{ "Event": { "published": true, "date": "2023-06-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-17", "timestamp": 1687046581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "35196e80-077d-4f29-8c43-88e086b69f31", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161ed37e-0d20-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687014195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687014195, "uuid": "15ec9ded-4832-4744-8686-54f4d1a066e3", "comment": "Malware payload (AgentTesla)", "value": "bcf6e584d3d2ab249db80ce27accdb9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687014195, "uuid": "cee50105-df57-477f-bb2b-f7b691242a9c", "comment": "Malware payload (AgentTesla)", "value": "0025fa6f194a33862ff4241a1fefed9477645cb36cb99e65d05b639b29dcdcdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687014195, "uuid": "2bd9feb0-4bec-4c1e-951f-21989b0b7f59", "comment": "Malware payload (AgentTesla)", "value": "6dfb35d26795ed8bf6e1f0975c179b35312d8110", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687014195, "uuid": "737da281-d62a-45bf-b2c5-de1a5be7facd", "comment": "Malware payload (AgentTesla)", "value": "b89415c881b525cce1f66e6c30cc2fe96bbcc536af152cec19f5e26b915b04666e82f6d403ea77a72538a5f1a3da798f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687014195, "uuid": "7dfbaea1-9962-4c7c-92f1-ae3a393918ee", "value": "T174340217B6EB92B1C68D55B3C49B90050371DBD23913FB0EA98D37288E837DF0266AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687014195, "uuid": "3facda44-1bbe-40a4-bb7a-8d01d307ab3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687014195, "uuid": "66ebc55a-e14d-4de3-8a6b-01c90f8b84c2", "value": "6144:60io1wzuwh9ogXuVxTstqi/u0A0tMPIMV:f91w1BuVRk/ub0yPIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687014195, "uuid": "b7eed3fd-cbd6-48e5-a511-eede6a9a8ce5", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687014195, "uuid": "744a89a6-1157-46eb-97ff-156eaf4341fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687014195, "uuid": "388421ef-a352-4cb1-a4f4-efbbaf5e73f4", "value": "SwiftConfirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb6564c-0d48-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687031733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687031733, "uuid": "26927c4b-330b-45fb-97df-39a56ab311ad", "comment": "Malware payload (RedLineStealer)", "value": "b4dfe347766e8628764b8f372a481b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687031733, "uuid": "f5a35f81-7661-433b-953d-e4e4535c2ce9", "comment": "Malware payload (RedLineStealer)", "value": "0062bcc8f31b6b25b737f6a4574b1cbafa89543fe62c8271a704eaff6210f64d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687031733, "uuid": "51207a4d-494a-48d1-9d85-3dc810510754", "comment": "Malware payload (RedLineStealer)", "value": "efb049bacf79c02846504748e5c5d973cd93a33f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687031733, "uuid": "0d720962-b853-4482-94f7-e8afc3c2c1e9", "comment": "Malware payload (RedLineStealer)", "value": "3272adc880a19d552ea5f81e6324a7043cdf9e83239e0b62e62503dcbcd396326c8f9de6b67806b1ddf6163683774af4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687031733, "uuid": "14fd341d-1abf-4655-a2bc-3f7bf4b400de", "value": "T1A6F41216A3E44162EDBA577098F713C31E3B7EB28974A72B2395985E1C739C0643273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687031733, "uuid": "f147dc63-64de-4ce5-b10c-8758ede5e98f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687031733, "uuid": "92f0daa4-7080-4788-bff9-21fd830490c3", "value": "12288:WMrxy90Omrx7hppGsxDOCj11sPqiZnzC3HwLwoMS1QLo/GMDENkr0bpjQqM:Py4FdpUsp7siWnzEH+8oDDECYl0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687031733, "uuid": "a33c985f-30f8-4052-9415-51b6dfb4c2d3", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687031733, "uuid": "026e9f4a-133a-4160-a43c-948666231552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687031733, "uuid": "116940a2-7c9d-4e29-83e0-e683673e22e1", "value": "b4dfe347766e8628764b8f372a481b1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf184ca0-0d36-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687023928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687023928, "uuid": "86cab790-d279-4f73-b017-1d16a3f78603", "comment": "Malware payload (RedLineStealer)", "value": "b8801107e4a783ca9e9efe2e6ca47057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687023928, "uuid": "c7389334-b92f-4dd1-96f8-0ec368dad143", "comment": "Malware payload (RedLineStealer)", "value": "014c09103caf1ea9126623cb475b2c6fe8697367d1b9fb9ebbd44d48763d7fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687023928, "uuid": "935b04b7-700c-4133-b8f5-cafd8eb95fc0", "comment": "Malware payload (RedLineStealer)", "value": "4e31ebfa61ee40613e8122cc904515b1aedd9a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687023928, "uuid": "9967d8ce-c201-424e-9d04-e47d1c39ced7", "comment": "Malware payload (RedLineStealer)", "value": "1cff9eee1d81965fcdb43504335de229c73598e73b88dd2ae417f855d2127c0ac2e654b0b7953117bb2252bdc6e4bbbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687023928, "uuid": "fb740dd1-55e8-409c-902d-a0d447f0fc62", "value": "T150F41366AAEC5132EC75377089F30B831A3BBE611CB983272605591F19B295470B1B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687023928, "uuid": "5662cc05-f901-403e-bc88-8da971887d11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687023928, "uuid": "3ad441df-d4f9-4639-bf9a-1bb0c324df20", "value": "12288:qMr/y90mml70g2C4xxL/JnqwQKdLIblCFh3VHoUhia4y128iTqBRTFT8DCh+G:dyK0g2dtVtrPFBhb1+m4D++G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687023928, "uuid": "638ff25a-ef2f-42ba-85a3-71254bea2776", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687023928, "uuid": "7c8e9768-3312-44c4-a7b5-28144f265466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687023928, "uuid": "edd2ae0a-65a5-4032-abbd-ccf2687944a8", "value": "b8801107e4a783ca9e9efe2e6ca47057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffb756e-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045458, "uuid": "a5785d30-fec9-4d38-8023-128dfa819b08", "comment": "Malware payload", "value": "14fd9e962953cd058bf47a33e2696259", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045458, "uuid": "abb49954-dca6-42f2-9c0a-b710283b20bd", "comment": "Malware payload", "value": "01e84cc7137eba014bf17f10b24315889c13d1f21b16a75c4387a97fa68a3916", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045458, "uuid": "d09a8363-92db-48c1-b17a-9de10717c4f0", "comment": "Malware payload", "value": "a17a10c0e6fa9c7654c1e5b6457486b274c72c85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045458, "uuid": "38cf9137-e807-49d9-a03a-69cc9a67d702", "comment": "Malware payload", "value": "a1907cc2b0d0db42969e9c1f28949d0b1fe4757743f12964105147819feebbdb5b6ee7b8ffedd69d38052a98c2b00c78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045458, "uuid": "6ae86847-baa5-40b2-9020-ea74c6a97161", "value": "T14F63A51A6E628FEDF659833447B78E21AB5823D527D1D681E26CD6002F7034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045458, "uuid": "e1c592ce-a409-4efe-a1df-2a119c845955", "value": "768:YaDrpAYA0od2i+mbbRdggK8XomvQaQYdYHt0WsbrHroX1y/ule3fCdw/MImV:Y/GGB58DnHtYb/AVevCW/M9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045458, "uuid": "5dc5d0d6-cc83-4c1d-b199-2517051e1dcf", "value": 72284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045458, "uuid": "7108b397-5987-4c85-8816-3f854ded4cca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045458, "uuid": "2240773c-c07e-4401-a167-7fdce2dafc5e", "value": "14fd9e962953cd058bf47a33e2696259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb73c99-0d1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687012815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012815, "uuid": "9d7d2d68-abb7-460c-aaae-44d93d350b00", "comment": "Malware payload (RedLineStealer)", "value": "274037f659958f0ff56331ccf024db84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012815, "uuid": "f246978d-cad1-4b7c-a422-3a59bacbd2b8", "comment": "Malware payload (RedLineStealer)", "value": "0278140decbf6f24c966fe3cea29e58cfd7d8a6c532f66e83e925d6543e0ec18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012815, "uuid": "02394572-5ebf-4e4c-a3c7-96dc718d0d73", "comment": "Malware payload (RedLineStealer)", "value": "41d4d95fabf0eb95055459577030f5e1941e4694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012815, "uuid": "38f3c49c-7ac7-452c-b046-bb98bde02bf2", "comment": "Malware payload (RedLineStealer)", "value": "eefcb02aff69da78648c018a4298f289adc4e9f3ef1f46eaa94d0433243023ecdb5fb2ea2bbd90785ee59470056c1d66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012815, "uuid": "f1a1989a-1651-4b70-870b-e0cf638e941e", "value": "T1A5C41212A3D49033DCF15BB418F302A71A36FCA28D74939A27859D5A4CB3BD0A976377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012815, "uuid": "81514f60-0398-4650-acbb-9987e02ac7bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012815, "uuid": "3b73d2b8-3642-4491-bf5c-1dcee82e6419", "value": "12288:WMrMy90j0hzATJ00xs353m9r2HsWdipyaq/gG2n+juJX80:GyDu0esEesHpxOgGL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687012815, "uuid": "226fd296-f3c4-4421-b38f-33cb9654d693", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687012815, "uuid": "85165a37-d8ed-4964-b630-15b1fbc5976f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012815, "uuid": "629e3bef-9cab-456f-94c5-361f34735ebf", "value": "274037f659958f0ff56331ccf024db84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd972f3c-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045454, "uuid": "21f9e6ec-acd5-4c0f-b8e0-5689f308921f", "comment": "Malware payload", "value": "2f4878232aeac3b8eeb92ff407f31497", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045454, "uuid": "69ee9cda-194b-4265-b3ee-bf68643d6f73", "comment": "Malware payload", "value": "0283169db50730dea7596bc0ba509414753f8cc816813eae58dcc90cc0314436", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045454, "uuid": "2e8d3c81-d83c-4912-b3ab-628216f0bedf", "comment": "Malware payload", "value": "1d1a1470319f528ce95126da4f02f675a31f9418", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045454, "uuid": "09928b80-a5c1-4387-9344-f9d0894d4784", "comment": "Malware payload", "value": "81804c871796113e9e1a4353b8332c54438771aa2681ee5fb0e79279d7fa8f79364d1695d276676e4d24dbe3e23f1b1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045454, "uuid": "4e031e95-7329-4771-a035-89440b059606", "value": "T1FF63D715FF550FB7DCABCD3745A81B0239CC554A22E87B3A3934D428B65B24B49E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045454, "uuid": "e55cc1be-e389-47a3-9544-9435060f1f34", "value": "1536:iFgYAXFOJ6AmxjvTL2ZJaOLuV4kWL/Yx:iFgYuOWTL2a43L/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045454, "uuid": "0438ce5c-aa36-42ad-bfbd-5b6af8e161c0", "value": 73212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045454, "uuid": "d12e48c2-f866-462a-a9a0-10a227993c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045454, "uuid": "f2321537-03d2-4d6d-a8ff-dc3019eda666", "value": "2f4878232aeac3b8eeb92ff407f31497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0a7861-0cf3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1686995225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995225, "uuid": "b1d39ee9-3786-4c13-b5a6-f8c15f8fea64", "comment": "Malware payload (LaplasClipper)", "value": "7e1c47ca9cef11631ddd096c1d3639c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995225, "uuid": "68c5e3c2-1911-48c2-b5d2-550fc03d9cd4", "comment": "Malware payload (LaplasClipper)", "value": "02c640ef3ac9d7fa8c919b0f72bb85413ef3e9803d2d091277b9a7c41f52e9d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995225, "uuid": "40b8b8ba-3bf7-45a3-b32d-bb955e2a7895", "comment": "Malware payload (LaplasClipper)", "value": "4e8d9b1efb8b4b7b316e5a7fd3fb808e2da759a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995225, "uuid": "e497ee6d-9e5f-45f1-bca0-b4bc8458322f", "comment": "Malware payload (LaplasClipper)", "value": "d5141080577292e1d2d9c859d74f5dd8bda0458862cf9e5d62b454562b6d3065689f86dd75477961faac28f99f726025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995225, "uuid": "9100dd2c-6f7f-4f93-9dd1-499a8698307b", "value": "T1A0C4183473A08C2CF9643E3B1E23FAB63558A0E6374C24A733D4C18599B15BF965F91A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995225, "uuid": "78cc1bbf-5e88-4a66-bc2b-53ad7a9cc0ca", "value": "2fe73b1edf18bd6736d0f71d5f78f29c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995225, "uuid": "ee2fbf73-965d-4c1a-9a9e-3d10a3c4bdd5", "value": "6144:qTov37S4OHn8MDIYKReFMjkyI/VYXVhUYbjDyVlQBCVTI:qcv37SajRVjziVq3gVlsCVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686995225, "uuid": "0b9bef3e-cd48-47ca-8739-982afa0746cc", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686995225, "uuid": "4e48cf88-15f8-4cf2-8ff6-5e29629fb001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995225, "uuid": "67fd9a7c-0ac1-4898-bc00-213cfc8fa0f0", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b742f0c8-0d10-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687007594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007594, "uuid": "f322f439-13d4-485c-b763-75d6cc3f7987", "comment": "Malware payload", "value": "10d502ddd6ef70cd18e117adb6b66f85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007594, "uuid": "d7065172-5e2d-4e8a-9aad-e2a46b2d2471", "comment": "Malware payload", "value": "02e375566de78870ae7ae1676c57706abeead9827e0a77fbc33db572adfaebf2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007594, "uuid": "6c0dd4b8-04d1-4bab-a0e0-17785d613136", "comment": "Malware payload", "value": "bcc702436e820991a51690347704b409e80f1594", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007594, "uuid": "0782d35c-3d84-4827-89b6-c6b54ca012b5", "comment": "Malware payload", "value": "9406a998085a6bc90e2d932da0e1a10b105720d9a1104a4ce5480a75f93f0c41aa04b6efca7f59f009318777a14e5aa0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007594, "uuid": "d36158a9-fee6-4182-94e0-24d5d29eb4dc", "value": "T1ED0574B82A4026ABD776DEB241E2044BF27B7727B2239D5826D213C5472151F37EDA0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007594, "uuid": "1b5d07d2-0e0a-4394-98e4-e0af9aa528f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007594, "uuid": "efca6c31-1978-4c1e-b7d7-b3b0d968951d", "value": "12288:2yOs3G5seskaEG95JnJJziBiOmT/mzcPPboVAtNqdODH:2yO3BG9TMsOzAbjsdOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687007594, "uuid": "c602fc19-244c-4f39-acac-90d255bd505c", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687007594, "uuid": "c6e2a3fe-a946-4b71-a76c-5a0e52e72376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007594, "uuid": "8aa0a300-cea2-4f3a-a614-49a19661436f", "value": "BCOvhfBcjK52OXY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebbcfa9-0d58-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687038342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038342, "uuid": "f3497643-2850-42dc-a914-9992992db0ed", "comment": "Malware payload (Amadey)", "value": "21470d42fabfc1a410edd15b970352c0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038342, "uuid": "41074d82-d963-4a1f-8056-6649f174c9bf", "comment": "Malware payload (Amadey)", "value": "0570a28fd29a6c8eb848e271bd0abe3b9a158e9931cf334d050b2454f2f771df", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038342, "uuid": "958bc889-77c8-4724-a4f7-25fc3257f705", "comment": "Malware payload (Amadey)", "value": "0a776d3be6e1d9731ab239e37210eb3cd4e154d5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038342, "uuid": "38c5132e-78e7-4fc7-b2ab-b9520a6b45bc", "comment": "Malware payload (Amadey)", "value": "901e54f708497c66cdb279eeb85df1e03a0c0044495c656430bf9e49e243d52f3826ad24509ebfa162350600b0306e8f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038342, "uuid": "4518ba69-0b56-4025-9389-53146a16c028", "value": "T110F42313BBD44573E9F62B7018B712930A36BC909D744BAF3749689E1873BC0A57272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038342, "uuid": "18e66edf-e664-4278-81d0-97c607227b03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038342, "uuid": "4eabd032-6698-4688-b860-758a8d063306", "value": "12288:BMrVy90WuH9J9HcBVvcIGiWnPpkSDE10T82m6oYlmAisUY23Z1Wx:My1w9J98nRSPHo0Q28Ylmxx1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687038342, "uuid": "99839525-842b-4997-adf2-41e2d670955c", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687038342, "uuid": "c55e3a2f-b758-44a1-8354-475461d89212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038342, "uuid": "ded57c67-d6c4-483b-8579-f56799da7716", "value": "21470d42fabfc1a410edd15b970352c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6aa5a9-0cf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686996192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996192, "uuid": "808c9f9a-b7ac-40d8-8a7a-d7f29be4ac1f", "comment": "Malware payload (GCleaner)", "value": "da9016c0c6c80d80efcfd0c2d1a417fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996192, "uuid": "2d6989ff-863c-402e-95d2-bc448a865d64", "comment": "Malware payload (GCleaner)", "value": "06b1f0c7bcebfc00a38b2fecc85de193cf598a7029196dd12bd1226e65db6b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996192, "uuid": "d2658e64-e3f6-481c-8166-e5cca9fa66ca", "comment": "Malware payload (GCleaner)", "value": "c6d57797aba069cab99ec0960e8ae5b94f65665a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996192, "uuid": "29086f99-20f9-4dd5-beca-812157a789cb", "comment": "Malware payload (GCleaner)", "value": "6ea64b3a4c468e90e9cbcd0eef63fcab614b8f4e69bbc17b5239c4206a370604ee473e725ca430c0d99f684d8ce16ec0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996192, "uuid": "656e3614-9960-41cd-9eb3-c61cc3d9dc4a", "value": "T13084F74392F23D40EA758F729E2FC2E8361FF2518E597B6D5129AB2F04B10B2D163761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996192, "uuid": "8c28b298-4046-4c07-ac00-8e06913f0594", "value": "fcc5ef716ee1fee9b7ffaf9728383a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996192, "uuid": "7fa2c9e8-97b6-4655-87f7-dce8685cffe1", "value": "3072:u3gCdCDxxxFOJYLm2/e8azOY+mi/4OZfpHIMZ7xKRH6B9/DMNeMmIjto01TVw/Vm:eCnO41/ZgD+28LtxQaFMPj+giUB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996192, "uuid": "29beb99f-09b9-48bd-991c-f705de6c3d85", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996192, "uuid": "5aec076f-3a0c-42c5-b897-37ace27e593e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996192, "uuid": "4bcddbb2-b169-452b-aca0-97c749826464", "value": "da9016c0c6c80d80efcfd0c2d1a417fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19ba5d2-0d5a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687039447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039447, "uuid": "b3fa41d9-dd1a-4590-8b5f-513123989408", "comment": "Malware payload (RedLineStealer)", "value": "b4eef8e785ace2ca885da616b17086af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039447, "uuid": "fbd600a2-f1ea-46da-9b03-b2723a4aa7bb", "comment": "Malware payload (RedLineStealer)", "value": "0744d0df09bd1c4f39364329a0f9337e684ef581000a0151461ac0c96eed7afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039447, "uuid": "616b8819-5b28-461e-9def-5c9dbd29382b", "comment": "Malware payload (RedLineStealer)", "value": "eb95bc96a2813889a3d9303d671b7e1ec321b161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039447, "uuid": "179330a5-272a-4702-84d1-9da0798afa95", "comment": "Malware payload (RedLineStealer)", "value": "b838eb2af5b898d57dd090a9a9b6a623799cbe632c7940db44f7b799003c06ae314f133c4cd5524fc6f801fbb0d6cdcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039447, "uuid": "5c3dc58e-4d43-4e69-bfe0-3a101914b6ae", "value": "T13844290271E0FD24D401487FB47A429BB5AE68DFF7E8C4F6126421DB2A572992F39336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039447, "uuid": "df47d9cc-f759-432e-9850-648a1eaea0b0", "value": "ce750fa4da93b0efee3dcc00247f3365", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039447, "uuid": "ebc3e8c3-a7a2-4098-a261-a591830123cd", "value": "3072:VaBb6SvakP5CJky9Syptei7hZY5oQmK8qYBVHjSrxxQTgxlz1oeo4fM:VfSSkQJkAtthZYrmK8qQ2rwTgxlzqwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687039447, "uuid": "d9aba225-5e27-43f7-acf1-b484701ab938", "value": 265220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687039447, "uuid": "0b9488d5-44ee-48f3-801b-8a9f2089e9f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039447, "uuid": "a6f46264-4b5e-4afb-8508-34e9d31e93a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d78a21e-0d41-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687028435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028435, "uuid": "d556a5e8-bf67-4381-b8ce-c4644d431a6f", "comment": "Malware payload (RedLineStealer)", "value": "c222e505ce4f01374166f9df373732d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028435, "uuid": "d57a38f2-ec1c-498a-a2ef-d2b502c92773", "comment": "Malware payload (RedLineStealer)", "value": "07d6060348300a5607af6a943a73e2b56e32bb289cd98efb556520fd34f595e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028435, "uuid": "be824914-3319-43d4-9f83-3ff71ca2c69b", "comment": "Malware payload (RedLineStealer)", "value": "2b3fafad40e6f4ac0b8dd2cca6685230f158d607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028435, "uuid": "d55fc452-f165-41bc-b747-b299e236734e", "comment": "Malware payload (RedLineStealer)", "value": "635b5b6fa540428a15a8a9b52b1248e9a059f442607bb826bcea13b990bc1be0f2aa5b8f946d6b347e3387b58cd82f01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028435, "uuid": "de6a8f0c-4bd8-4581-9975-1f08b4f53b22", "value": "T13AC41212E7D84872DCB1377028FA07C31A35BCA68E78439B37559A5B4CB22C5A97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028435, "uuid": "5a04c5ec-b726-4b58-b33e-af0a95c32188", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028435, "uuid": "f35e53be-992f-475a-9c1c-cb255dac0e14", "value": "12288:ZMr3y90QrlIKnyfPDcf8R3od9PrCf4wumbh:qyLneyuf4wuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687028435, "uuid": "2a467767-24b2-43c8-9e2e-2127222a44ac", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687028435, "uuid": "585f5317-829b-4d92-a851-5ae758f237b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028435, "uuid": "65a6bc6c-87a4-403a-bc40-90798c90364a", "value": "c222e505ce4f01374166f9df373732d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad254fd-0d23-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687015518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015518, "uuid": "01766565-c864-42d4-aed9-114d1af5aa62", "comment": "Malware payload (RedLineStealer)", "value": "88b3356a28c55fde94ef5d4f76681bc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015518, "uuid": "f1829987-7b5c-44ef-8742-874faa1b9bb0", "comment": "Malware payload (RedLineStealer)", "value": "087c532422bfb865eed6ffdaad1c5af374c4c35a2e3866e23d54f4a21524c405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015518, "uuid": "09f3e2dd-463c-49bd-8f36-3272e847851f", "comment": "Malware payload (RedLineStealer)", "value": "95bd235ac345bf184667b5bc53877457ef3cb30a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015518, "uuid": "81a29aa8-c7a2-41a6-8502-9972546223cb", "comment": "Malware payload (RedLineStealer)", "value": "1ae405a984d9a3d65ecc4015e1e8ea4a0249fb31e3cd71284a629be3ec0c9c65f52b6eab1430de751a7125842c5a69f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015518, "uuid": "bdaf2c6d-e4dd-4177-9b91-efa28d151727", "value": "T1520513A3ABE44563D9B537705DF603830F397DB19C38C62B2259A84A8C725D4EA3137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015518, "uuid": "d5d550ff-7b63-4c67-888c-8e6bdebe8a8d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015518, "uuid": "ee03d8e2-770e-4be5-9074-ecf75d6bc6a1", "value": "24576:byz6D30Me8db8LFwMYU2L6g5LbDp7BQGxjB:Oz6gXuohwtL62bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687015518, "uuid": "1d685b04-8359-480f-af6b-cf996b599269", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687015518, "uuid": "0a26879b-a9e8-4584-8fd2-3c1f9b1b5590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015518, "uuid": "1d87ce41-aa02-40cf-84f2-f7905abd81fa", "value": "88b3356a28c55fde94ef5d4f76681bc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816d748b-0d55-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687037138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037138, "uuid": "9e9a74fd-5d17-4838-8388-b173059792a1", "comment": "Malware payload (RedLineStealer)", "value": "57d84c62a840583ea2b5f83b0072720b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037138, "uuid": "3a73a473-3d85-4de1-86ae-2a5beb456003", "comment": "Malware payload (RedLineStealer)", "value": "099a27fe88e3310ca62f14be7ebaacee132863c630f8702c7dce1d0cb76796b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037138, "uuid": "6f7e84bd-4f3c-4c47-8fb7-49a8b99c5ce8", "comment": "Malware payload (RedLineStealer)", "value": "dd923e6dfcae1da2e3ae41a72dd9ef0d1070751c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037138, "uuid": "5f4d8ec0-6375-41bd-aa2f-1a23375c1087", "comment": "Malware payload (RedLineStealer)", "value": "d52d3ccd878e5230261027d5880bec33ca44a571fa3e1e5ac4997d32414dae880c7e93487af9a28d33c3a9e8279e2209", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037138, "uuid": "613ac6d1-ba88-455b-ba95-185e9dda31c4", "value": "T108F41206A6D89972E9B93B7014F603430B367C668C3C835E36589DDE0872BC9B97177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037138, "uuid": "bb7df787-c113-45f8-a8d4-273ca1d60415", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037138, "uuid": "7ddcb0a9-f1b7-4530-8f42-cbf80109b3ea", "value": "12288:JMrvy90nhAt7ZYF5Xp5UaMC91CEvMJFL010mV3qa0CtCLGtW:iyMo7ZYTHVMC9qjL0SmV3TFcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687037138, "uuid": "7e3f505d-f003-41a7-ba00-1dd872b1a906", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687037138, "uuid": "6e636455-ee50-4ca1-bded-af464a88bd5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037138, "uuid": "8edd3711-acdb-46de-a71b-bdfdfd9e8ba3", "value": "57d84c62a840583ea2b5f83b0072720b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702cf281-0d3e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687027231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687027231, "uuid": "d91a11a1-1443-499f-a11f-067c78c285ba", "comment": "Malware payload (RedLineStealer)", "value": "351d1bf167fa75809615735c794c5ca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687027231, "uuid": "5ee1878b-d64e-4947-b752-0a0c127ed524", "comment": "Malware payload (RedLineStealer)", "value": "09cd9944f2761d3979ad62282d3c17f82773d6e7b62caf3bcab294dbdb5c9d31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687027231, "uuid": "f032e324-0881-4482-b564-0acbb7404508", "comment": "Malware payload (RedLineStealer)", "value": "063757102a1a65a7626003b9dfaf89ed00978f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687027231, "uuid": "a1714022-7053-431b-a404-4b6054fb251d", "comment": "Malware payload (RedLineStealer)", "value": "35d3dcb6e9ba071f7e56796f3ce62312557e0983a0a69d860849b28d8ccc8f89d5934b69fee780ed561f47d8d1bc47a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687027231, "uuid": "1c558903-dab2-4a77-a0e8-3367ff2a0c03", "value": "T112C41213FAEC4433D5F21BB018FA0B931A327DB66D76826F2705A49E0DB2A846471777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687027231, "uuid": "c54ac13a-d254-43dc-bfc8-10fd77fec8e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687027231, "uuid": "02c7e3d6-ce1d-4904-adfc-d6a500b1bf7d", "value": "12288:yMrQy90aDvFTXPpXhrTsl5TCbLBdWHLAccXTjNOANRzVn6s+AbLc/:ey/XXI7KerArOANRzx6s+AbLc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687027231, "uuid": "7e80b7c6-4d07-4cbe-860c-96e504a4684f", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687027231, "uuid": "abdcfe6c-5bb3-4006-8e5b-700ed92434a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687027231, "uuid": "ddfb90e8-7c2c-4ade-9e2f-97fa8adc6999", "value": "351d1bf167fa75809615735c794c5ca1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7785e5b-0d59-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687038947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038947, "uuid": "695d27b7-a2a3-442b-8c16-2f54a6acd4c5", "comment": "Malware payload (RedLineStealer)", "value": "65adf49cb2badb9824c0c13816d063a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038947, "uuid": "28ccae26-ff25-422d-adde-696fa38b641f", "comment": "Malware payload (RedLineStealer)", "value": "0c73837399ae04e4b7016ebc2c030d22d8ff8d6f7f541af1ae306b23964131f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038947, "uuid": "fcd2a8be-326c-4f74-843d-fbe758d2dc4c", "comment": "Malware payload (RedLineStealer)", "value": "6639d1479c3d0788f97090970228337e06792144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038947, "uuid": "d5592d28-e56e-4efb-bead-45d684c5044a", "comment": "Malware payload (RedLineStealer)", "value": "fd21e38a942e595192b056fc13d6402eba839fd4f033b61f81d012d48ba4c27242758ea948ff40504ee21d17b9fc5581", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038947, "uuid": "8ed060c7-0417-4999-ac93-601264ad4b52", "value": "T1ECF42306ABD84033D9B52B7098FA03C30F397C914C74936B139AD99E4C72B94A9763B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038947, "uuid": "316bcc44-6bb2-46ac-b557-17f666122c3c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038947, "uuid": "53de16d9-8fe7-494f-97aa-f4c08a2b1beb", "value": "12288:tMrDy90b2ot+0QwozW+RoP7eLyT3XwV2e1iPTyTPOqri4Cul7o:eyaPLoS+RoP7cQwV2e1iPeLvXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687038947, "uuid": "b4e92457-a273-4ef4-9bb1-a16ee49a6d91", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687038947, "uuid": "f45334b1-68b0-4227-a138-f09742e52e60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038947, "uuid": "39583d32-ce3a-488d-b78f-5ca3575bffa5", "value": "65adf49cb2badb9824c0c13816d063a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b5f2a7-0cf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686996152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996152, "uuid": "3a95d1dc-9fd8-4d58-9fe8-bd07f4044e74", "comment": "Malware payload (GCleaner)", "value": "bd72910b547a8885dd63bce7a213292d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996152, "uuid": "0bb0ff9d-27f2-4217-a618-d08847155bc3", "comment": "Malware payload (GCleaner)", "value": "0c7ba42e83397dfd7b3013dfc6287e72632a7b3d8dd5379819c53cd3dde1f61f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996152, "uuid": "bcaeeb42-9870-4f48-997b-6ab62b8b3183", "comment": "Malware payload (GCleaner)", "value": "1077990980c36b0bfd42682c9138882e5063a964", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996152, "uuid": "95517c6a-d881-4b67-aa39-41ee06f8e8ac", "comment": "Malware payload (GCleaner)", "value": "a1c6730b53c7f17f42b7d1377112632f5ffd9089c1a9db40b10d2a255463fcf9e9a7378dd13ed5895ddddde3aa53bd89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996152, "uuid": "9a367a69-f2bc-44eb-a68d-513829c7bc86", "value": "T1B8944B4362E17D50EA656B329F2FD6EC761EF250CE5D3B64222AAB1F05712B2C173702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996152, "uuid": "b71f70ab-71af-46b6-82fa-7e2793001db6", "value": "ff663290422cfc5dabe317e4ebb150ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996152, "uuid": "acbf0179-37b9-4e7d-88bd-7a046cf80e21", "value": "6144:UXFd72ojMsalEsivr7Es0xBRpQVfiTv6+6gMpRA:wCojMsFPzMDpQV6jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996152, "uuid": "7df3adc2-eabd-4d34-af4e-f570c8cc0efe", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996152, "uuid": "eac87493-962c-425c-95f1-1ccc37a8270d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996152, "uuid": "71e5a0e2-d0cd-457b-8f71-73eb307d79b5", "value": "bd72910b547a8885dd63bce7a213292d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4609546-0d3b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687026030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026030, "uuid": "4f13ac27-9830-4585-9570-25fef7059a21", "comment": "Malware payload (RedLineStealer)", "value": "60e2e910dcf0bf3ec511a6a8a96517c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026030, "uuid": "70589043-9245-42ef-be55-46f27dcd0aff", "comment": "Malware payload (RedLineStealer)", "value": "0d171af287469dcb4d710c5ad03a6f042098e501106199ae016bedfa5ef50dcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026030, "uuid": "fb3b22f6-5e09-4727-a2d3-2f1050e71614", "comment": "Malware payload (RedLineStealer)", "value": "36b653555a792d8a23edd3fd50fcbce19bee10f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026030, "uuid": "e97e7114-c45d-4754-99a6-fc6b02bf3a01", "comment": "Malware payload (RedLineStealer)", "value": "558e54efe6d0b8e0c10a9e7da31b1beeb8b31f72194d2e67ba6c4189a1847f57d32dd1c2bffeb239e76411243bc809e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026030, "uuid": "b40d7da0-143f-47b8-83bd-cfdbe677abea", "value": "T160443A1231E0BD24D405487FB479469BB6AE68DFF7D8C4FA152421DB2A172892F3D33A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026030, "uuid": "2233eabb-09c5-40e8-8173-df8168905081", "value": "8b20c0aa1a6b70c064e1b0a2222ddac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026030, "uuid": "e4ee8b7e-0f4b-44db-a350-7d4f986b16d0", "value": "3072:qpmbUZsF++CnDLAypR0Hgm6SeqsRoAmgzmkm0GxpSHyQrpbRutnlz18Ft0x:Ug+pn9Seqs7mgzmkm0G+pr3uZlzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687026030, "uuid": "f139a7ee-084b-45c9-8798-bebaa02c8632", "value": 269592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687026030, "uuid": "e7b1d586-cca6-4972-845e-bb8bf9c746fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026030, "uuid": "709698f3-8538-4862-b6d1-6d07cbb39ccc", "value": "60e2e910dcf0bf3ec511a6a8a96517c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd70733-0cf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686996168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996168, "uuid": "9716f0cd-e726-4161-bfad-85a572ded5c9", "comment": "Malware payload (GCleaner)", "value": "507c718fee56d26bc5532456c3b4f3d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996168, "uuid": "88eaf5d2-c46e-45e5-82c7-acb30616370f", "comment": "Malware payload (GCleaner)", "value": "0e295dbc421c8e73e3fc2164743c6866b2749ccc259f170ed64438a703184d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996168, "uuid": "ae4774da-251b-41a0-bd6e-2bb4ae9726cb", "comment": "Malware payload (GCleaner)", "value": "bf8adef685a2f9791db46491f3ce3c86ec43da25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996168, "uuid": "28a80624-490e-4eef-832f-08fb8ffc8883", "comment": "Malware payload (GCleaner)", "value": "adc7b0a04ab829c3b04ec9226318d2c9e9fe24e1ea55e59916bf9dffdd6adad93266a695f0c900f3d4776fbf334aabbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996168, "uuid": "208ae473-334b-4a11-9561-1aab904d02ec", "value": "T1FEA45C53A2E27C51EA758F328E2FC6E8361FF1504F187B9EA2589B2F09711B2C572711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996168, "uuid": "eeab342e-dac0-4a21-85eb-48bbf5692716", "value": "e712b9ea811eddc692156be9406ceff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996168, "uuid": "509945ed-55f2-4368-ac95-9a60c996a35f", "value": "3072:EzfUYACri/Xvipv8BFF2cN4OIUk4W6it41TA2X/rS92NUZwjDkaXcNLKPkLKOm+8:NCr6iu52A4UWuytKDFuLKcNcfX4OB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996168, "uuid": "3228b964-5392-4f23-9997-37ca1b1bd50a", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996168, "uuid": "018a01e2-fedd-446c-9a0a-d766a827eebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996168, "uuid": "efe9c96e-100d-470b-a9f0-d3589f206087", "value": "507c718fee56d26bc5532456c3b4f3d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb51fea-0cc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686974052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686974052, "uuid": "b11dd8f3-3766-43bc-a059-5a882ca8ec20", "comment": "Malware payload (AgentTesla)", "value": "1680103ba897689ec92f5940e043afb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686974052, "uuid": "f094e4fe-abac-4622-a47e-72bfb51a405c", "comment": "Malware payload (AgentTesla)", "value": "0fb2fc1ae6abaa05ced5259a6962c80b6e7bb8dd88e1a737958cd42458ce1b50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686974052, "uuid": "7d2b50cd-db9f-4d19-b4be-cd805e906f30", "comment": "Malware payload (AgentTesla)", "value": "9b9edf3561b86317eaa9794bb1663fb173fec96c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686974052, "uuid": "6e801d86-b470-4685-96c6-2a2ebbaea584", "comment": "Malware payload (AgentTesla)", "value": "63b45dc829fa59ae0c6b5ff9fb25d699119c76c234192cf8e063956c1391782a6519b4ff8414675dd9949bbcbf514b33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686974052, "uuid": "9b7805d5-2186-4665-9760-1cc2eebc755a", "value": "T1975412443770C463F49207710D7B6B66AFB3D12359B9813B67606B583EBB2E2992B313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686974052, "uuid": "c1dff8de-6a63-48f7-8200-89ad61290ef1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686974052, "uuid": "558bfa9d-aa4d-4256-b271-e0b3a2befd8c", "value": "6144:/Ya6XMVYClWSQFqDJgt3WVTVccAP9pUp6ntMx13XstBJS/:/YVMVLIpIFW3YTVbAP9pk6GX3ctBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686974052, "uuid": "9a506d85-02ec-4d7e-90d9-0992275aed51", "value": 290053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686974052, "uuid": "14a8cb66-a5cb-4c2f-8987-194bf18b71e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686974052, "uuid": "cbd218f1-8645-46bf-9fa6-8df63b763364", "value": "1680103ba897689ec92f5940e043afb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8f9edf-0d32-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687022130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022130, "uuid": "82a1a55b-51b1-40fe-b3c9-1955fbf7b7eb", "comment": "Malware payload (Amadey)", "value": "c58783800a0f1e652669de2ff3685ac6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022130, "uuid": "3863b964-3423-4684-b6f7-538521c6edbc", "comment": "Malware payload (Amadey)", "value": "106fc61797e984b57dbd81db57b754932b3de0977b98f4c34a50c897189905e1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022130, "uuid": "4df42028-d3d1-403d-86fe-287cb9bf2b4a", "comment": "Malware payload (Amadey)", "value": "858bd31532ce7bd92bc321d2eb7196a2fed2512e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022130, "uuid": "08901586-1ce3-49cd-8373-84ec48917fcf", "comment": "Malware payload (Amadey)", "value": "7590fd38b1f22bdf5b17de994e3f5950e0aafc919f3de5797a0c56e3c820d6c53a27bccccade9bfb968ddaf092d81a41", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022130, "uuid": "50d29c47-1e0c-442d-a5d9-45f08714a8fe", "value": "T1EBF41213B7E98436E4F2233155F603D30B397DA08A7893AB16195CAD0C72AE4F93577A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022130, "uuid": "dfbfb817-2017-4a0d-bf6a-82aa4665ec1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022130, "uuid": "24863bf6-34fc-4cfc-95ed-32a3b3b2617a", "value": "12288:XMrHy90/GiCjgm21fj/TXigw4eRUGUFagNXD+BHEg1+y1O3d5AkEEbOI+r:Qy+d/m21vZon2RqT1+hIEb+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687022130, "uuid": "9d97f6ae-e567-4f32-b80c-d93e6d18211b", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687022130, "uuid": "4a7efb5e-bd1c-4d5b-9610-052416e96705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022130, "uuid": "c4cd6431-7c28-47c3-ab00-ae4f078836bc", "value": "c58783800a0f1e652669de2ff3685ac6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97ee88c-0cd1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686980593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686980593, "uuid": "62cc01b1-4c3e-43e7-bc9b-934ebbf15d8c", "comment": "Malware payload (AgentTesla)", "value": "21b73c612b5ec316cdcd5ddaca49e10d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686980593, "uuid": "0b8e2906-f9f1-4a5f-8487-aae11f93d32e", "comment": "Malware payload (AgentTesla)", "value": "1445df50c20bc522a9a3a27e89e5b14004b1cb208cc72073e3f8d7ada1e7f415", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686980593, "uuid": "0573d4ad-6904-4190-897b-3984d97bc389", "comment": "Malware payload (AgentTesla)", "value": "10512de9cd70c59b3fc97644610190d2abe6f76c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686980593, "uuid": "4a2834e3-3ac4-4b77-a5aa-b8ea700dfa6e", "comment": "Malware payload (AgentTesla)", "value": "081b5138449903c131dc9dba32ff00c7fd66ede1d236eb97068afa058bfce8e0f6104c51dc92df6045c17efd8bd6d84b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686980593, "uuid": "28eb2764-bf18-4b9f-964c-3eaf99ed6376", "value": "T1645402166A94D8EBD4131F3058763F16A9A7ED30BC7033076B9473693BB72D1891EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686980593, "uuid": "880847c4-0280-48fd-aadf-78eba8b55c13", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686980593, "uuid": "d6451967-bd62-49fe-90a7-9526fbf206e1", "value": "6144:OYa650qgz/G8pfxAoz/MqEv72AJWIC2EehJZPOmrQOCB7gjsiJP:OYvF2faEyRW+EehXOm3CRl4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686980593, "uuid": "3312d7b9-7693-41cd-9c4d-fbc499ee1510", "value": 305881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686980593, "uuid": "9f7c2f05-4d15-4b78-a2d3-b08af1c5b225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686980593, "uuid": "44c4ac15-9779-4f04-8269-ff65a9dd3bc1", "value": "snr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7281a0b2-0d08-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687004042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004042, "uuid": "05e4a9e4-7568-4a82-81ce-cf6893b2b963", "comment": "Malware payload", "value": "e5eb80ad4887a35204feb394094952de", "object_relation": "md5", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004042, "uuid": "47baa8b3-497e-4796-9261-2eb85ebd8a0a", "comment": "Malware payload", "value": "1458502f67db3a702df91691189a5b2022ecd1ec5a0ca809eeff9692c1379fb4", "object_relation": "sha256", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004042, "uuid": "7464bc44-c4fb-4a24-b086-6bfb3d8b0f3f", "comment": "Malware payload", "value": "6052886c6154ab45c4dfa5cead2f90d6fdbf403e", "object_relation": "sha1", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004042, "uuid": "a66a8fe9-d33b-4206-aefa-1297317de91f", "comment": "Malware payload", "value": "d3d7b1cfe95c7d5c50d3b654e78d84b702a7a9b6723fd0c4e8e75958bf972651c85b69296af3f6b175bece969b6d9993", "object_relation": "sha3-384", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004042, "uuid": "cdcfea2a-1632-467f-9186-edf9692e40fb", "value": "T19952F81D6BE44334EABEAF365C7291400672FE04D923EF6E09D9901D5C736548EE1F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004042, "uuid": "8308ab7e-7eda-4d95-afc5-d06b6063ad7b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004042, "uuid": "1c2ecc43-5ec5-45e9-bc0a-fcc1aec8ae5e", "value": "192:Sp3AJUFIWJm/sfCJBWEbKu8BZ5FGOsT1Vu4IW1CchI6gQHsmEEMKkrdzL2qH2:SpQFWA/5Uu8BMJVu3chtdsmBkrAqH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687004042, "uuid": "0b5723a0-8435-45a9-9676-d9e91eec78da", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687004042, "uuid": "87f38aad-7272-49c0-bf09-7433ea2ba41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004042, "uuid": "869c07c4-fe90-4485-bf38-64706fb92cb0", "value": "CdWDdB.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c86287b-0ca2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686960304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960304, "uuid": "0ac446ae-fd05-4a04-962f-857244bddc2b", "comment": "Malware payload (RedLineStealer)", "value": "5dcc9f3d83b1a0567975bb4287989d8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960304, "uuid": "2ed8f9bd-b376-4ea0-b4dd-7d1130605f27", "comment": "Malware payload (RedLineStealer)", "value": "14ad0b220fec046cad2a8e8dff2d89f107566da3f68c011c225fa6bab29c52ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960304, "uuid": "a6587086-11f4-4677-a89e-1a27b8bd548a", "comment": "Malware payload (RedLineStealer)", "value": "4fe5ff5a7506d9ac4db945ee715bf6335881366b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960304, "uuid": "58cb4a01-e181-4035-b351-f089c69d6630", "comment": "Malware payload (RedLineStealer)", "value": "99558cb5412053d241a0fa7748d1f3a0871409c12622f5e0e842ba1a4d41ac906d77c8a079c6d0b93201a2bdbb899566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960304, "uuid": "4bd8f94a-1114-4ec0-a310-bbd8cd0ae042", "value": "T195051213BBE8343BFDB81B7028FA02831F357CA25534D2226797A85D1973594B97272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960304, "uuid": "b9adfdd5-f288-4c34-9321-d8ae039e9722", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960304, "uuid": "f8229fc9-11b5-4514-b16d-58618559284d", "value": "12288:dMrwy90b+PdMxkBOisP01bD8A7J8VzZHEJXudcKfdwASPVZ10Yf3TuLbf:Rye+1ss1vSpNEJeOKEZRef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686960304, "uuid": "dfe5231b-a5dc-42f4-89cf-71c917625fe6", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686960304, "uuid": "28320bdd-9e28-421d-8879-313d87402c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960304, "uuid": "ec6d5220-ce10-49d8-a732-a7cc4ab2abb8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fb3fd7-0d18-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687010885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010885, "uuid": "43e1ae74-f01e-4166-8832-6eb6fb250fc0", "comment": "Malware payload", "value": "c9bba95d8e06827ae55f5a3ff324bfad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010885, "uuid": "ccbcc98e-241a-4cbe-9213-37fd7e6b2254", "comment": "Malware payload", "value": "15030cb202c71596cc85dec013af49f4e48d3a1fcaf44ffbc780006d444b5b02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010885, "uuid": "e4c5a922-5b11-45a6-b821-8005dd384e3c", "comment": "Malware payload", "value": "496ef6b61dc8364aaa11845e829b45359922ab8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010885, "uuid": "270f5109-f699-46e6-a357-de22f5191c3b", "comment": "Malware payload", "value": "04a164427264c9c4e534d0d1ef7890a8f8a60c5076d4aea8fa5363548471561ef00354ad4083d0571e00d816be880b9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010885, "uuid": "0c06ac29-93af-4c21-a126-7ae8f7c176db", "value": "T1BF9412915671C87BF46C4A30E5EB8BF35E78AE55D421954B2B80BF4CBA33B81C90C366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010885, "uuid": "d4b441cd-eb80-472b-b26f-77fcfc57a669", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010885, "uuid": "8f2a8c8c-0511-464c-879f-d1327d36d471", "value": "6144:SRlWobwZTbOFhtmaXcJKw2YMW7i282q1RA/jTHiBypNJ3YknJIhB5Q4EldRURm8g:K0+FrXbGM2i28hs/SBqNJJUL0d/Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687010885, "uuid": "050997a7-8484-4a65-bb7b-f3bce0781397", "value": 414480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687010885, "uuid": "75cba9c4-c6ab-4146-b932-c0eece24aff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010885, "uuid": "80a4ea9c-e865-49b8-ae53-528ec3117b5a", "value": "Al Murad Sign.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad1a0fd-0d1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687012217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012217, "uuid": "cb6f5b9d-e932-478d-8d8d-c656593fda0c", "comment": "Malware payload (RedLineStealer)", "value": "5918cf2763302a0afb3c49b6e5ae64cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012217, "uuid": "85298d95-8798-4326-a0a1-3eb1c638ddae", "comment": "Malware payload (RedLineStealer)", "value": "1678ccdcd4ee435c382bfca71c35dfe528ac5b1b5bfb2adbddfe2ac4d36876bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012217, "uuid": "abdbddaf-64c0-432b-995c-c2864bc54232", "comment": "Malware payload (RedLineStealer)", "value": "eed21961733134bfe1fde3488e53446c868e8040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012217, "uuid": "644d06e3-0f39-4996-bb82-061a2c71c659", "comment": "Malware payload (RedLineStealer)", "value": "d877b87f13cd6d97fd5029c8b0a93185bb829b5536f394c53c6e39f9b2fa968076dd6831e25b2e4506ce15d076a06ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012217, "uuid": "74edf058-66db-4842-9608-81496d97d6cc", "value": "T1CDC41217BAE99533E8B01B7059F702D31E367CA05C68536B32D6A54E4DB26C0B93237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012217, "uuid": "073035c2-5dbf-49e6-97d2-92e63f0d5cfe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012217, "uuid": "32959fb4-2ad1-4308-a7ab-b3d0beb3ec83", "value": "12288:/Mr4y90hDMMJPWbh+Zs0kOVtuYOzrMyV3JS828XeXWKHLwXSFDB48InP8:/ycJPWt+ZRkJYarMyV3JS828uNH6yDB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687012217, "uuid": "e4b175ef-33da-46e0-b85f-a27ef2bf9a8b", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687012217, "uuid": "b5577d07-9449-4449-89f9-bf496c5995b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012217, "uuid": "4b8b8c83-b844-43c7-a029-27987121eb33", "value": "5918cf2763302a0afb3c49b6e5ae64cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9110adfd-0d24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687016119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016119, "uuid": "631ecabb-728e-41b5-9ce0-d8711f942e8a", "comment": "Malware payload (RedLineStealer)", "value": "87f3a04fa83298a8b12952754916e340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016119, "uuid": "9e07550a-17d6-4670-8078-8c933dd664b9", "comment": "Malware payload (RedLineStealer)", "value": "1c73ad69511b16ee74195c3f9333b6d2133be1194fbf9ee01a68f6fdf5e7bb7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016119, "uuid": "ad7f2722-8516-4139-beeb-4aaf5058632f", "comment": "Malware payload (RedLineStealer)", "value": "e939b681dc8b9a80bd002c081c5856e52b9a5f08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016119, "uuid": "a4d6eaba-81d8-49b2-99bf-fea06b5cd560", "comment": "Malware payload (RedLineStealer)", "value": "ac05f7f20d4c9c4020e9a7d53f9771aca1f4f1c5a7eb3b8ccd27f9013551fc0b68e557ba1e7922da57b78ca6012487ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016119, "uuid": "4e8e489a-ea58-49a1-ae1f-e41653e7ca0f", "value": "T1D1C41252A6E54177D8F01B7058FB42D31A39BDB1AD78432B23945CA90CB22D2B87277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016119, "uuid": "d36bf616-dbda-47c5-9725-99c82364f4e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016119, "uuid": "93ee0397-eb0c-4ca7-bf29-a4cab36ef4c6", "value": "12288:hMrqy90WSDdiUgSbB+jAMI8qQdVE1lvg73VBWc3yvqXo:jyTVqATI8NdVM473zep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687016119, "uuid": "c5476083-9f1b-4180-8ff5-2f1e3c91abeb", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687016119, "uuid": "ce4c6fde-8dd0-483d-9562-a675cc4dd09d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016119, "uuid": "20a67076-d468-43b5-8a24-61d65388c41c", "value": "87f3a04fa83298a8b12952754916e340.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f7325c-0cf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1686996456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996456, "uuid": "68ba9ff7-4701-4b60-9137-856c4a68a6e3", "comment": "Malware payload (LaplasClipper)", "value": "2610a0ddbea9da2319bda1005b9c26c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996456, "uuid": "83e8a822-fbe0-42b0-a2a0-483ece228790", "comment": "Malware payload (LaplasClipper)", "value": "1d38b7669f2dcddcf429fef7dc3e37f613caffb8794f1b923b753ac6a38e4094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996456, "uuid": "eab1c6ba-4668-47d3-bd1d-269352be92cd", "comment": "Malware payload (LaplasClipper)", "value": "bd0abf0e85dbb443790134d31f82f7bb287c8120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996456, "uuid": "c85d5ae5-777e-4b24-8b57-00be0321dc57", "comment": "Malware payload (LaplasClipper)", "value": "b0137063b6e8a67d909f86e6f3242c5069449d7ad2413d28ce10262a5b97d3fdf19614dfc562f3e3cb264b49f7048b29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996456, "uuid": "2207704a-432f-4147-aa2a-5b08c0c35f6d", "value": "T101445C1335B08B99FCD793711E5C9AAF0E79B5A12940918EA2939DEF87D41D0C93232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996456, "uuid": "4cac082b-f3d9-4f8b-a0c8-5e34cdff81eb", "value": "d7603d1b17202cdd1d003c27d46c04c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996456, "uuid": "cef94038-6032-4f80-9200-805a6b706241", "value": "3072:YlRbncDRcLjlRbHrvUgxLx4kgKPsbGgOOZrce/a0G0zWgAiJQS2kOuZmVeDkgPxe:GBnyGlRkgxLxYT1dcktG03QS2mEVeQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996456, "uuid": "7a936970-38f8-4ca5-a32e-022605cb40e9", "value": 260728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996456, "uuid": "f962c4be-ed26-43de-ab1e-9e1146fec06d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996456, "uuid": "a2b1f133-05af-4b7e-aaed-79b0bd9987bf", "value": "f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d10b2d8-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985618, "uuid": "24c82f9f-a3f3-4381-acdd-f40dd0261be5", "comment": "Malware payload (Mirai)", "value": "bdcd188af9159fa82e8c1c3ddf4c95c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985618, "uuid": "1e20fd06-2e84-45f5-8c6e-6385d4d8388a", "comment": "Malware payload (Mirai)", "value": "1dbbb5e1c1dc9dfcc066edbfb03685e3065055cc233098c8d65db5e0d1c9d3e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985618, "uuid": "81b76eaa-b3fa-4209-bca9-0cf9e05c5848", "comment": "Malware payload (Mirai)", "value": "09768f70ff327ef5f46789f110b29f97a0c79310", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985618, "uuid": "5770a403-0606-4c3a-a173-26846e671729", "comment": "Malware payload (Mirai)", "value": "e3dd81a022556dcbe18cb0d8811eb61d5b3fdf41ffed7230bc58ffcb93401a1c6e1b736592fe1db28469eb87d9d34ef2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985618, "uuid": "f1906921-8e10-4728-80f1-70ae59aae85c", "value": "T125E2E010F3610952ABD40435D1F647E5E7A67CFCD1C1E2EE4A1386E4F392A426BF5263", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985618, "uuid": "3c309384-7c73-44c5-924e-e6ad3f3f1c8c", "value": "768:jEc2UDlqKpQydYmhAlAw7dHCSjJhezoe3UYs:IlYCRi0hezA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985618, "uuid": "5c17dad5-c720-412b-9b87-893bc1d3c96c", "value": 33380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985618, "uuid": "c03503e7-839d-41c1-8a27-e24607fea82e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985618, "uuid": "2e7079b0-0a3a-4ef0-a2ad-cf99d9cbf771", "value": "bdcd188af9159fa82e8c1c3ddf4c95c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059bbeeb-0d4b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687032636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032636, "uuid": "6dee733f-521b-471e-a0d3-21f1509fe976", "comment": "Malware payload (RedLineStealer)", "value": "5a9569429445078396ea87e5e849213a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032636, "uuid": "e24c2036-46ca-4514-b6b6-ab5b53d4e824", "comment": "Malware payload (RedLineStealer)", "value": "1e1aa0b00559445d9b507c8e3bb1d1c0173ed4b960fcdd66ed630cd0ae012eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032636, "uuid": "3a85ad7e-ed3d-4d99-8a68-9f134c072dc8", "comment": "Malware payload (RedLineStealer)", "value": "4484c0c7b1462908e855c0530b628f13a7ddfd01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032636, "uuid": "20f162bb-9758-496e-a7f7-28cacba33cf3", "comment": "Malware payload (RedLineStealer)", "value": "f2360f59a62104c27b813d6e99144d72b1ad4bafbb55b5a77ed16195a06d3cb23ba8084a91a92325ede53eb28f7c37c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032636, "uuid": "3ade4791-5c13-45bf-863f-22f0e610765f", "value": "T1D5051252A3E45472E9B91BF19CF327430A323CD16DB8C35B3786E81E1D32694997272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032636, "uuid": "d707f67b-f4c1-4bc9-8fbc-6d2e63d9b557", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032636, "uuid": "0e9eff27-e940-4be0-af99-f8e21919234a", "value": "12288:6Mr+y90lTsf3quUzftFnHhSKu1v6tzoJYFHW8ElGY9nW0vw8b0nVoZ6v6v4gt:Qyq3uUTtFH52v6tzMb8EljJVd1Ev6vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687032636, "uuid": "a706499d-982a-4f1a-84bb-bd1bc0ccdafd", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687032636, "uuid": "6938561b-cb37-43ea-a084-337740be7538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032636, "uuid": "8559b9b1-09a4-4731-9e1b-efcf6199e617", "value": "5a9569429445078396ea87e5e849213a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352123be-0d56-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687037440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037440, "uuid": "c1680b53-b58a-4edb-b177-f736c9d2c98c", "comment": "Malware payload (Amadey)", "value": "7b264d5040774c734efdd48acc2a53fb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037440, "uuid": "1161a09a-da97-4e53-8fb5-038a7ea84aba", "comment": "Malware payload (Amadey)", "value": "1e9bb027abe27d495031e8b42200127a77f1001718a21efdfc8a63c148bb77d2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037440, "uuid": "7d20d169-0ccc-45e7-9c07-6b85166daba7", "comment": "Malware payload (Amadey)", "value": "b9be1aab81edabc32730d94418d413b284fa7fe7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037440, "uuid": "1f640121-02e9-4fce-8285-41d69d755bc4", "comment": "Malware payload (Amadey)", "value": "d6578a19daf9b6d947ff69ea4a89e7ecb85170fe167301536001705f4ca38204d1b37d3bf841f8d75f80bf12e6a258e4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037440, "uuid": "f44152d6-0db7-4fcb-a09c-be63f33c7e2d", "value": "T165C41243AAEC45B2E5F52F705CFB07871B35BDA06938920B3385A98D1CB26D0A572377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037440, "uuid": "78c5b66f-64d7-48ac-a4b6-ed52aeeeb231", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037440, "uuid": "5f62dcf3-ce5f-4366-b605-3a153fcf9df3", "value": "12288:uMr6y90AodMXVFY7zAjpBPl00P8nx5WGTtwy:wyBzPYPqBCH1hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687037440, "uuid": "210dbcc1-2e44-47c2-9171-932c12d0f7c5", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687037440, "uuid": "dcd3d4d9-604f-449a-bf7a-4b807b13ae51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037440, "uuid": "2a9bba30-c0b9-4bd6-8fac-8865c2e60aad", "value": "7b264d5040774c734efdd48acc2a53fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4b019d-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985614, "uuid": "4be18c6a-9761-4a29-be00-db7a129ed28b", "comment": "Malware payload (Mirai)", "value": "3fde5ee7c5fcb28eaa98fa6a4a14f3fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985614, "uuid": "c6cc2585-9d7c-4d1f-a973-936d7a175d79", "comment": "Malware payload (Mirai)", "value": "1ecc3e42df8576b391bbcb5d615470a852883626850160fc0fed663a84f0f195", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985614, "uuid": "153e1bfe-968b-45ff-8d3c-b7b35abae401", "comment": "Malware payload (Mirai)", "value": "64dad8708eff5563e4fc9450deacca2d2b73fde4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985614, "uuid": "90f7ff98-8c6e-492a-88ea-340d16ad281a", "comment": "Malware payload (Mirai)", "value": "b8c21ebd49b65b4ef526c53f6efd5b634ddb902672cfdd71d6a8855ed95fd52bc6cd210d5cabd87a55b3d85d68d744a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985614, "uuid": "a797d2fb-1c89-4108-9978-fe86200f1743", "value": "T14B14B80AAB610FBBDCAFDD3706E9070535CCA51722A43B353674D928F54A64B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985614, "uuid": "2c677106-2d82-4e17-8081-0285ce33cf93", "value": "1536:S3o334s+CtQWwMiu5JlzM90n//664zLvunbo+/X+3udlFTHo5hc35J0GNi/CuBOF:S3o3In1hMVnws7++dTocBNiSUV03Kr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985614, "uuid": "dd6d831f-8aa4-438b-a955-a2acbe9ff042", "value": 194348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985614, "uuid": "cd6a6b34-28cc-4c9b-8499-ed61d0eec99d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985614, "uuid": "9a8529a9-204e-4fbb-88b4-1d484e74343b", "value": "3fde5ee7c5fcb28eaa98fa6a4a14f3fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b523290-0d2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687018526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018526, "uuid": "98f2857b-a5fe-492f-9bf0-7c185022a603", "comment": "Malware payload (RedLineStealer)", "value": "41ca2209432e0d7c8590b790ca9fb4b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018526, "uuid": "65b670d3-e258-4792-9c05-2ec8a081a755", "comment": "Malware payload (RedLineStealer)", "value": "2059a50fbc47b60810eb532179fe9cc5132474e7f64bd7daa24147d53a4383e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018526, "uuid": "810642e2-1f3d-4d7e-bdee-db2b635b6e5b", "comment": "Malware payload (RedLineStealer)", "value": "7b96bab7e7289dad6dae6e00d3b6a0591a15d72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018526, "uuid": "1c78b138-3137-4cb2-9728-7eeb22bd3919", "comment": "Malware payload (RedLineStealer)", "value": "39112c46cd271a4b5d33c0203d53a96edfa420b15d25e640a1f54fe851b972591d3e452f5648bda30e51fe8f62b9db85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018526, "uuid": "d28662a1-9439-406b-94ed-dce005e4ef37", "value": "T119051302A3E94063D8B117B058F743C71B36BCA11EB85A7B63069E9A1C73985F57237E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018526, "uuid": "3b88b122-0419-4978-b5fa-7aee0e928962", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018526, "uuid": "8ef17ebf-64fd-4014-8e5f-f40fee9d4170", "value": "12288:wMrWy9051PwrBhrbSK0pQBTV29sKS3u53gGuYvGPd7GTlZQOdNcf0CTW0kR:2yww1da+729sKS3uKGuqJZQ22f0gRkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687018526, "uuid": "6541111a-214e-4de0-82ae-08bd5e2d473f", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687018526, "uuid": "b057e7d5-94b9-4cc7-a0a7-d66f39cfd7c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018526, "uuid": "f6135ff7-ada9-4d3c-a701-58ed1fbf7be1", "value": "41ca2209432e0d7c8590b790ca9fb4b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f2689c-0d17-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687010542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010542, "uuid": "e5c88e28-7164-440c-8915-4e49e40f9917", "comment": "Malware payload", "value": "dc187de46aefb5cfa30eb2909f116537", "object_relation": "md5", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010542, "uuid": "aaffe91c-0ad3-4ccb-89a1-0c4bc7bda738", "comment": "Malware payload", "value": "20c9f38af3c5d715d9722f0eaa03d6e77616b8bce3d91db8a36fc3add23685bd", "object_relation": "sha256", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010542, "uuid": "7644c2aa-11da-41f5-9790-b66a7c647687", "comment": "Malware payload", "value": "dc264b2293a71d5e20262e19b4a5c54bd8c352d8", "object_relation": "sha1", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010542, "uuid": "2442a083-f0b8-4684-b989-a2122486330e", "comment": "Malware payload", "value": "ec0a1510c5aa8a61b416c465ce21da0a11ece11da51d6ca56f549af04f90d364bbf3c4705ac729027f355260c1847fc4", "object_relation": "sha3-384", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010542, "uuid": "f61cbb31-a96b-4fdd-8f39-3cea7250a7b9", "value": "T18D5601B0ABE88D27EFD9337CD8B64199EE3DC15BD64B6347201439296F7B3840789864", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010542, "uuid": "72fac947-cc90-4fda-8a3e-8bc9e872977d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010542, "uuid": "28a10af3-4f79-4e1f-943b-2f10a1f6e2d2", "value": "98304:jfNLVVzOzvALZe+bxKztxZJNe7sCwj6s58NfpmLSBy/5myCyN:jfNLKrA7bxKHdxCwz58NkSBo5BCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687010542, "uuid": "1d500444-8bf3-4d70-bf1f-67df866aa67f", "value": 5902848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687010542, "uuid": "22987036-4650-4bac-89e8-d1ac9828c321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010542, "uuid": "8f7d2e7c-a51c-4266-b106-079cb99c1202", "value": "sc0pe_carved_deobfuscated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4620fa-0d2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687018524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018524, "uuid": "43bb79fc-ad47-45d8-b1bf-6d6384135cf7", "comment": "Malware payload (Amadey)", "value": "bbabe6482b56b51dd0460e54852a3619", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018524, "uuid": "19bfe20e-f374-49d1-bf25-25a85a80fed9", "comment": "Malware payload (Amadey)", "value": "21565b02d2eccd682c87db0197f6e7d89a27b8dd18fdd47a0c169de0964180d0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018524, "uuid": "802e6f17-9834-4480-8902-85bca2c10e51", "comment": "Malware payload (Amadey)", "value": "974ecd8324bb078883fc23bfb1653bd43b7447af", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018524, "uuid": "19416a54-705e-4bfe-bff6-74e8b95ec955", "comment": "Malware payload (Amadey)", "value": "f88ad7f07832f7637ad35d5b007fbf699af9c7b227921f8b31a358fba64a894f9e9cd79d2007e00a3349917c214353c2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018524, "uuid": "88ba3dcb-1992-4a6e-a2be-82a4bd7df387", "value": "T19EC41213A7E45027DC722BB069F213D31A36BCD16DB8876B2781AD4E4C31AC5A631B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018524, "uuid": "239eb1fb-4c74-43a1-b8d3-182ac754780a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018524, "uuid": "5a0b6480-bb22-43ec-85ad-a3b30d6abffe", "value": "12288:ZMr6y90Lsi8m/kNmUc5PYW1X5mhWctjTxDbVil:TyJmjU6WPx5il", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687018524, "uuid": "9f40ca27-39c4-4926-b990-17b1320dd309", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687018524, "uuid": "2756339e-fe5d-45a0-9fc5-618b3c094dee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018524, "uuid": "2fa4194c-79ae-45d8-a1c7-44c32cd6a2ac", "value": "bbabe6482b56b51dd0460e54852a3619.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69176f0f-0d3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687025501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025501, "uuid": "1177df03-ffa3-4cc8-ad0f-201c82424364", "comment": "Malware payload", "value": "d92dcef30094ae24cabc6638d9fe1400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025501, "uuid": "d6a82b89-7b2f-4b29-b7cc-ab3a717d603e", "comment": "Malware payload", "value": "235d486e31be0c04805ec23af164dafb95aaa976a8a36f3c64cfac4068965739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025501, "uuid": "56350c37-c887-438b-b432-93161b037744", "comment": "Malware payload", "value": "7b94c9681db044927f7342ac365174865c57e876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025501, "uuid": "7c3b3e62-c498-4d2f-9c0a-cb09ff3ef0d9", "comment": "Malware payload", "value": "271a43b5418eee7c587908a5b0324c605a583eb33b72faf27cb6e24b79e4e339076a59ead9375dc2f2ebe7c55e636dab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025501, "uuid": "5991d4e0-50e3-4091-88c4-d563c1ce07f0", "value": "T14B16BF223F84807AC963317186DAA7F9A66AED702E35029751503F3E7F307D24A2D65F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025501, "uuid": "a6fa584a-1046-4471-bd4a-41f8e1ac75b2", "value": "b0d4ed0d7d95ead420b3fbd5b4f63194", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025501, "uuid": "fe07040a-4844-4ba1-8ee0-ee75b2411a49", "value": "98304:GdaA9L/ubM0aY28wiz0tp6noeLbdj8hm5LZRKNHRHOmr/JuxOJ1EgIeX5FLOAkGd:Gdj9iGPioGnoevKH9u0GgIeX5FLOyomj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687025501, "uuid": "bcfa3907-a17b-47f8-92f8-e7cb29935f98", "value": 4359168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687025501, "uuid": "10a77614-22f0-4cef-8fc4-5213dcfa993c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025501, "uuid": "c0f81a4f-b94d-4277-88c6-b1fc84d26b86", "value": "ROM\u52a9\u624b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e023be8-0d6a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687046152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687046152, "uuid": "0e0bec4e-d6b9-4681-9e5d-bbb798dc296d", "comment": "Malware payload (RedLineStealer)", "value": "c9807d55e36d91aa8861ceb43154e2e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687046152, "uuid": "f4aa90f8-4e96-475f-ba78-3233123004bd", "comment": "Malware payload (RedLineStealer)", "value": "23c797de3816ea78b55e97b5376171ba1b2004b9798dbc178f93830f9e15c3e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687046152, "uuid": "0dfc318f-290b-4426-a9a3-5dd240db039c", "comment": "Malware payload (RedLineStealer)", "value": "7266eac1b0112fca912ba39270c9b134b54c5d24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687046152, "uuid": "f4822b4b-1371-4571-beb8-a3f1a36c8ea6", "comment": "Malware payload (RedLineStealer)", "value": "0271ed24cf78febc5341699d218b98ab687dd6454ebee9eaebe06762de0bfb3045f6fe0c608cccaf1d627ad2db6709ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687046152, "uuid": "81f4170c-4930-4ab5-a761-38563dc79342", "value": "T1FE052253B6E458B3E9B22BB549F2139307397C905A78477B36C2AD8B0CF2194947632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687046152, "uuid": "6175ea18-f6bf-4763-8336-8b11180b1e5b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687046152, "uuid": "e7552065-cc4e-473d-b87a-99b5f9c013de", "value": "12288:XMrUy90/F5zSjON1A572506LzFNGLp82NofAUXaInBZr2oaVCZj5rWYbe2VtneSq:rywF5zSjON1eN8s/VEBZrVrF1yOn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687046152, "uuid": "fcd2f21c-70e6-4c24-b56c-f5e9d178c0ca", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687046152, "uuid": "10fafdcb-f1b7-45b3-b34a-fdb41fc8831d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687046152, "uuid": "bcf20e11-309e-417f-9a0a-e48f0eac9de8", "value": "c9807d55e36d91aa8861ceb43154e2e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75103091-0cfe-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686999752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999752, "uuid": "c79fd81b-7b7a-48bb-8795-c3484d661e7e", "comment": "Malware payload", "value": "1cc42155aac8301b04acf2dd24e00037", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999752, "uuid": "c7967ffd-64ab-483a-b420-efadf916c777", "comment": "Malware payload", "value": "2580898bcb319660a9ade85c4c70a9b4b2644be647ea4b6829110bde3b33e7f5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999752, "uuid": "28c86eee-d198-4046-be06-fc5088d05f9e", "comment": "Malware payload", "value": "400726cc2ebbe7567d9abe0a7609398d21e7a094", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999752, "uuid": "913f7dd4-4892-4711-8827-8768495a1d93", "comment": "Malware payload", "value": "15f4e2f1ca91a92aa83b17dac25f36ef21290de955c89565518222f53ef9db7da2873c249cb45f2ecadca0fbd8896d5f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999752, "uuid": "c4202fb6-3680-41a7-9cf1-2efa63061ebe", "value": "T14CD225565B8C4C61F269E87B865EE00E49BCF23234C255C5BC9CE6B17B3D14E0B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999752, "uuid": "f012c79e-9a25-44be-b08f-e91ddeed360b", "value": "768:mgDjAA7BkMdHBVWbSUq6aNJENZDo2rXkUjGpOm63xeQSEnc2s7v6:mMjAeuEqSRNM3jcOffsD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686999752, "uuid": "d40ba4d2-5bc6-4912-8d2c-a8d67d4b312b", "value": 28949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686999752, "uuid": "ffc3ec76-7408-41f7-b282-4aa858e1b8da", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999752, "uuid": "d00fe63e-287a-42d0-a863-834274f8de63", "value": "1cc42155aac8301b04acf2dd24e00037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93943554-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985629, "uuid": "323b738f-dbbd-4b00-8895-f607595c8a3c", "comment": "Malware payload (Mirai)", "value": "b90f670e9c0be41802b93489a907df89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985629, "uuid": "4ede5638-99f4-4c28-a73a-ea8fc3860a43", "comment": "Malware payload (Mirai)", "value": "25901801b56d27bab90acf9de7049263299a40213e1886cf68492c1aec54bfe6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985629, "uuid": "4134584a-7ba9-47ac-b7d1-0f49d1707c76", "comment": "Malware payload (Mirai)", "value": "7b92c6cad0e61e8a4bdadb3c0f50b542fb1c137b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985629, "uuid": "51557c2d-6c29-483b-a906-14721db64eeb", "comment": "Malware payload (Mirai)", "value": "80c6262a0720833cd42b3ae9f6f76bf1e4082b611a757574779e8077e7f8dfbd652d236a387d5062fd99eb1f37567c35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985629, "uuid": "de7ca765-30b4-4081-a401-0fc313adffe7", "value": "T1E604971E6E228F7EF368873447B78A25975C23D627E1D684D2ACC1141F6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985629, "uuid": "16007268-d8f6-4d4c-98b2-ebc9d817bce9", "value": "3072:efSC/pmiac1+E8LYrC/crCiELtniTMRKw8+V0y3Y:efSgMLYpCisRYMX8+yeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985629, "uuid": "41d96e58-3482-4d6a-926a-54e65bba6aee", "value": 190252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985629, "uuid": "c3226899-59e7-4782-9c24-2437477e1143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985629, "uuid": "9c1dbd82-6e7c-4588-b6d1-68f486a4f8c6", "value": "b90f670e9c0be41802b93489a907df89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719d544d-0d08-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687004041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004041, "uuid": "ab7303b9-142e-4c3d-b069-4b15d037586a", "comment": "Malware payload", "value": "3369f161a4e160aa0647e581042fe6a6", "object_relation": "md5", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004041, "uuid": "8f02f374-8a07-4913-94d2-f751eaafac4f", "comment": "Malware payload", "value": "259ec67faa862fc65682039552f20ad2e2120fe1c09efa2b92847bd564b1c571", "object_relation": "sha256", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004041, "uuid": "d48b5e97-43b8-4af9-b744-d8dd04efc5d6", "comment": "Malware payload", "value": "f660602fa6fbb994b21b17d2364400903047b425", "object_relation": "sha1", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004041, "uuid": "2351e884-e486-458c-953b-db35ca0d6dbe", "comment": "Malware payload", "value": "6e14662d2597fcbd98614e17f096cb044c00c97935c5bcc60c65ea2c102c9cf0cfe05673e7184d44e16ef25abc7f4511", "object_relation": "sha3-384", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004041, "uuid": "5cb85dd7-b59c-4c23-b21b-a8108345c70e", "value": "T196633C02B3EE1A08F1F36B9C5A7A15650E3BBE655939D25C00BC654D0FF3E418DA1BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004041, "uuid": "fa49a880-feeb-4efd-bc7d-84a5c3cbd0ad", "value": "1536:/s4b5F/gVPJN69w6uRSqFBeWp54b5F/+kVYs4b5F/LkVY4VP44b5F/+kVO:/s4b5FgVBM9w6uRSqFBeWp54b5F+kVY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687004041, "uuid": "2214484b-7f9f-4156-8fa7-a17ae16aadb7", "value": 67800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687004041, "uuid": "e6425a8e-aff0-4472-9bc3-c631dfcbde39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004041, "uuid": "30cae932-e5ed-4487-91ab-d3e844a06442", "value": "Detalles_Informativos_Del_Proceso_notificado_Nro\u00ba_=929982892-21.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2ba989-0d59-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1687038821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038821, "uuid": "5964ebe6-d28d-420b-bc45-ca8ae86a62e1", "comment": "Malware payload (Tofsee)", "value": "452252e2bbe473047a792cea00cc8167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038821, "uuid": "00070f45-6f4c-4589-a596-a16638f01f22", "comment": "Malware payload (Tofsee)", "value": "260dbd9a551cd6f5d24d8e665bc6b296134fe94fbfc3a0f804f9aa535455e35a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038821, "uuid": "ab271c10-f0ef-4f4b-ac6b-712b5e6d7ef8", "comment": "Malware payload (Tofsee)", "value": "e99a1fb2ddcb7bab0ab1b8293e2a3b1e262e089d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038821, "uuid": "a3536ba0-186c-499e-87c9-4878bf92a8cb", "comment": "Malware payload (Tofsee)", "value": "c1916ae0ad66ab354cb0dbc0c1efc02e6b2d9eea6993e640bb49225654e76ff95f0693d2362e30506e1e938d4d9210c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038821, "uuid": "0262bab8-930d-4a67-91c2-7f0bfab0809a", "value": "T1B5343C03A2E17C91D916CB768E1FC6E8B60DF650CF49B76E16189E6F24B12B2D163F40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038821, "uuid": "24a035e0-2d38-4ee1-961e-caec1ab64401", "value": "8123a6a160c2e51432b427de73e978dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038821, "uuid": "5985ef75-f430-4d51-96ed-fbfe9785268d", "value": "3072:bu8oDIUXgf7hCHSYhaHzZe3AzGTmFjMY9/NuWY/gkjpLcKq06Xv5HTVSeR7t:DlUXWVALhQz+AzOmtJXlAjpLS0oXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687038821, "uuid": "afb80ed1-2f6a-4da3-825e-de131685501a", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687038821, "uuid": "0f5e39f0-9274-4952-bd1b-896cd7a52051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038821, "uuid": "e9aca5a0-c0d4-45f2-8eb8-b6755133bd75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d65681-0d38-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687024801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687024801, "uuid": "38e4017a-a799-410e-ba2a-8be7948b3d6b", "comment": "Malware payload", "value": "f773d26929d9ca0814877c914be90f6d", "object_relation": "md5", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "xmr", "colour": "#5F5221", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687024801, "uuid": "4d94f29c-4612-43c2-9ffb-109e56c066f9", "comment": "Malware payload", "value": "271724c5ff157be6c9c596f8728894a3de24a6cbbf23b89afec313f4e6212bf8", "object_relation": "sha256", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "xmr", "colour": "#5F5221", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687024801, "uuid": "55024ae5-8c93-45b1-981f-ce41e26ecad4", "comment": "Malware payload", "value": "42cad3abd300641c536d644123c8e1981131758a", "object_relation": "sha1", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "xmr", "colour": "#5F5221", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687024801, "uuid": "146f9ef8-6b8c-481e-9a7f-cdfd6b0a9fa5", "comment": "Malware payload", "value": "5111dc9a209b26294376138c1689d70842266dc9fa9c75fff242e6f2aeb8bf4eebe45232ffdf43bf8ac8533a35665f4a", "object_relation": "sha3-384", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "xmr", "colour": "#5F5221", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687024801, "uuid": "b2cb09a5-b0d5-4190-9ca8-dd538656c281", "value": "T1AC7623C2E1DB02FCDC578C3451024C9B9AB76D3E87A9A16703E1B69F85B34A3597B603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687024801, "uuid": "d81893cd-6280-46fc-9d78-4f51b27ed025", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687024801, "uuid": "dda33404-e447-47ab-b506-081bf3b25aa3", "value": "196608:NkcyW+7X4FMIZETKwjPePdrQJ/BNOqgYP8:hwQETKwvJHOqgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687024801, "uuid": "ca8622a6-c4e7-490b-8349-e5a266b41781", "value": 7218883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687024801, "uuid": "b87056c3-f952-4042-9ae9-f649edf6f268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687024801, "uuid": "edffb912-743d-44bb-8f08-e8144c0badc5", "value": "FortnitePatch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e789c548-0d02-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687001662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687001662, "uuid": "c73c0e74-9d6b-4fad-90a8-0afbb9eee2d0", "comment": "Malware payload", "value": "5eccf3e8667f97062f836dbab43d7a55", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687001662, "uuid": "2dd7c6e4-d42d-4963-be93-5de6d5568b37", "comment": "Malware payload", "value": "28075ecae5e224c06e250f2c949c826b81844bca421e9158a7a9e965a29ef894", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687001662, "uuid": "cb76d8d9-6ab0-4045-b9b5-7387f92277d3", "comment": "Malware payload", "value": "40b3039199fc6a36f274b102e1ed7ab14d1bf128", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687001662, "uuid": "d5f128be-bf6c-4e7f-a4f6-34be6a274908", "comment": "Malware payload", "value": "16391222b20ee76ac24286748f46578c0d1ef264bb857ba78014ec72a3f097a4d8ad1615a92bc1b982470a2e7370121e", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687001662, "uuid": "bed69ed9-b233-4ed7-a8ac-b37ebfa8dcda", "value": "T17A646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687001662, "uuid": "f711c04a-967c-48b8-ba57-f3548be2c797", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687001662, "uuid": "fa078bb5-9f6b-4e39-ac97-fdcf79c71f10", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9mK:5xb8ZqekwkJPaThgyDChXohRRwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687001662, "uuid": "83c4fd03-23db-4639-9e86-2d9c7f1fd821", "value": 320521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687001662, "uuid": "899903b8-33fb-46c1-ac3b-be204d0b29f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687001662, "uuid": "bc6be698-d0bc-438c-8454-d6f67a32cca5", "value": "180323.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98be0fd7-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985638, "uuid": "f03c643d-7189-418b-b618-6d99c3fb7dcc", "comment": "Malware payload (Mirai)", "value": "75a28dca6f1fb6617abc893adb1401db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985638, "uuid": "3279c75a-b2d5-45ed-9d00-db9a941c63f2", "comment": "Malware payload (Mirai)", "value": "289ef320cfe4df2fb0b1848877acb14c8a957a599f23ca4e27611194f84f5da3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985638, "uuid": "05082558-6640-47dd-a105-d07f234c39c3", "comment": "Malware payload (Mirai)", "value": "ea1824d32655a1972beadf2c84a114c45950ac0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985638, "uuid": "c5f781ff-cf00-4540-9d98-1a723d41c911", "comment": "Malware payload (Mirai)", "value": "03416833667a055aa9c9848074d6eaae5341b6153a822d3763866c6a59797b54494adc06c3bb1a9837617f3a1bfcc1d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985638, "uuid": "62b3f00b-4c12-4af0-aedd-247e0977fa6d", "value": "T138F2E09EDC6A318CCB9D6CBDC539077A1854B6C27203DBC93B46DE3175A5A4AB80D8B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985638, "uuid": "f4885b5b-840c-4beb-bd28-3447d8ed2070", "value": "768:mVfMEx9kBxrcwO37PR3fP21imoTt8RxtOBMlrex+WMl:0kBQrPR3fP21vo8OBMlrem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985638, "uuid": "2800a873-87f1-4b64-822f-e86f99738a4f", "value": 36292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985638, "uuid": "5aabee32-22b8-4720-a445-d79a43aee0cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985638, "uuid": "bcbade27-f723-4c48-88c8-25ca7df8dfde", "value": "75a28dca6f1fb6617abc893adb1401db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d579b31f-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045440, "uuid": "84cb9b4a-b8a1-48cc-937f-60306a36564c", "comment": "Malware payload", "value": "220e69c2ca8b2cd6a2cf5b5111126e2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045440, "uuid": "84f8bf41-8bc2-480f-8a74-2dbe77d633c5", "comment": "Malware payload", "value": "298ec383ade9e2b7048a31992f6eabfab4feacd1d14339ad10b54d2b75ad7d45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045440, "uuid": "5ffd9eb8-e70b-4970-886e-10e308c50095", "comment": "Malware payload", "value": "fe2b1e0be0474ed6713d4c26b48f02fcd2d8e8ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045440, "uuid": "805f2ae5-c4b9-4eac-aebe-15e22b3cba12", "comment": "Malware payload", "value": "e809322e281fbea772f611ad801a1b8062d1c0840535c029ef647ec2b219cd86d36b3352a973536228bcab0022d7286e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045440, "uuid": "99e38789-34e4-4d82-9333-1a4d6fe3d019", "value": "T14EE31845FC414B23C6C612BBFB5E428D7B2A17A8D3EE720399256F21378795B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045440, "uuid": "f0d2b272-0c86-4268-b026-98738705bcfb", "value": "3072:8XpHmLaJbkKyFea4Y5uoDu2rdA+0shTEG:8X/JMQa4Y8oDuNxsh4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045440, "uuid": "13234043-14c3-4abf-a55f-7490847bf852", "value": 150240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045440, "uuid": "ad1e4dc8-efdf-4c25-b44f-39e1d9b94355", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045440, "uuid": "7c87c07e-8503-4651-be47-dcfccbe7fba5", "value": "220e69c2ca8b2cd6a2cf5b5111126e2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21cd3f0-0d0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687005008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687005008, "uuid": "fa4e7e76-18df-4f41-80e0-2da6ebc33214", "comment": "Malware payload", "value": "fd3fe7327f664f7d0e894ddd0bf094bd", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687005008, "uuid": "50912158-1ce1-458e-a46e-6a30778c5b51", "comment": "Malware payload", "value": "2a2eeaaaa14b0a455603bf1f096809429af734eb2bef1f18179dbf6eae2610c3", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687005008, "uuid": "545cf2fd-5454-405b-b5b6-f44201a5a8fb", "comment": "Malware payload", "value": "4cef6280ed489052cf0f990ca6eae2f3c34e1139", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687005008, "uuid": "291e75dd-2b81-4126-8b6d-eacc81c66b63", "comment": "Malware payload", "value": "779eb8e9081c02f87dfcb35da4e809e3eca222236e5736f3de306f10d54d3214d783e2b6e002880b109f0c81e59e41d1", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687005008, "uuid": "88164668-cf4f-413f-9aaf-d3ed035126d3", "value": "T14664BE56F3AA5F1FE1E46534C620D3224BB4FC198B6BCF7B7B0A3A4BC8BC5949910611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687005008, "uuid": "afa30a02-9934-4bd6-b17f-6341c333579d", "value": "6144:kC+pjU3wDNa2N2FVhO5MflfOHDmu2dnwwh5KVSlDb7pLcGUZVrvwCRXO0bI:kuNC5oVKELwj5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687005008, "uuid": "f560f8f0-1ba3-4641-b7cc-e09abce5a227", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687005008, "uuid": "747a938e-bede-425c-af31-cd29c998207e", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687005008, "uuid": "99bfe21c-d530-4abf-a6ca-e0578c36023b", "value": "SecuriteInfo.com.WM.Concept.A.32724.4875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e276964f-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045462, "uuid": "1bf084be-dedc-47c6-82c9-057be87f82b0", "comment": "Malware payload", "value": "a3062f465fb52a3a3c2e08043d705c8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045462, "uuid": "66ce11dd-1c6f-4f6b-9b80-43b9f6cf3a0e", "comment": "Malware payload", "value": "2c25eddda73b27b69fd66752b5c372696ea275d6e503a8c25bc3b14be8886876", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045462, "uuid": "6ec9ec99-a689-4173-b0ef-73d2fbf73d5e", "comment": "Malware payload", "value": "c8bdfa99ee270ce83f4cd8fd5d3f1f6ec1c6adba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045462, "uuid": "2f65c576-fa8c-4c91-a2f7-8fe1959005c5", "comment": "Malware payload", "value": "b388989779e0247583b817fd7f87b315bb2cf068ea350d80c4a45a1515c408d8d78e4cf277abcfcfd23ca61076f7514e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045462, "uuid": "f824adeb-957b-4148-8ebb-3627da1484c5", "value": "T16814981E6E228F7DF668C73047B74E25976923D627E1D684E2ACC1105E6038E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045462, "uuid": "c1ecf4a1-9d25-4385-862d-ada026c8a7ae", "value": "3072:R3yZrQ1OLNWjWmX6JTHPMpTcJoFR2OHJwWIr5Cxk:R3ypxfmX6yZ5AIwW+5kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045462, "uuid": "655df820-f7bd-4a70-ae8e-679fbd6da265", "value": 198684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045462, "uuid": "376b567a-6d05-40b1-b6a2-4457630a7f08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045462, "uuid": "196355e5-c7ac-41d7-8f03-40ce07d9b96e", "value": "a3062f465fb52a3a3c2e08043d705c8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357ff372-0cfb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686998356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998356, "uuid": "fb4abbd4-cd0b-4908-af66-1a394c8db734", "comment": "Malware payload (RedLineStealer)", "value": "78765db8da01875ef17d5f448a211f84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998356, "uuid": "a8400898-1e48-46b4-aaaa-66ddaa688a81", "comment": "Malware payload (RedLineStealer)", "value": "2cf3910b4ad37fe3ccee1684e7307cf329c0cf34766ca261a9e66f642db55573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998356, "uuid": "acbbb2e8-b81e-4000-b943-908e616c3912", "comment": "Malware payload (RedLineStealer)", "value": "1365e9dc5d21a52f64ff0c5495c80f1d766daf02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998356, "uuid": "fd3fbcfd-e596-45e5-9fce-c203a42dd9a8", "comment": "Malware payload (RedLineStealer)", "value": "1728463ff1f689920d277e941ae0b5d5ae916179d3abc8dc13eb594f54d44a25fe8e9c536f074e55c342997612f500df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998356, "uuid": "88bd3425-ee0a-4e95-99dc-03a6d28479c2", "value": "T196645B03A2B17C94E52ADF73BE1E86E8761FF5508E49B76DA118DF1B04B41F2C263612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998356, "uuid": "e4a9e5ab-7104-48e3-8626-4ce1950b2deb", "value": "a346b9b1867290f612560daf31aace2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998356, "uuid": "dd42d5ee-330d-416c-909e-61f11241bcd5", "value": "6144:T+kBFPcCyOes559Ez6fNgs67fLVdRP98Dl2JlBbo:TvyFubFaVjPqJ21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686998356, "uuid": "fb842682-effb-484d-970e-f0e44cd49f7c", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686998356, "uuid": "2075467d-c601-4fdb-95d0-8feafa6f7265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998356, "uuid": "8b8073de-b6b6-4b0a-ad2b-8a6b92b391d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa603ba-0d39-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687025128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025128, "uuid": "71b1d041-5434-4a97-a390-e84a3f71945e", "comment": "Malware payload (RedLineStealer)", "value": "c4e1a1bfabfb9402b61dd6aa90a7fd13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025128, "uuid": "c8de83a5-53e7-4db1-ad73-e0ab6675f489", "comment": "Malware payload (RedLineStealer)", "value": "2fc258344129e0a28124e20edbbb07d668470c92559c3138c79e897060a638cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025128, "uuid": "a30d2e4b-d94f-4691-801f-f053b2dc680b", "comment": "Malware payload (RedLineStealer)", "value": "51d4bbba57a91f8f116ffe8ec2e8a7664f5ebba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025128, "uuid": "6ac68164-3eb1-4f33-b421-79e9d82eaa81", "comment": "Malware payload (RedLineStealer)", "value": "29d749320a96c08efa3c43f4b2a6e269400771c7cd9a77c4a6c026a3807216c63a4273983c12aa93bc35f52e2a16a0bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025128, "uuid": "0ae9c31c-e6f2-4e91-8947-271f2d63f206", "value": "T119C41243A3E84033E4B11BB048FB17831B327D519A74577B6799A87E5CB3588A23276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025128, "uuid": "7b87ca03-9e8a-4055-b68f-abe28f8d4f3c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025128, "uuid": "d46ee3ec-26d6-42fc-9964-7373e6697516", "value": "12288:YMr3y90hl21wmhDf7Idy0FOpbnBz5gP0ZAmEFbJB+Rz+9Ru:vyHwmhDfOyRpbnBzs0ZAmeqRzY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687025128, "uuid": "0fb4ca56-5670-4b4b-98f5-1c23d1745ca4", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687025128, "uuid": "80f4d970-1425-4db1-93a2-2cd51d105054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025128, "uuid": "32f367bc-0b79-4dbb-9b9a-8f80d084c6f2", "value": "c4e1a1bfabfb9402b61dd6aa90a7fd13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea187a3-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045482, "uuid": "1537adfd-613b-4091-9ea2-5fc84667311e", "comment": "Malware payload", "value": "fcf2a7caf0e8ac83fca8567ab3075170", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045482, "uuid": "33c55927-08f8-4f66-8720-f1147e246297", "comment": "Malware payload", "value": "305f427120962e961d4cbdcddc2e64fa20ba9c10d789567e7088c626d6aa3db1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045482, "uuid": "6f598a2f-fd1d-4a15-a2d3-f21b57179cfb", "comment": "Malware payload", "value": "0e1e82a3f13d4b7c3eff8945bd2290e2b22e1a17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045482, "uuid": "0de1f22d-ade4-4f7d-96cc-396ad8723495", "comment": "Malware payload", "value": "b60dc8c6fcd2f05518129d43a3d4c3fd052050ea05011b47b98b4ed3557894b27fc9d844b2416dda3f8ddcb818bc7be2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045482, "uuid": "a95301f0-22e3-4ea8-a000-d89cc308f048", "value": "T18E532B9AF801CD7DF81BD77B44570909B671A3D152835B3623A7BAA3BC731A81D23E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045482, "uuid": "4eea3b7e-0eaa-4370-a303-97ba0d88bc71", "value": "1536:4h9h2SiCRRcGzs8rEz8+UsRU7DbPud+UkjF0S:4h9hNiKuGztQUCUfi4F0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045482, "uuid": "53725afd-95d1-49e3-80ce-46935b29b308", "value": 61276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045482, "uuid": "29c1dc2f-ada1-43f8-bd1b-f06d495541a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045482, "uuid": "ca229ad3-0136-47a3-af11-d74f99bbdc87", "value": "fcf2a7caf0e8ac83fca8567ab3075170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f9a6b9-0cf4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686995275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995275, "uuid": "cad900b6-6687-4c17-8a40-1ff8b913aeb6", "comment": "Malware payload (RedLineStealer)", "value": "5a08525e2c51b8c6735a7b9e60ba7332", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995275, "uuid": "25b465a1-5367-4061-a7e3-e6d1e2139388", "comment": "Malware payload (RedLineStealer)", "value": "323ad1eade62a652ce4ac347ad4161902a95fba6d84ef52761455177b7bd1981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995275, "uuid": "608c85bd-f604-4169-938b-90f55cb23ab9", "comment": "Malware payload (RedLineStealer)", "value": "9d5bca1179229dcdc3ac7cc81c0b51797f3b9c0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995275, "uuid": "7ec1ab15-1b49-4f6f-95b6-8639b9b2b819", "comment": "Malware payload (RedLineStealer)", "value": "186f1bd10172e780e38760164453a17a10747a9560cdc5bf21e6300a159105e5f91837006ccc57a7546be39f2656dba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995275, "uuid": "b56cb4a5-d513-4ad9-a21b-cd8ed17d6162", "value": "T1C20582B965D027B7D835D662C15234C9F27F6316B2528C6839D2DEC7826298E37EC80F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995275, "uuid": "fbc9d176-abba-47af-9e56-a908094535aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995275, "uuid": "c95ffc76-a336-4021-a09d-ab7128f56d9a", "value": "12288:h9gUX/2iNHsxIiCSMrGuZcJ0SrRPLzCQq+X5T7:LV1+OrTc0QPnZq+X5T7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686995275, "uuid": "14ff7dea-df32-443f-85ea-223d51f54b5a", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686995275, "uuid": "229aa02a-c8f0-4986-a62f-3607c0b82e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995275, "uuid": "306da902-864b-430a-bf86-a9aff9bfd12b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6784f46-0d59-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687038945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038945, "uuid": "c3eb0f97-a17e-4357-935b-9640c9f96c0e", "comment": "Malware payload (RedLineStealer)", "value": "d6571d20898b256ba5acc1e83687ae27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038945, "uuid": "c439d827-fdcd-41e1-9a93-4f0f1a2dee4a", "comment": "Malware payload (RedLineStealer)", "value": "32ff0b2b66fa44d67c3777d96f92eacedf0e2e0af8fd86526f8c592af5825b5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038945, "uuid": "558fd8c7-a071-4200-8c92-ef26a2f61ae2", "comment": "Malware payload (RedLineStealer)", "value": "c70ee7d3744eb9e9d34cff2d23c746216621ef26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038945, "uuid": "fe1c3fb9-d5f2-4a9c-ae7f-d52976113c41", "comment": "Malware payload (RedLineStealer)", "value": "e85cba2e7fc2ea2cfff77dfb7eb7fa19c45d8ccab5911cbd3ff055db07dc865b323ef8a06a6cdbd152223cca4b3bb241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038945, "uuid": "e6ecbe12-4801-4b14-830b-fcc6641137ba", "value": "T17BF41255E7DA9171DCE017B06AF702930B327DA348788B2F3782785E2D72692A53533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038945, "uuid": "586e786f-713e-421e-b3c8-c16039da4022", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038945, "uuid": "72425a9a-b3ce-4006-8b87-176c35e222f4", "value": "12288:gMrCy90xq4ys8GX2Pcw6JkdflJ2SgOPHwrI3e1siIONv8/5kTGVPYpfcG5/wxKNn:Sy149pYcwt52aPADKONv8/mKxYWG5/Ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687038945, "uuid": "0fd36ff9-2941-4f14-b4ec-f9032e01f16e", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687038945, "uuid": "7bd398f0-a263-44d0-ae2c-535870239cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038945, "uuid": "8e1825c6-63c2-4389-bbc6-cb6b36c61a44", "value": "d6571d20898b256ba5acc1e83687ae27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41135b0d-0cf8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686997087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686997087, "uuid": "9d01030a-b176-4672-9415-1fbeec6b7fe3", "comment": "Malware payload (RedLineStealer)", "value": "e42396baaac905be9766ae8955f5d7b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686997087, "uuid": "6d725d99-47be-427e-93a1-c979575cb4d8", "comment": "Malware payload (RedLineStealer)", "value": "344004f908a66f42c43549a2efa7ccd8043c579b80b12bf43ab9de0e814b11ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686997087, "uuid": "7ca9c0ba-7c3e-488d-89d0-9e68d3f1e5e0", "comment": "Malware payload (RedLineStealer)", "value": "8a04f7c8caa1524913c372677a04ddb7d4f37822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686997087, "uuid": "404420a2-3a7e-4dd2-bcd0-019e30ec423e", "comment": "Malware payload (RedLineStealer)", "value": "e96755c40812af7c0fef4709cbcca6f117ad1e6cce77c51ec9c9852bed4b3d6c2b482b265b51b33983cb7f007c07e7fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686997087, "uuid": "4c6733e7-84ff-4ba7-9193-ab6032412382", "value": "T113647C13A2A13C94E926CF728E1EC6F8761FF5508F5DB76D9198DB2F04B11B2E263211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686997087, "uuid": "fa8eed4f-5145-4aeb-a30d-8654d768a078", "value": "a346b9b1867290f612560daf31aace2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686997087, "uuid": "49f821a9-e789-48c0-a815-a716816e375d", "value": "3072:E3R+YE59OvtchnAHmo5Bokfl4095K7BA/d0mgxXu4wKqDyyMK60q3tyXlQD4kZh0:U+YEyWnUh5ukJgQdKYSyMK+9m1eO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686997087, "uuid": "4f8cdddc-1e75-4e62-8c67-4ed33b9a37b4", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686997087, "uuid": "ef525539-920f-4d68-a070-8fb6e4761d67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686997087, "uuid": "57799026-ce62-4897-a5cf-a042101a1406", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56597e0-0d58-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687038514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038514, "uuid": "9cb4159d-883c-415d-a97c-4dee074920f3", "comment": "Malware payload (RedLineStealer)", "value": "71a24f29551add9d99904f731fb5a8f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038514, "uuid": "7356074f-4412-4f56-8095-dcd2a9bf7b0d", "comment": "Malware payload (RedLineStealer)", "value": "359d88310fb7a00e3df1311a5c4deb448e4c7483d73f04fa33c98a011e432097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038514, "uuid": "4a118724-966f-482d-b1d1-17c555f9cf64", "comment": "Malware payload (RedLineStealer)", "value": "5518a884fd894c5cdeb90c26698903f458706261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038514, "uuid": "116d6d7f-63db-40dc-af80-e2d33cc623e8", "comment": "Malware payload (RedLineStealer)", "value": "71aa2e98db9b7bfb1d0b98324b6b9db6a7f1798c24543bf762cf43e0b8f0fd9342d133253508ed96f048d325ce627beb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038514, "uuid": "1e6e3165-b496-4a74-8d4a-ce49132c5603", "value": "T159749E03A2D17C85E526CB729F1FC1E8765DF5508F49776A2A0ABA6F14F0272E163F40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038514, "uuid": "3107e575-d41b-4144-9ddb-eeadd7fa692e", "value": "04b17228a03b1d4a739b2c7487c1a1b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038514, "uuid": "bfd77d6c-7c87-4a51-a30a-ec27a7567954", "value": "6144:EZ2vuq3T3TKakG6Ir0ms5XvRnNZeSRztjNk2NvR9:bWq3LuvG6oLs5fpfmsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687038514, "uuid": "30056103-ea08-4d77-843b-10aa590de34e", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687038514, "uuid": "a13a97b9-85ec-4d90-b9d8-04638d252b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038514, "uuid": "636f279f-d64b-48d7-a5bd-a2eb285dae7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b17a25d-0d21-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687014660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687014660, "uuid": "9d3b316b-9913-4ce3-bb5c-3292ff989288", "comment": "Malware payload (Formbook)", "value": "1295cd68c9274daf773810630e5c017e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687014660, "uuid": "b8d739aa-b561-4f2c-b1ac-463aac661d12", "comment": "Malware payload (Formbook)", "value": "35a10de4741e23670aadd4aa19babf2ab5b8f134c0df0050eaf2255b6d90c053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687014660, "uuid": "b94ab9f5-a4c2-42be-aa6c-18b825d46652", "comment": "Malware payload (Formbook)", "value": "6ed15b4b9cf18e3949309693bf71998dc2883806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687014660, "uuid": "f7a61e22-a98d-41b4-85e0-75dacb049468", "comment": "Malware payload (Formbook)", "value": "4395729a5e5a9753075489978dce87b0bdb0f8cd6686c27555ae543c1894957d5e907c67e7da8b3650f27bdbbb9e914c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687014660, "uuid": "bedcd84a-12be-41a6-bd51-0f1cf44ec18b", "value": "T145259DDE02F5111BD56947F4A955AFF01BA1ECB97A22C3197D40FCCEAE323E144226A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687014660, "uuid": "9da8deec-9a94-4b94-b1ff-5ee2f9cb07e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687014660, "uuid": "41631644-3722-43f2-b118-2f73b348569e", "value": "24576:sQbicrmr8thRQVE7d5kExiNVz4qXdVjZ:sEi4C8XReE7dSNV4qXXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687014660, "uuid": "766a4574-036e-49c9-a3b1-7829c598bd6b", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687014660, "uuid": "af4dd991-8cf3-40cb-ac9b-0b901dc4e9f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687014660, "uuid": "4f06292b-83a5-4f61-a082-8c94b0fd1ab8", "value": "PDF.New OrderCIFMetal Product.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f9743d-0cf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686996159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996159, "uuid": "41fd66ee-5e52-4c5a-88b2-7af033f8e0c9", "comment": "Malware payload", "value": "2fbe2acfb21ea5795bb238a0deb92569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996159, "uuid": "ac5a498c-4151-4d7a-ab76-c0fafefd165b", "comment": "Malware payload", "value": "36ffcf52d839a9accc67bb62c3ab7a628c6014ef750b171391fb2f606b9f21f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996159, "uuid": "8ff5e394-f39a-40b9-a1c4-39c355704790", "comment": "Malware payload", "value": "4738408370ea4c9e616db4c62bde6d32b7713327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996159, "uuid": "8e630c0b-d183-4803-af34-ddeb3f6c5c92", "comment": "Malware payload", "value": "fe3e348e6cb14e7c14fd7e961ea55f9288f3d6cffce2e45ddc7a74a767189dc1e27b333f99f5f8bc6c85c4f830d93277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996159, "uuid": "7200c6f9-cab3-424a-a6bc-27b1aaf2db34", "value": "T18374BE13B7E186D0E46A5D32B36AA0160F6FACF79C93D7DB30D83C1B54622931476D8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996159, "uuid": "d6f832bb-51d1-4589-8937-02aa26270e50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996159, "uuid": "674dbbc7-97fa-4c8d-8362-668a12d306c9", "value": "6144:+QaKkCLLli3uU+5t134XcnYz6ORy3U8YJ++LI8bfVkQn0v:MeQ385rosnYWQyk8P+bNkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996159, "uuid": "846cffba-bbdc-46ca-9f67-138ad23a9914", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996159, "uuid": "5f56974a-a24d-4398-a53b-a2267c22caef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996159, "uuid": "09f54f81-5164-4fbc-b387-8ffe2ec23685", "value": "2fbe2acfb21ea5795bb238a0deb92569.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25533e9-0cbb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686971132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686971132, "uuid": "efd33bd6-fb06-43cd-8e99-a53f7bf39b69", "comment": "Malware payload (RedLineStealer)", "value": "8ad0291a1dfaf355e5cfea617a747f40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686971132, "uuid": "cea68a42-3aef-4069-99e2-76aeb439004e", "comment": "Malware payload (RedLineStealer)", "value": "39e0c825a90be2e05a341f2847f77c78001728e43dd75a3e019ab3fcaae9e5ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686971132, "uuid": "1792ee32-e288-448c-8136-7f1e842aec1a", "comment": "Malware payload (RedLineStealer)", "value": "98d91c597d281952ae4cb7407ed4295baf68ed1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686971132, "uuid": "8603de29-9c51-42c3-a338-b49c22419cae", "comment": "Malware payload (RedLineStealer)", "value": "f0f11fede25002a0f6e4e945e9c6f445961d6213ead196e3aa9d7b6ce69ebba9357d91737926ee6ee5bd7d7cc3a94d5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686971132, "uuid": "a4da0077-69a0-4911-82bd-d9849c4abd20", "value": "T1E504C558364B657EC96F883E9C700CE1667CAC671246AB079D8EF0E43D3B7919B051F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686971132, "uuid": "27e8066e-ab46-40f0-8d87-10b98564e513", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686971132, "uuid": "003a8cc2-d05b-4e95-b622-52732068e379", "value": "3072:oSbeEwsn/ht1Zz8bE4VxNH2A6s1wMcv8e8hh:oDLkKtdX1wMcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686971132, "uuid": "a471a6bf-fa23-429d-b322-6fb592a28887", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686971132, "uuid": "ff6aa83f-82e9-44a1-993b-2726d5ef3349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686971132, "uuid": "b5d55595-8ea8-478c-8672-45ab63cb4bd8", "value": "8ad0291a1dfaf355e5cfea617a747f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9803bd9-0d12-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687008537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008537, "uuid": "398e0943-76c3-4f7d-b0cf-92c4e46684ba", "comment": "Malware payload (Formbook)", "value": "db3e793d4a46c0ecc782f417e35abf5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008537, "uuid": "74f9edc3-fab5-4990-a885-28658f15bfd6", "comment": "Malware payload (Formbook)", "value": "3b64d6b8012a1a72f89aa735fa41ddda9423a575235baa72c7fc0685cd1b3666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008537, "uuid": "4945e1d4-6434-48d5-ab04-2b1b2d4bf24e", "comment": "Malware payload (Formbook)", "value": "7c60ba8fab8881b93af60ae7c6723e05620b4a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008537, "uuid": "13733d7c-65ff-4847-8af2-30681a55e02b", "comment": "Malware payload (Formbook)", "value": "1040e656798016afc53c703401fc85ca091dac729b5d539405ddc19cfcc107c007e3dbe71d6b569ad8f64ea05346ae5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008537, "uuid": "11531036-3bc9-4433-9497-c5cd402b0cda", "value": "T1D7441225F691CA53E89306721D3A0B6B6F9AB42021B5964F1310AF2DFE2B311D50F767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008537, "uuid": "41bb9ddd-3714-4a81-af08-5abbb3220932", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008537, "uuid": "640bedc6-2cde-4b65-b2dd-e258269bb0d2", "value": "6144:PYa61YXmRxamzKnudt5A0P0gW4jrE+QVowwwhb9FA67A:PYXY2vsudn3MyM+Qdb978", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687008537, "uuid": "1293c139-1d72-4465-9fe0-05b39f59a0c0", "value": 260111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687008537, "uuid": "73887d12-c1dd-4c25-bdb2-e876c86eb521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008537, "uuid": "195bfe07-26ee-4f8f-9e4a-0a3f644f6e8e", "value": "r98100.TREN.AUTpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a1707b-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687045474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045474, "uuid": "4b92dd6d-d84a-4ff7-8941-c628c2e0fd95", "comment": "Malware payload (Mirai)", "value": "c1f40db86e1d3f5f950b18d3554de8c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045474, "uuid": "5668fe30-777b-4222-9527-ca1e5e828aba", "comment": "Malware payload (Mirai)", "value": "3b944e13024c08b7670a973faa88d2ef4d8122a8de08993cc34bf38196a01ef1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045474, "uuid": "2a4d7552-49e2-4f27-85d1-09caac2c3f12", "comment": "Malware payload (Mirai)", "value": "7e74a8f6fe18965244c6ea9ec1086f5b5fc6b9dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045474, "uuid": "92e994dd-c77e-49e5-bfe4-958e759f9e92", "comment": "Malware payload (Mirai)", "value": "be647714bb5c1ef2a0107ca1cb064497524d6714b196a3868f2e96518249c7d23347ae068af7114b4a57d98c8dd8a6fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045474, "uuid": "41c9c600-c47c-412c-9d01-0e9525b006bb", "value": "T1D0131955FC82857BC6E017BABB6E6B8C337263D5C2DF7323982017A1369221F1D22E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045474, "uuid": "4afc5f00-e930-4224-ba63-7809680edaf0", "value": "768:6MlRO7TliI25UhzWwG5rVSX827R4lofjPyLzLcc/GukXohfRlwyhBP1FzHNVwde:9lTI25U5dG5r2rfTyL8c/GukCRlvhx1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045474, "uuid": "62b5850c-155d-4c6a-87f5-7be925768083", "value": 44576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045474, "uuid": "06b4f726-447c-4a90-a319-9ccf4e92790a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045474, "uuid": "f8398fa9-8ef9-4899-b84e-28416a67ab37", "value": "c1f40db86e1d3f5f950b18d3554de8c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829a9abd-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985601, "uuid": "b22fc0f6-e095-4b03-9f05-928bb57a14c5", "comment": "Malware payload (Mirai)", "value": "fa1de6a51de8a335c5217588e11b515d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985601, "uuid": "84787c7e-0042-4d9b-821a-ff84fd52546c", "comment": "Malware payload (Mirai)", "value": "3c3c0eda0d601e32865f15b91c2e1c18037e2526f0d4cf3e882b24cb9650e726", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985601, "uuid": "6be12ba4-308b-4a16-af9e-27fc4ab6351c", "comment": "Malware payload (Mirai)", "value": "7c8d4275171732efef1e13430bbd81d2b8bd8b2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985601, "uuid": "e90254b5-9f20-4651-bdc2-69b251973118", "comment": "Malware payload (Mirai)", "value": "f3617c5ea7ecc3fe70cd03bf4cada04d530e7ed31af7552887516621ae6242b6d73247b6ef052bd584ca1735f28df193", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985601, "uuid": "c7ac32d3-2288-4be7-ad44-4f8dbd54b0ce", "value": "T159F349D7F800DEB9F80AE33B4853091AB130BBA155925B377257796BEC3A1D80477E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985601, "uuid": "6aec7683-a35c-4251-a83e-59782624d424", "value": "3072:/AmV6mX6PyQmBExaNNCKaGO/kFZMPQ9YDVfjbihL+5hHByQCdO:FKqddar/hY9YML+5jyQ+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985601, "uuid": "9e8a6e5a-d9bb-4004-adb0-aab06d97b2b7", "value": 164812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985601, "uuid": "76ea1309-63b2-4a3b-af4a-e3952c48a70d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985601, "uuid": "6f561942-6b15-4fdc-a69b-3d7f7247cd69", "value": "fa1de6a51de8a335c5217588e11b515d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e8328e-0d52-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687035641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687035641, "uuid": "25187896-1ded-483d-a37c-5f69b291827d", "comment": "Malware payload (Amadey)", "value": "2c073cde9e4e40f08ed69613de738d48", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687035641, "uuid": "6624b121-6c56-473a-bab7-75d3c2f0e27f", "comment": "Malware payload (Amadey)", "value": "3d9df09517fe7c019744f8db097cbff2304983bf7bf849d6b0433d5bf375fb01", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687035641, "uuid": "3277ac27-7018-4017-9bb9-9c5f08150021", "comment": "Malware payload (Amadey)", "value": "b9f8ce906f6fa4bf0a266d8802f9c6f999e1794c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687035641, "uuid": "3ff7157c-c8c0-4135-a755-40ec5fe8725b", "comment": "Malware payload (Amadey)", "value": "ff4a24120b7cee229dcada454eb16f05d634226ca85fcaef89b6946f64be8dcc16e68f1ededbe8b19548aae6e63aefc5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687035641, "uuid": "67b0a50c-a0f3-42ab-8171-a5965dde807e", "value": "T15DC41203F7D84172E4F51BB12CFB05E30A367CF04978965B3B8AA9591C721A8697273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687035641, "uuid": "a986cdcd-ac18-4cca-9eb8-0cceba060445", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687035641, "uuid": "8e6fdcd3-93b9-411f-8672-ec587c402d31", "value": "12288:7Mr3y90VYo0kfBFPNy0Rs5Q7csO590fvs/WTdZ2mg0:wy2skf/I0Rs5Q7csW9Is/jmg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687035641, "uuid": "c962ddc2-bde4-46c6-82f1-082410ff19b0", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687035641, "uuid": "64425341-3cc1-4f6c-8c30-467302204839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687035641, "uuid": "045a30ee-a9af-4f3f-9940-20002bedf0e0", "value": "2c073cde9e4e40f08ed69613de738d48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d721629-0d27-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687017321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687017321, "uuid": "63006c17-6311-4b24-ae68-9fa706e83de1", "comment": "Malware payload (RedLineStealer)", "value": "a9429b6fb97f10b280b83de3eafaf91c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687017321, "uuid": "38d01c34-6071-4861-be5d-c3a2b0d7ce48", "comment": "Malware payload (RedLineStealer)", "value": "4064f6e42cd00553d962824e30016069e5504148c39dff87517690473944f3fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687017321, "uuid": "f41be745-8dbd-4299-9969-8d2131a02cf9", "comment": "Malware payload (RedLineStealer)", "value": "c59f96b7edaa154705b7f5aa96c8c5aa6d8bb164", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687017321, "uuid": "8b663957-0f3c-433c-8ac0-a85b4e631b17", "comment": "Malware payload (RedLineStealer)", "value": "5f60626867d53ac79f4d69aa93e3bba9d06e254951003354e4302ac5e5b21e3605fbe47fbeb0baad118897a9969f2b51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687017321, "uuid": "bf2f24ea-02b1-41d8-a485-0d8cc2d3881f", "value": "T198C41213A7E81572ECB617706DF603D31B717D618AB8C72F234AA51A1CB3094A67273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687017321, "uuid": "ab5edd52-c2a1-4e4d-84eb-5536abf2b76c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687017321, "uuid": "8538c8be-e281-4fbc-afb8-e41b20afc5f4", "value": "12288:TMrmy90sui/qmthJz3qGF0doocayVUS39qB40pt:tyKi/qiqGF0kamUS3i40pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687017321, "uuid": "8490466e-4357-45e1-8a31-55d0706cefc3", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687017321, "uuid": "fdacbc38-3c88-4a96-b308-91aeb588e98b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687017321, "uuid": "28bb0e31-37d9-4b38-bfb3-1b7994a4babb", "value": "a9429b6fb97f10b280b83de3eafaf91c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71884cc9-0cff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687000175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687000175, "uuid": "98e77948-99d8-4969-805a-a02c6272f3e5", "comment": "Malware payload (RedLineStealer)", "value": "5f8dd2a08b71770341c1854bd2fcfb33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687000175, "uuid": "efe4631f-d591-4c5d-81db-a23e804a98d8", "comment": "Malware payload (RedLineStealer)", "value": "41e29fd53ef0864123b0b12a661b4bf26dea11f01735b11184635cf91ce2d12b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687000175, "uuid": "b9fcd00e-5afe-4c36-ae91-cda13e696677", "comment": "Malware payload (RedLineStealer)", "value": "1a103d3fbba3578557255f8443fb20346d53eb7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687000175, "uuid": "b0491882-a6f2-4436-8cf6-f41a04709705", "comment": "Malware payload (RedLineStealer)", "value": "2bb1fe8730b367587e3860f2ce1b659b27bf7f37ccc2d9edd91c0bff07e1f2705bab80204ebb43caa7e53e979494b044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687000175, "uuid": "6bdaf13e-2bd0-4bcc-9eb1-090ddd39e71a", "value": "T110C4ADC23681DC32D8B210314BA4DA74BE6BB8234B1E79DB63D45A2D1F306DE6B31756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687000175, "uuid": "803b67c3-f763-4089-8c9d-1f5b50e26b8e", "value": "c0ab2b613ec158d9556fd4cc78fcca0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687000175, "uuid": "dba208fc-0025-4083-b9da-60ac8cdbe9d4", "value": "12288:6BJXf4iZZu6RPlsrxkHlZnOqzDUParRlwJi7gzmy4nHrhUPaRA8:sXf4yZuwPlsrxAZFzDUParReg6mlLhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687000175, "uuid": "9376f9f5-b501-4523-98b6-e033c7a82063", "value": 587936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687000175, "uuid": "698b994b-f571-4adb-b93c-d48912b43fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687000175, "uuid": "72dd1bd0-df49-4048-b4e4-45f0dd5f49fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975fc62c-0cf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1686995944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995944, "uuid": "470bd80a-a2b9-4886-8697-c43508714224", "comment": "Malware payload (zgRAT)", "value": "3c5b4bb566951504af528ce9121759df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995944, "uuid": "65843145-65be-4bff-a0d8-36c9a6a46cb7", "comment": "Malware payload (zgRAT)", "value": "42032fb2e1a7dcd8e06876f6cb9f0fa51d82806f29ff0253ce2502b862f70981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995944, "uuid": "d2e44b0e-75e2-4d71-91e8-6b3748e3831d", "comment": "Malware payload (zgRAT)", "value": "13b3ecb4c8c43ff6a62aaf608d1dd02835613c2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995944, "uuid": "959d4a73-a583-40e0-9baa-58c932dded12", "comment": "Malware payload (zgRAT)", "value": "8122869c321befc1af658a42b78f6042e2eff8eb2b427eb6c42c10726b3c42a45af15120e1b04f235a93a3825a3253e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995944, "uuid": "7b9927d2-a3e3-4358-aec0-5e3dbcc86714", "value": "T16434AE893641B78FC457C47AC9EA0C24A7B661AB133BD243658306EC8E0D6CBCF556F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995944, "uuid": "aeb784f4-5c41-419d-9c14-4e03461becc8", "value": "6144:dQRC8pzXrOOOdTcBLO9tFrKX2HgaFSRuEi5:dQRC8pzXrVOdgFOdLHgacy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686995944, "uuid": "124b6b14-2b31-4795-8c90-31301816ef7b", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686995944, "uuid": "78f77a96-63df-4c8b-a3b8-9cd06d3fbf91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995944, "uuid": "c5f1a0ad-d7d5-430d-9c82-5ec81ab4ead0", "value": "Sat\u0131nalma Sipari\u015fi 20230331,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d4a448-0cf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (YoungLotus)", "timestamp": 1686996803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996803, "uuid": "4f4402a7-2b70-4e96-9e2e-0173f037f0bb", "comment": "Malware payload (YoungLotus)", "value": "8f26838bcfe78a273701af789c8a8922", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996803, "uuid": "29c2a11c-416b-4341-ac5f-700d78152a91", "comment": "Malware payload (YoungLotus)", "value": "42bc619ece29110430b91ca7c007523bfc5fda8a46b8e079beed624a350decc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996803, "uuid": "de31fe2f-3a71-422b-8947-e635f644bb9e", "comment": "Malware payload (YoungLotus)", "value": "3fcd2adf71c58c74a9e335b56a32fb56a78ba19f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996803, "uuid": "ab8649f9-379d-458b-86ef-16a9a2b5e026", "comment": "Malware payload (YoungLotus)", "value": "a39041a7181114fff6b92c35547f0400815c40603ec90acbf044119659ca96e307a95aeb6971c860733f6e88ed5dbf6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996803, "uuid": "1152c79d-67e9-419d-97a4-2910fddbc399", "value": "T193E3F1A31A5A80B6CDD663B091D78D2EB321DC0448D5CFA74BB1361F7C79B863D292B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996803, "uuid": "47545baf-54d2-4330-8256-099e4fc77f28", "value": "fcb17a5fbbc1dea101c155ad1f1e322e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996803, "uuid": "3b1d5527-b2aa-44c2-9cd5-b8aeca69eece", "value": "3072:mPh253NQakAmFFLTnTcY8iY+BkBrhxJ5AdgqB6uYWxHDit:753Nlmj3TcY5xBxPzY6HDit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996803, "uuid": "674147a8-487c-4112-be4a-5bcf0ea310e5", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996803, "uuid": "ba9f2c4b-36b3-4478-b98e-e7d042310ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996803, "uuid": "c029b4c2-44e9-4851-bf40-f8aad8a650aa", "value": "8f26838bcfe78a273701af789c8a8922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feee4927-0d10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687007714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007714, "uuid": "5352afe7-b183-46b8-9235-e3ba0457e07b", "comment": "Malware payload (RedLineStealer)", "value": "2e82e13f104e71aa4b800ece38df13bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007714, "uuid": "a160b74d-80a6-4655-af4e-d195f34e3f43", "comment": "Malware payload (RedLineStealer)", "value": "43d01693eb6709b9d2256d9f993dc27b893c2f1a7eb4746bb13275e55d218493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007714, "uuid": "a4c523bf-64fe-4d72-9058-234f6a6a09f5", "comment": "Malware payload (RedLineStealer)", "value": "eee3ff2b9959bfce5fbce202bc59653b89f12556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007714, "uuid": "85350a0b-34f4-4284-8854-514d1d6e454a", "comment": "Malware payload (RedLineStealer)", "value": "2a74b0f6730eebad407ebd83021be8e78eef1d7fc4845e34ae2d33bded1af9a482469ffd6dfb0861434720852c7593e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007714, "uuid": "70dd3861-a81d-4e28-81fb-eda41d8a70c6", "value": "T141052206A2E48063F8F527F069FA43872F36BCB16DB59613235AA81F0D725859531B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007714, "uuid": "6c3afbd6-90f2-421d-a5bd-3bbb44c0509d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007714, "uuid": "723cb262-6e17-47b0-9c5b-e742666f60be", "value": "12288:aMrAy90F7Rqt333wx/hXyjcvpxV2ijWEIe4H/6af98O:WygNYH3w9hijcvpxoiPO/60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687007714, "uuid": "6aab430a-332d-4c98-910b-4f64aff0c9e5", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687007714, "uuid": "25079af2-ad04-4de6-be33-e568d84d8c73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007714, "uuid": "fd13d5a0-e03f-4e2f-8af7-2ea432a91ea5", "value": "2e82e13f104e71aa4b800ece38df13bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ee2e6f-0d1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687012824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012824, "uuid": "1ed7194b-5595-4e7f-8544-de2f8d06faef", "comment": "Malware payload", "value": "f3f5d14d3644c17ce896534a97fe2b8d", "object_relation": "md5", "Tag": [ { "name": "educational", "colour": "#BD4D03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012824, "uuid": "f29024bb-c920-48cd-af4b-2350c7325810", "comment": "Malware payload", "value": "44667a988cc089bf72554f869e1f6552b5ec206b0d2dcaf34e79482d8fef404a", "object_relation": "sha256", "Tag": [ { "name": "educational", "colour": "#BD4D03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012824, "uuid": "8471485b-a3c9-4a1a-8d5f-c114567486a9", "comment": "Malware payload", "value": "ba80f08e26fb94d5965d0b7ec9cb3a8f85f24ae0", "object_relation": "sha1", "Tag": [ { "name": "educational", "colour": "#BD4D03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012824, "uuid": "600a97a3-fa3d-4f3c-96d3-8617d40336ac", "comment": "Malware payload", "value": "2b3ee6620603acc6c2a83b45b424f4e2281bda5bef10d0e3ec9043f483854adfa5a24881eafee6c11e077440f85b54a1", "object_relation": "sha3-384", "Tag": [ { "name": "educational", "colour": "#BD4D03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012824, "uuid": "abe80193-d78d-4047-9227-1cd029649064", "value": "T16B468C03FC9551E9C5EAE2318A328252BB317C881B2037D32B55F7B92A73BD45E7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012824, "uuid": "8c5258ab-343d-41a0-8167-b20e0dc207cd", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012824, "uuid": "7f284553-7c61-4985-bc75-c059182f1472", "value": "49152:6sFIN/6X3P8P0SfErb/T8vO90d7HjmAFd4A64nsfJIY/jEIF9yZI4ob5aHcq5E/h:lX3P88/AiAi8EWdaytlUguRN19D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687012824, "uuid": "c36ac861-39c1-4e02-81c9-04232bd56ff9", "value": 5640192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687012824, "uuid": "cd60506d-0451-4235-ad6e-91a3e8c6ef1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012824, "uuid": "33a729de-e233-4c99-ade5-b8b1b796e509", "value": "itssoeasy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e313d9-0cfc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686998973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998973, "uuid": "7e463610-3b12-46eb-a4a3-25d98b76dba1", "comment": "Malware payload (Rhadamanthys)", "value": "279670b1d010792b94c5179e7ff2381d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998973, "uuid": "5b3fe9f2-0ccc-4bf5-add0-f9b61d659ed1", "comment": "Malware payload (Rhadamanthys)", "value": "452c0558713dac55a25f47217368c54ed4d41a97b677c66b4af291cc7f9da862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998973, "uuid": "9187b7f9-73b5-4c09-809b-a4edd0b4d6d2", "comment": "Malware payload (Rhadamanthys)", "value": "c4d1d9d4de1b8468e3870e4013f52cd3ca90e867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998973, "uuid": "5ca822de-c2e3-444e-aba9-68ac7c43e526", "comment": "Malware payload (Rhadamanthys)", "value": "f42da873a6c3ead725d38d7b56efd3deaedb8f525aedf9fd647cd695293c054407ffcfd6fc67c6d25ee65279f7181964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998973, "uuid": "a0eb8204-c69c-406f-b1f5-aac6b91841d0", "value": "T191A4AE53A2A17C44EB35CF769E1EC6E8761FF6508E49BB6DA119DB1F08B10B2C273211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998973, "uuid": "39a5f34d-7386-470e-a4e6-55d4c6a8e30f", "value": "a346b9b1867290f612560daf31aace2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998973, "uuid": "fb7f2962-6286-4432-9fb8-7b45f2163d28", "value": "12288:+DPSIa1AnJJAtSffrOFo+BQ7kJghOZ0WQNnQ/:DlyAtSmo+B7J63nQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686998973, "uuid": "d5f6cad5-6f52-43b6-92f2-578eebc2adef", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686998973, "uuid": "0efcb492-e321-4013-bef0-40db275d4f04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998973, "uuid": "66f8f579-5e8f-446e-a17e-0a73f30296a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa6316e-0d4c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687033235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687033235, "uuid": "38bcad7f-c0c6-453e-b860-53fc1c228dcb", "comment": "Malware payload (RedLineStealer)", "value": "800f655a1eced02aff4094718ac479c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687033235, "uuid": "893872a8-9911-4e6e-ad8f-4a872ebf34a2", "comment": "Malware payload (RedLineStealer)", "value": "4865bcf291c5629fbf94730d91c13429e77664b1c865b85c49b09fd9671bbc5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687033235, "uuid": "326797ed-d2e5-46e4-99f1-1c14c6078594", "comment": "Malware payload (RedLineStealer)", "value": "bf18fb26e4b0c9f004d9b9fbee9ad9d36a131ffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687033235, "uuid": "ac68adad-f93c-4e6f-9784-476f5d7fff3c", "comment": "Malware payload (RedLineStealer)", "value": "be8c3c27a9a2f375a2eecfca9c55b0d86ac425875a05f7fe640c11b2818260ff79e56a5cb38f7f4198e56cf4b9fcf28e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687033235, "uuid": "f946aec7-f22c-4625-ac56-28c47970be4c", "value": "T11C44290235E0FD24C406097F747A429BB5AE68DFF7D8C4FA126421D72A172992F7933A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687033235, "uuid": "0a1695a6-9632-49e5-8dfb-2a19fa108a28", "value": "8b20c0aa1a6b70c064e1b0a2222ddac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687033235, "uuid": "48f3d1f1-01d7-4ef3-b88f-ee20322e34ec", "value": "3072:zqGrUpcqdCu/JkyieubmC1oPj7cmaRp7INH1Kr5w/Exlz1Hwt0x:z7NqUumevC1oPsmaRp7INMrgExlzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687033235, "uuid": "7c0fec62-6705-4a92-99c7-dd8fa7df6ce9", "value": 269080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687033235, "uuid": "55fb2c82-90fc-4743-a788-3cdf54368cdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687033235, "uuid": "df92734c-5220-4e05-bcde-1dca4a7da999", "value": "800f655a1eced02aff4094718ac479c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe52bcc-0cf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686995716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995716, "uuid": "22de3013-e71f-4176-9345-e6d95890ba5c", "comment": "Malware payload (GCleaner)", "value": "55e7f1381362daa3cb6e507dabc604e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995716, "uuid": "d700fe7c-8443-4dee-8b4e-bc257d2da3b7", "comment": "Malware payload (GCleaner)", "value": "489eade7becb78deb88c28f80a3fc5d22e071ef8cb629f79d5e6fdebdee8ae70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995716, "uuid": "22747e79-bbaa-47c6-b6c9-a81e50243eda", "comment": "Malware payload (GCleaner)", "value": "dd7534bdb46605ddc482371053e79bcc252c1ad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995716, "uuid": "1c124cec-e3d3-4cab-affd-1bbaa46b85cc", "comment": "Malware payload (GCleaner)", "value": "5658eb6084368fa2c5c07cdcf41d88981689a8cb7fe355ea0c14a1711bdc33f7c8a184f5ee5e7afead8cae75d818ac18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995716, "uuid": "6002b2b6-7cd7-4257-a7c6-9c46e0fa655c", "value": "T1AC85CF3FF268A13EC56A1B3245739320997BBA51B81A8C1E07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995716, "uuid": "6b48f636-5462-48b1-8f15-4777f939a5ca", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995716, "uuid": "1a9efd69-f648-4dae-9b5f-ae3f121750ac", "value": "24576:s7FUDowAyrTVE3U5F/61lORBKic6QL3E2vVsjECUAQT45deRV9RI:sBuZrEUoqBKIy029s4C1eH96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686995716, "uuid": "bc2b3594-c006-4f15-a97f-142b01c2e961", "value": 1794907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686995716, "uuid": "4e3a1eaa-92c3-4184-800c-267a22d818e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995716, "uuid": "3752a8a8-4010-480e-ab79-5f1b507e965a", "value": "55e7f1381362daa3cb6e507dabc604e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b593134f-0d60-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687041950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041950, "uuid": "d43ee69f-e398-4c97-934f-d23f74142d6b", "comment": "Malware payload (RedLineStealer)", "value": "a104404f68725a2240bc4c1992b36be6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041950, "uuid": "ce52d26f-d7d2-40f5-880a-ae6f8c330325", "comment": "Malware payload (RedLineStealer)", "value": "48d982c4069e5935d6cbefdb362057a7eeb525774fee32cd2c89f05feeaf9164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041950, "uuid": "3098a2a3-d532-4ab3-8e8a-1cf34e5f8889", "comment": "Malware payload (RedLineStealer)", "value": "a30db89cfd4b5c94ffedbe8d20a9ab7a9e96df31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041950, "uuid": "110e30a0-ebb3-4f6c-89c3-78153d204c5e", "comment": "Malware payload (RedLineStealer)", "value": "423a4e40d3f5841d4188f56f65df9037ef110bfdc09604ca61d1d7034a7b56c5afcb5f6b11b343a58ebbba878d841a6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041950, "uuid": "c68bf683-20c8-4e3d-8558-d739e7d61c72", "value": "T10344290235E0FD24C402087F747A429BB5AE68DFF7D8C4FA162421D76A572992F7933A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041950, "uuid": "b29b58a6-9176-4c35-9126-2557838a5e27", "value": "8b20c0aa1a6b70c064e1b0a2222ddac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041950, "uuid": "84bfcf09-18c2-4749-88c4-2ca8817622b7", "value": "3072:kgGMZihn0gJCjdg7yieubmC1oPj7cmaRp7INH1Kr5w/Exlz1XTt0xe:3Zih0gojievC1oPsmaRp7INMrgExlztV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687041950, "uuid": "88306661-70dc-427d-bc7d-7be3ae44afe0", "value": 269586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687041950, "uuid": "c630e1e7-b0e6-48bd-9fdb-f8a07c18e8c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041950, "uuid": "f8032ddf-771f-4881-90d4-d30da0382fe8", "value": "a104404f68725a2240bc4c1992b36be6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b778c1-0d56-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687037743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037743, "uuid": "2ef922aa-3df9-4327-9897-be895f9fc668", "comment": "Malware payload (Amadey)", "value": "f4cf379a721cbc1c9fb6255c9e4dbe77", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037743, "uuid": "ca67fa8a-322b-43ef-a845-1e2958a5540e", "comment": "Malware payload (Amadey)", "value": "4927b49cf1b8c574dce9dde9cc82ddadb3889379cc4d902f23a975bcb63ac137", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037743, "uuid": "ae74f6b3-689f-4b64-8c94-542bb5a2197c", "comment": "Malware payload (Amadey)", "value": "5aed87c6b70ece3770d77a235d3642558484f5c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037743, "uuid": "06210f10-5ce0-495d-aa7d-3eb278b620ff", "comment": "Malware payload (Amadey)", "value": "a8164f50140a0c5c1514de8ea7183182dd0438b03896820bee954cf6d8367ddbca68fc2e78c728c7ccb6e2459990e3be", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037743, "uuid": "7e99884f-31fc-4f56-b395-821127f37271", "value": "T1FEC40212BBD88523DCF26B705CF603D31A3ABDA24878832A27555C9A1CB3BC49572777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037743, "uuid": "a7d1e75d-f883-46ae-b3ce-4a4eb6af58fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037743, "uuid": "c9ee765f-ca0f-4bf4-9bec-c36f465ffd34", "value": "12288:1Mrsy90Bc24Dwgth0snu/XqxUuRG7lkjQ6GvgAwiPd:xymAPtmsOaxhE72jwg/iPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687037743, "uuid": "ad21042e-df6d-4668-97f7-012a35c06ee1", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687037743, "uuid": "3e8e9ff0-25ee-4724-8ffc-3cb95f9dce0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037743, "uuid": "17ae2e6a-37f4-494e-a534-c8f9aa0e1485", "value": "f4cf379a721cbc1c9fb6255c9e4dbe77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03cde656-0d55-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687036928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687036928, "uuid": "ebfd82fc-b52c-4b16-b7cd-1b57f5704856", "comment": "Malware payload (RedLineStealer)", "value": "b4c77fb15d681ae13838e794bf6f1f2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687036928, "uuid": "97af2257-f3eb-4c31-aa8b-68d64d6ab166", "comment": "Malware payload (RedLineStealer)", "value": "493fde2b16a781eeb4ee79b1e2fcfec1fc7516181645d79019a61949dcb67964", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687036928, "uuid": "be296728-0af9-488a-9662-48de983eed57", "comment": "Malware payload (RedLineStealer)", "value": "a14b5f12fac84a9ffb5ec8e3aca0a4242557b2b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687036928, "uuid": "5b1b385c-9546-4a18-b2d6-136d24570bdc", "comment": "Malware payload (RedLineStealer)", "value": "6161940ad082ad621c6a9bcafb2c7ab592d0a0d4c2508ffe2516a54016c4fa6d833e0564c5e1aa12a0a6e80575b3a5a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687036928, "uuid": "554aa7e7-e875-498c-bf5f-317c26968795", "value": "T1B1647D03A2E03C94E925CB728E1FC6E8765DF5508E497B6E3A189ADF14F12B2D163F50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687036928, "uuid": "96bcfdf6-47d7-4c90-834e-593893f6c7bc", "value": "04b17228a03b1d4a739b2c7487c1a1b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687036928, "uuid": "57b6f8e1-dc43-44a3-aecb-6ac570fb2634", "value": "6144:6bHzb6tqr89U9RNREPobSzjhG+corNFRL:yGK9fREAWz9GdcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687036928, "uuid": "0b911c6a-9ff0-4b00-a8d3-cf79f39f55f8", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687036928, "uuid": "b9b4d70c-67c4-4e98-8e3e-1888de615200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687036928, "uuid": "eaf9fae2-b6ee-4eaf-b9f9-07d2d06df435", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5efe88-0d5c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687040142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040142, "uuid": "f456a342-f238-4eb5-a792-909462c9e311", "comment": "Malware payload", "value": "48ed895e72e60d9d22f3a4f6db48bdca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040142, "uuid": "bd70e91d-aa74-4c75-910b-b3aec19cf320", "comment": "Malware payload", "value": "4a65596deb5d4aa89ce0b25277654b0a74a8ad43a0f9902d72ab008e905cbf9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040142, "uuid": "07c53e81-934c-4d4a-9e53-a42932537693", "comment": "Malware payload", "value": "85f2f86c4a71ee115d9835e3a6be1a274d74f21a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040142, "uuid": "633daa05-29ac-46ff-bda9-efcb8710b12c", "comment": "Malware payload", "value": "437d54ac0c9870083ec7f1942584c56c52ec6260618e267d8218813bca24c93ae93257ab1bb74a1e7be0caf6efce9f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040142, "uuid": "c077440d-ac39-4a2b-b19a-5e648836c413", "value": "T14836233B22F5A60DC57AD6B8413046DC97FABD852E20D78E19E437C9EAF3E855600363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040142, "uuid": "1854eb09-ae02-4e7d-8e5e-b24937fd5778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040142, "uuid": "c3f5242d-863d-47f3-95b4-3e769574eb16", "value": "98304:2i1NG8sPcJWWdPtJQtJHkUa5L7lqXpAJKyCUAjt9:2WNb0r85ISJYh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687040142, "uuid": "7221d9da-3397-471d-b2af-ef01b2d2de69", "value": 5224384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687040142, "uuid": "e56e6d67-d83c-416a-8b8a-b38998d29819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040142, "uuid": "6b760232-5c82-42de-a208-b11b720b7504", "value": "cmds.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf92d8f-0cf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686995792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995792, "uuid": "6013c52d-354a-4a4d-90af-1bab63e9b04e", "comment": "Malware payload (Loki)", "value": "15946e09f89d472e175a626f3b8e314c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995792, "uuid": "48cbef83-118a-4335-baf7-c16797f55752", "comment": "Malware payload (Loki)", "value": "4b8c610c5e83b3b4f231233c642d3d9bef476012d4c77eaf3bcfe5a7212abacd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995792, "uuid": "4507b26a-d868-4f2d-af46-c96691c4a72c", "comment": "Malware payload (Loki)", "value": "500af3c6a90cb82ce346566b7ef7661cc3cb0eb0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995792, "uuid": "3f77d127-2d92-4b8a-8d49-3921277dd4d7", "comment": "Malware payload (Loki)", "value": "6b6fc29fa6f49399288485211e478a6c0cf3d455992129787459fa45cc6b332f771a9e9e7681d80416e235f3eee5938a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995792, "uuid": "4a5fc256-85a2-45ca-8b69-161dd5ffe889", "value": "T10AE2E656E79B03788E8211B2621E07C89BBDB53E335540B17C6C923833B9C6A46766FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995792, "uuid": "e1b29e4c-dd34-459f-913f-dd4a66e23e1b", "value": "768:pFx0XaIsnPRIa4fwJMsOzmoT0FSLRe16ymzwhzCypR+ZAC:pf0Xvx3EMsOz5rN2nmKR++C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686995792, "uuid": "1617a49e-bd57-4422-b2f3-40c06449e410", "value": 31618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686995792, "uuid": "ded7cebb-6a3e-497f-b772-1425231e6c06", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995792, "uuid": "bba13705-d694-410b-aaec-a8e5631564b4", "value": "Payment Advice 16-06-2023 SKMBT03783930224000488904003TXT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd6bdab-0d10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687007712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007712, "uuid": "1496de81-2124-4b26-a7a4-479367e09121", "comment": "Malware payload (Amadey)", "value": "e4e7e86b592820fdcaf9191c0925cf54", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007712, "uuid": "4917e8e9-96db-43e2-b03d-61d35b03d219", "comment": "Malware payload (Amadey)", "value": "4be8d072a7d8fc20d035c01f9d37a0e4136c7102a3d0a1616aa3804412ac75ef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007712, "uuid": "1d88dd1d-8d32-44c5-9453-cf170e46b084", "comment": "Malware payload (Amadey)", "value": "860be249ec874161c16100be999b7f718f3bc0c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007712, "uuid": "2231d75f-0628-428d-9e2e-aeef619cc90c", "comment": "Malware payload (Amadey)", "value": "6b1846d79563a99d2f1602d6f027302aa4775831e74ca74ddbdb3d34a8f30cd1359d42a30361b72625b8d0f3f0fddf9d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007712, "uuid": "f4d48cd4-3a4f-4652-9c97-ad6c6e8efd40", "value": "T1C7D41202AAE89133E9B517B028FA03D31B3A7C91597956AA17E19D4E1C337E0F530B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007712, "uuid": "94363b58-c011-4b52-b9c1-f72392922251", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007712, "uuid": "9bb622f3-fbdf-4c33-96ff-53601ce65405", "value": "12288:HMrHy90xMahwVBCvg7r7Bim19C7JHw+qIo1KD2oS3A4:wy7ahCBCY7r75XYJQ+mKDlS3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687007712, "uuid": "3e173e31-acb8-4db2-8f05-d0f736521100", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687007712, "uuid": "106fde52-134b-4ecc-bf6f-9106446e1366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007712, "uuid": "9c333f97-7acc-4164-aee1-8bf29ee742ae", "value": "e4e7e86b592820fdcaf9191c0925cf54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f123ac7c-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687045486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045486, "uuid": "c05cdd0f-0c98-46f9-8efe-170232a431f9", "comment": "Malware payload (Mirai)", "value": "0e48ae25f5cce3cd8930a3498e8f43c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045486, "uuid": "c257d3b3-1344-4681-951a-e20b138b77bd", "comment": "Malware payload (Mirai)", "value": "4be8dbb8bf9260eab1f93f0d710fcc9a313385dc239dc00bdfcda8490fa4d00d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045486, "uuid": "65d82fff-694d-4daa-b586-086279e8a589", "comment": "Malware payload (Mirai)", "value": "bb1565be2fb6a790673a0d3590613f871a5ca707", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045486, "uuid": "133d6474-20ac-4a0a-9908-7553d44ac1ed", "comment": "Malware payload (Mirai)", "value": "1de830a184c8061243ff3eb53943d758ca4b0a27cbf13aa83e2cfe23a28fbf26a755dc253f01f2840de1474115d6d68e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045486, "uuid": "487e6df9-849f-4e53-8fb9-bf58a961d49d", "value": "T17CF339C7F800DEB9F90AE3374853090AB130B79215925B377297797BEC3A1D90967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045486, "uuid": "17ed594f-b530-492f-b7e1-fbf5c0e09438", "value": "3072:iS3FpLHxgTmIDpYfatldI3x3BpHhnb2qeAqt9VcjbiTLIN5nNtgya8ePH:iSjRgqo2xRpR2rAqtdLIN50yaxPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045486, "uuid": "5c5c8a66-e8d4-4922-a131-af005ce65e86", "value": 170656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045486, "uuid": "a9ba03a0-89ea-407b-84c3-7b028fb823e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045486, "uuid": "4dfaa092-fc24-449b-a363-37699552f018", "value": "0e48ae25f5cce3cd8930a3498e8f43c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899e37a3-0d39-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687025126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025126, "uuid": "2fd3bddc-11ae-452c-a4bc-92cedffebc66", "comment": "Malware payload (RedLineStealer)", "value": "b08c46871a6b220052fab764fd15928c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025126, "uuid": "db7292c3-8558-4fad-ad64-afbc04919c10", "comment": "Malware payload (RedLineStealer)", "value": "4bf18d3320a07a94275ce7ad478c8c4a68a67e3aadbcf3f238d939203ab6d050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025126, "uuid": "773abb85-bb85-47d2-a13f-d58e9384b59f", "comment": "Malware payload (RedLineStealer)", "value": "b883d5f64bc50abbde1ac518877d56e94226d712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025126, "uuid": "c1980db2-0a8c-41a0-8a1a-2efe9aa16c05", "comment": "Malware payload (RedLineStealer)", "value": "533b4edb4a3636dffaab07f76aefa5b6f546c0123c14fa67d44f5ee1c4502af74a3c72f11dc97d420808647c4f0b0594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025126, "uuid": "bff9cddf-2583-4900-b04f-380a18c5c6cd", "value": "T1AFC41252AAD45073D8F61B706DF706D30B35BD91AC7443AE279A9C9E0CB26D8A03533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025126, "uuid": "90d103d2-4066-42b7-82ee-448864921a91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025126, "uuid": "cd0027ef-f797-424e-ad59-7381fea68dfe", "value": "12288:rMrmy90NgQidKxxyStHvhnWVEQ3EkjyI:VyHUZtPbMcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687025126, "uuid": "6a81c027-d2a2-4dcf-bba6-35492fe0f74d", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687025126, "uuid": "37564fdd-a8d5-408b-9854-aee43d58ac37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025126, "uuid": "4ce01489-2f49-472c-8038-7d2e230f502d", "value": "b08c46871a6b220052fab764fd15928c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71d4393-0cd5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686982334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686982334, "uuid": "853faf6c-c6e3-4257-b351-364d2a592be2", "comment": "Malware payload (Mirai)", "value": "6eaa1ee8fe2fdd45c6624f31481c4514", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686982334, "uuid": "3b863ea0-a3db-4507-ac88-810ec0b7990f", "comment": "Malware payload (Mirai)", "value": "4c02197a9a1b4175dc5add6871cca607ba3fc4dbd48a3bbf77768e77ef39f67b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686982334, "uuid": "3838caf1-b21c-440e-b559-1214cf702eaa", "comment": "Malware payload (Mirai)", "value": "c92ada2ef9f686a4b4573f3700aaf17ad17ec5b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686982334, "uuid": "6cd79dac-9f58-4156-afae-f405df73bd02", "comment": "Malware payload (Mirai)", "value": "eb4018dd25fb38204dda2f65432de5ea69167a88ce0c7b28b70c87877ca7e8070518e31c264a0500cce66fd570f6faf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686982334, "uuid": "f251a46b-8490-4c57-8ba3-3bb266220403", "value": "T18EE33A17B5C1C4FDC8D9C1B84B9EA536DD72F45D0238B25B27C8AE236E4DE205B6EA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686982334, "uuid": "e5edd16f-6917-4b9c-829b-a8d7b98c27ae", "value": "3072:d7FPBXzu3giWNVGcld5YDjpagqzV1zA/STywX4utClMH4q1:d7JBXzSgjNjlhVVylMHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686982334, "uuid": "3f4c7232-b821-4550-99c6-daa3d0f0f68e", "value": 151592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686982334, "uuid": "4a4bfb16-211f-4533-a3b9-981a41879122", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686982334, "uuid": "8c65cdce-8c7a-4b8b-883e-2e8eabbdb00e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85eecb6-0cf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686996080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996080, "uuid": "0e4c9b57-e3c4-4915-bfc1-2730e9e288ee", "comment": "Malware payload (Loki)", "value": "5aa7935238912fb5c0eb279d2777c7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996080, "uuid": "a969bdbe-30d9-4ac0-9a7f-1dcbd66632d5", "comment": "Malware payload (Loki)", "value": "4c7b710cdbf291ddf58269b2157572210b80d344ef58f9d250c8dfc18e03deb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996080, "uuid": "b6f53e32-6bba-4346-832b-082883607a67", "comment": "Malware payload (Loki)", "value": "44e1e14b187be237c68597632fb79d669e5f84bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996080, "uuid": "096e485a-7b19-4e45-8db5-5d7dff54366b", "comment": "Malware payload (Loki)", "value": "d6a84488ec52024e2c64080bd41a41bd85b11b0da34a16fd6bf1f9ead7c486c19a6ee813311b773229285631e162de58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996080, "uuid": "aa4f695c-6a62-43be-80b3-2e15c271cdd0", "value": "T1EFC422681A638B2BF89303F609247930477F9766347BD6A30D83F6D8EA51F160924F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996080, "uuid": "cfc0b834-e786-4277-8fdc-08cffbbbf863", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996080, "uuid": "69d5ade4-a737-4517-8b6d-bfb13f55a99e", "value": "12288:c5LbzIu9+r9/GgtZpcV26ycNQTHS8ns+KzdoiG8M1K:c5LA9JeBfNSB8dU8MK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996080, "uuid": "21fc7f6e-396f-433e-98fb-c155a3bd9c05", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996080, "uuid": "1bb1e2e9-d05d-43b7-801a-29395e523c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996080, "uuid": "a4afd695-3989-41ac-9e39-05fcd5a1985f", "value": "5aa7935238912fb5c0eb279d2777c7c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923941a4-0d19-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1687011397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687011397, "uuid": "fc111bc2-5fda-454b-8a81-807df2c5c166", "comment": "Malware payload (ModiLoader)", "value": "f3070d794cd4d9ecf03023c3ffc20da2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687011397, "uuid": "cf158df3-a807-40d5-9274-95161834c67c", "comment": "Malware payload (ModiLoader)", "value": "4d5620bed727ed60dfde3de01a9be9933b074701b2e631fec92a623a55afe5ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687011397, "uuid": "c205358f-c066-4c44-9a20-8c092d8479a5", "comment": "Malware payload (ModiLoader)", "value": "5e56796f3393e4e346d27d05bd926f81115f4fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687011397, "uuid": "70feadba-bd86-4f8c-be13-3441daad490c", "comment": "Malware payload (ModiLoader)", "value": "e98a18880dbe3b9ab7faaf61815b4a59fd1841a78f9721e51bdc82383d2ae439e7951b41095ede7b1c6ac6a69a2f1a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687011397, "uuid": "e8600abe-24a6-4866-91aa-a86004fb3fb5", "value": "T16C259EA3B6874833C17217798EDB5F685929BE113D282C857BE4BC8C5B7C7867834293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687011397, "uuid": "67b91402-7d59-485f-b526-167b11569da6", "value": "2ebaf47190fd1bbd26fec0b446b1ee09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687011397, "uuid": "2c96c52b-3cb0-4ff1-8fdb-58d0890d8b8e", "value": "24576:Zs/dShaR6+yPvvIYHGrw8R+d7BOQ6nEz0:Zs/uC4JHGU0gBOQ6Ez0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687011397, "uuid": "46d5f4a7-2ffc-417d-8e00-85bda6492e8c", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687011397, "uuid": "f778f920-04bb-4dd9-958b-6d7b9b1a038a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687011397, "uuid": "7f02181c-1f8b-40d3-92d5-4ae3b931a441", "value": "PT000775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523657ee-0d51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687035341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687035341, "uuid": "9fe0f1ca-b0b4-467c-b7c5-eb4a4f90661e", "comment": "Malware payload (RedLineStealer)", "value": "28a269caaa4ccc942f3adc2960314572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687035341, "uuid": "f6529b2b-9187-47c4-a3bd-ed95de04a0d3", "comment": "Malware payload (RedLineStealer)", "value": "4d5dcb125af799aff872379946f3a7e2a2385fee1742229be66af19eeacee6c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687035341, "uuid": "0c8db9e2-6e77-4767-97d2-a51f9417bdf6", "comment": "Malware payload (RedLineStealer)", "value": "1012588ff9b1c95cf667cd205dc85c0374b3ff1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687035341, "uuid": "329ac656-84de-4698-8591-c6f799db584b", "comment": "Malware payload (RedLineStealer)", "value": "e91a2b4a8625fbdefa5c58095fcc6e5c0638b1d94dd76a735df2d71737a065f3f851ba4fea9602c579899651c5d64230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687035341, "uuid": "fa3b85a5-45cf-4940-8a82-447ef2817c8e", "value": "T16BF41243BBD89033D8B523B058F642930A35BDA29C384B9B6344AA5E4DB3BD5647173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687035341, "uuid": "0f61eece-0e93-4b2d-9a52-3d560b23198a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687035341, "uuid": "e671eef6-f77a-489d-b0a5-4f9e4eb5ddfb", "value": "12288:jMrVy90ljGEemGgll+r3g6yc8I5RgRXPsdexUtKBoMQHe8mB7CllQNfm:SyVBThzg6yc8IY9Psw2AFQHe8w8lyfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687035341, "uuid": "502867c9-7ced-4f3f-937f-ff51312a999a", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687035341, "uuid": "3b80deb2-4292-4396-ae5f-309bf0a3735a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687035341, "uuid": "0e8e1e09-8be5-440f-8f29-686775bcf738", "value": "28a269caaa4ccc942f3adc2960314572.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ad7977-0d34-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687023026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687023026, "uuid": "11ec314e-1923-4894-a0f0-d1855c5d580a", "comment": "Malware payload (RedLineStealer)", "value": "aeca05f8cc4fe436eff6ddf471a12265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687023026, "uuid": "ea8c7cc1-1938-4cc6-ad2b-107f9d7cb0e2", "comment": "Malware payload (RedLineStealer)", "value": "4e4eed16b3a6b4c9f1168745b8268765a9b7a0b5c557cc7e2975c24940eed32d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687023026, "uuid": "8e145e6e-b4d7-460c-9f23-10bdd6c66b6c", "comment": "Malware payload (RedLineStealer)", "value": "69231a0d844ada1834691bbd68ceab46ff026776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687023026, "uuid": "7aa0baa2-975f-420b-ac6d-7765e2c89c19", "comment": "Malware payload (RedLineStealer)", "value": "3f3e0b3409e045e9fedf2992d1100056e0938162ed75ed772ce7c7cca833b88050b432d340cb21ed2129a156964c3f5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687023026, "uuid": "9548c2ec-04ef-48a0-9c86-5fcd6b6638aa", "value": "T156051242E6EC80A2EEF56B7058F505830736BD918C38872F3395689F1D72AD4E17672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687023026, "uuid": "a177aaeb-33ac-4a60-aa30-53e8d529d459", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687023026, "uuid": "5a11dbed-fc37-4e7c-9671-181cac343207", "value": "12288:uMrly90QAbog1jinW0wIusA9dysfgKsX3dzL6hdw8YqLuebEcc:HyDW1mzH4dhtS3ssdGrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687023026, "uuid": "9c469a6b-0840-4462-9da8-b6aac116bfb2", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687023026, "uuid": "c1c9fa9f-da3c-4394-985c-d33a3f48b7a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687023026, "uuid": "ce60c136-954d-4abc-946e-d2bba7a11340", "value": "aeca05f8cc4fe436eff6ddf471a12265.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2935a41f-0d2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687018522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018522, "uuid": "53e73d7e-91c8-4b57-9dae-ee140ed395ea", "comment": "Malware payload (RedLineStealer)", "value": "cc0de4e46e121861ac73c8bcac840e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018522, "uuid": "042059a7-155a-4ff0-ac20-94972c70c523", "comment": "Malware payload (RedLineStealer)", "value": "548bb3898b2b3182ffa75e4524bc2da9e9a52c13be829fc9c6e0d78c1578d2d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018522, "uuid": "30fc3046-8058-460d-8ff8-ba78926501f2", "comment": "Malware payload (RedLineStealer)", "value": "3ad8f8a04756d8019635514839598c0a424a2c5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018522, "uuid": "1193abf5-f1c5-4aac-b01d-f1517e1ddd03", "comment": "Malware payload (RedLineStealer)", "value": "c9b6db3fdb3dd1ca94d92e7fcced47896ec0d8b07506eb73be95441629e5de5e76c4c4565a52f67fa00501700bad87e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018522, "uuid": "35f3ff20-9063-42ed-beb9-86385303cbea", "value": "T1E6F41213A7E90023DDB93B7024F647E309327C61A8BC466A1741DC9E0EF369999717BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018522, "uuid": "7e3acdcb-aaf6-4841-9b8b-27b0a41a72a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018522, "uuid": "b491e63f-f133-4403-a3d2-97d38fe56830", "value": "12288:7Mr1y90Oofqwowe1KjDpXVUKfnnNttc40yc6fbg9x08stI6pv:WyTKowXfDDfK40yfg9x09Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687018522, "uuid": "51cd1f9a-e0ef-48d5-970c-a4d550d8f16b", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687018522, "uuid": "5726efe4-1c70-41a0-8f56-857763212558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018522, "uuid": "c1efacd9-d337-4cfe-9b2f-b28c5b6ca10d", "value": "cc0de4e46e121861ac73c8bcac840e5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740ee3a4-0d30-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687021225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687021225, "uuid": "70d52589-940f-432c-b27c-f09bbf858ec5", "comment": "Malware payload (RedLineStealer)", "value": "82e0a24838c36217af889338cbf4cdd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687021225, "uuid": "84128fb5-ae1a-4249-9422-96f1aadcba27", "comment": "Malware payload (RedLineStealer)", "value": "5595623bd8a43b0fbde25a0473e0fdd8d255bf5341b7938286d08726107912ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687021225, "uuid": "6c78bdd3-fdb5-4af8-807a-672e954b06f1", "comment": "Malware payload (RedLineStealer)", "value": "7b3dbbeb05003807bea5ac38978dcc6f877b5766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687021225, "uuid": "2654b18c-d177-4a38-bb13-bac47eac7fab", "comment": "Malware payload (RedLineStealer)", "value": "80112df606338f4b1323b88edfdbba61d2f15ade9971cc6130e0fa6a0b7382774368f874340675f955d9c763932780cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687021225, "uuid": "bb46c0c2-0d70-4979-9407-d83918ee6648", "value": "T132C41203BBD45032D9B52B7019FA02930F36BC62A9B4432F2741999D1D73AD8A87637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687021225, "uuid": "bc7edf82-c54f-42b4-9ace-b12fc4b8010a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687021225, "uuid": "386640e5-f279-48c5-a429-5aea519c4699", "value": "12288:OMrFy90QktqZLVycYG7/oengDAIh9UjAeOMOlC25cWlQQFuPpD:/yNWqZLVy0vng39UjATBhHFuBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687021225, "uuid": "562c9f45-8dee-4ef9-bafe-9532721e3cc1", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687021225, "uuid": "5d7bbff9-2b11-4c64-9bac-9cb4057ffb84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687021225, "uuid": "c77f68a3-ab7b-4fc8-9a54-b34f139fbec8", "value": "82e0a24838c36217af889338cbf4cdd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7a7aff-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985622, "uuid": "b8482132-afe5-4be6-a6c6-02ab87182896", "comment": "Malware payload (Mirai)", "value": "c5cf54e1411c5e506efc49f7d472a3bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985622, "uuid": "405e8511-0fbc-4cfa-9a4f-45d55404cd17", "comment": "Malware payload (Mirai)", "value": "57861fd6bd657864d32b08e375f7e0d3b9ff79ef4a439e610bbbb4dfc613859b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985622, "uuid": "b3f16dc4-3e03-4b22-b962-7e90e8b3faf3", "comment": "Malware payload (Mirai)", "value": "1cc85e7d95837fbc01c3c5a08584270810ac6651", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985622, "uuid": "019cbdf0-3a89-436a-aada-24271c7ae0ab", "comment": "Malware payload (Mirai)", "value": "71c1ec508029881499c9d7deb3e10fdd80b78eb312baf3225da95a2efa60bb1206fa1112d7a252a84ff9f13e17b2208a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985622, "uuid": "5282b070-13a4-4e3f-b375-44673effe4a3", "value": "T166143B46EA418B13C0D627B9FADF42453323AB54D3EB73059528AFB43B8679E4F23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985622, "uuid": "961e3007-5ef8-4aee-9cc8-27f6bce0a079", "value": "3072:+mnkFJ4XUM4NulN+B+gWaT0/PAVEb/213Yc2xLUoORSEz8oVM/Rj79CaZ:+mnkUlNu5WaT0/PAVwCYZZgRSMBVM/Rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985622, "uuid": "f23de4d8-57c8-47ec-8022-91efd0901540", "value": 196332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985622, "uuid": "c8772bc9-0d16-45ab-a1fd-e75c4c068eca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985622, "uuid": "d7d161d4-2410-4cea-99f5-95a86f47cdba", "value": "c5cf54e1411c5e506efc49f7d472a3bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9eff30-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687045422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045422, "uuid": "ddea8e95-f915-4218-8773-62ee70fc7a84", "comment": "Malware payload (Mirai)", "value": "ec527adacd1132a7e6d87f9dbbe72aa2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045422, "uuid": "c3a702c0-84ad-420f-863b-69e988b89218", "comment": "Malware payload (Mirai)", "value": "59fcdaf4d6f987838d3c619be9cba4a8ca36b537057f09f69eda75c8b52b5f36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045422, "uuid": "8944a886-b22d-4275-857d-70780732e098", "comment": "Malware payload (Mirai)", "value": "b7ef60ab48d6346db97e3e370227beae664b7c47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045422, "uuid": "31223a89-289e-46b4-9162-84713b2f51f4", "comment": "Malware payload (Mirai)", "value": "173fd8b8534033b4fd926ff5257a47e26066c6c43a8597ae2d0dec6b186d3b12803b4c41c7f4603b224c61877ae1076d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045422, "uuid": "b7121676-6c3b-4d69-a13c-c1e7a845b5b2", "value": "T135434951F8819A23C6D1127BF66E428D3B3613E8D2DB7307AD229F20379682B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045422, "uuid": "7be05b53-66b0-4564-800f-ef686088c13d", "value": "1536:sQ2gT1poxMBCjn5zogVvqFhOiC6DavD/8:F2TneevGA9ND/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045422, "uuid": "7645aa97-9b9d-46f4-9829-94f8e638148a", "value": 59260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045422, "uuid": "8eb02252-6e9c-4ce1-88fc-9d6d062488c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045422, "uuid": "5e46b26a-3424-4904-8e97-ad9bb8db89aa", "value": "ec527adacd1132a7e6d87f9dbbe72aa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d744e5a0-0cf4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686995621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995621, "uuid": "0c7dde94-9670-4fa2-b300-fce8da493963", "comment": "Malware payload (Amadey)", "value": "85d5e40f555a77b020385076e37f7876", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995621, "uuid": "9103bc0d-19be-4778-bdf0-ec484cad4eb0", "comment": "Malware payload (Amadey)", "value": "5b04a5dd38b3ea7233ce1458738d5adf8a7fc6bd0c3731bd191383e720e8e847", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995621, "uuid": "1138d102-8e6e-49b3-a6c2-a5d0673cbb96", "comment": "Malware payload (Amadey)", "value": "f1ef0e38624bfa6f3d60018912bbb7057faa063a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995621, "uuid": "feff5880-6fd0-48b5-aee7-753420b4ce25", "comment": "Malware payload (Amadey)", "value": "0ccfa8f589b091c52b3b3ca1d60ffec139c5346dd800fc8c9dec5fa1f354abeb04554b2fc64ccb4bd4474f9053d61382", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995621, "uuid": "d43f66b3-f654-45ef-9870-6b906fde950a", "value": "T1DBC41203BBE54036D8B46B7018F613C70E3B7C919DB8932A3A46AD1A0DB2B54697177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995621, "uuid": "44daa170-27d9-4819-ba01-17ad3e0c0916", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995621, "uuid": "ed362a6e-687a-4d98-b099-84efaa49ed62", "value": "12288:QMrAy908BMEyWfJTsVREnSzINE/c7gmywpyd2P:Ay7tEzEPNMCgmysT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686995621, "uuid": "3a1d2e72-a3e5-4c7d-8d39-073b30cff311", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686995621, "uuid": "4316adf2-c3a4-4d1c-a651-57ed94ca485f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995621, "uuid": "f4eb7183-269f-40c4-a812-4a49fb2f47f9", "value": "85d5e40f555a77b020385076e37f7876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5e72ec-0d32-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687022124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022124, "uuid": "64b82e2a-2164-41e9-ac22-562a3bb491cf", "comment": "Malware payload (Amadey)", "value": "c87d3eb20c7bdc6dfd4d4209d614e6da", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022124, "uuid": "864c3745-a1d5-4fb9-8ad0-2529c52a3e7f", "comment": "Malware payload (Amadey)", "value": "5b6eeff5e160f538a569232ed92cd3e5fb3172cac5a4b5bd5e89bf0b5b359f21", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022124, "uuid": "196ff2ca-ec61-466a-9349-8507c46899ed", "comment": "Malware payload (Amadey)", "value": "061fd19701a92be0617a5027ed56ebf435645bdf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022124, "uuid": "236a6bc6-c890-4a95-aae0-25f2e5630285", "comment": "Malware payload (Amadey)", "value": "b692907a7815917f87a40ff74fbf7c01356787d63286d6e2c6e041c748d5c590081ce9c86b31aceeade99d2535dd762a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022124, "uuid": "f6bc8f2d-2932-460a-aae9-bc928dc43561", "value": "T1B3052212A6F84273DDB51BF11DF913C72E32BCA5CEB482261246959B0C631A4B9353AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022124, "uuid": "f7e3bb2d-42de-4cc6-8aab-1adf1a3b3439", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022124, "uuid": "97320c70-9a3d-4e56-a132-416bd16f0fcc", "value": "24576:3y9B+aKyxyBL3Vn50+xALaqjotKJ3LtJ:CCX+yJ3F50+xGVk8NLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687022124, "uuid": "b64f146b-3151-46bd-a89a-cf21fb038652", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687022124, "uuid": "95d6afb5-50ae-45ef-bab1-3fe1718f8e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022124, "uuid": "f14b0738-b50f-4662-9b55-a89fd2887ddf", "value": "c87d3eb20c7bdc6dfd4d4209d614e6da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95016530-0d3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1687025575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025575, "uuid": "0a3de720-4903-4a01-94e4-930d4497ad4e", "comment": "Malware payload (QuasarRAT)", "value": "3dd582fa094ed1d860fc4f31fa8d660a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025575, "uuid": "d9866b26-5ea9-492c-b555-04e0e324b21c", "comment": "Malware payload (QuasarRAT)", "value": "5c46967283614668bec2472cc6c95a8983ac5e78cc7c03db2242cdc026d9159b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025575, "uuid": "aa807285-d228-4a93-8774-00ad132874d3", "comment": "Malware payload (QuasarRAT)", "value": "f46b157a54ff616a5d91e4890afda8542f4b2ac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025575, "uuid": "5da00f1d-8013-4601-9365-08b8b3308c45", "comment": "Malware payload (QuasarRAT)", "value": "b3700f37546081a67079c82f5e07eb8fc54caa59edcfd0e7c3bcd56388e8d38ce2dab26140d8fe08f03ef979b6d27f6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025575, "uuid": "be48cc6d-ea8d-4741-8561-241cf800a9e3", "value": "T1C4472306BEE518B6CBF8F33104A62B603B75B459432677C32E9456BE1D1EBA41D2F324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025575, "uuid": "b05d3ef4-3261-41a7-8943-052926f680e5", "value": "96c44fa1eee2c4e9b9e77d7bf42d59e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025575, "uuid": "44f0b67b-e025-4908-911a-1a78ac8d52ba", "value": "49152:KpXVo0nS3/K3Jjkz3jBk55UeXBqFMGIWqs/9qICJ5eV1HEYoTNscG8O/E0xjT/3p:uVobzeMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687025575, "uuid": "bbbc4ba0-a712-4d00-a16b-d22ab12c47d5", "value": 24775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687025575, "uuid": "50d2f22d-e7b3-4777-b04a-824c3bdb245c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025575, "uuid": "145e6a9d-fd12-4e8e-87eb-6263a1c27856", "value": "@Yoricure.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283e5d70-0cf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686996187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996187, "uuid": "4df6065d-94a9-4c09-97cb-da84d022b080", "comment": "Malware payload", "value": "b7a86ea42141594c9dbb115c0e1f4249", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996187, "uuid": "7e6a9b24-a36b-4798-b200-2e61d0a621ca", "comment": "Malware payload", "value": "5cb23b5681fb5ad8fc84375ce8a8161fa9ba3650ac0f3361972268128febfad1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996187, "uuid": "4ef91672-1cc5-488b-a379-8ca5d2601858", "comment": "Malware payload", "value": "126e98f99cd7a38f07e3c38132dafce175c702be", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996187, "uuid": "f4e38855-a475-4c19-99e6-d3f0f3c9f864", "comment": "Malware payload", "value": "dccc04fe5414482dfd769549671d1b7662acfc20cc3c52a53f6c5f6253c39dbb29cb5aada4772890dd1dda9744c724d4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996187, "uuid": "8d894933-7884-478a-9950-38aa3d07e7f5", "value": "T17B646B5EF1E9B5E5CCF3E0B8C1BE8696FA75300D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996187, "uuid": "1a996540-518f-4bca-a045-9db5060b2026", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996187, "uuid": "3d941a6e-9d7e-459b-9285-c004d86bb351", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9mC:5xb8ZqekwkJPaThgyDChXohRRw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996187, "uuid": "5894244c-0dd3-4947-998e-7ae5c994ddc7", "value": 320532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996187, "uuid": "4668aff0-fba2-4c4e-8698-f95487e04c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996187, "uuid": "feb3e52b-6467-4daa-a3ea-acb524e63b4f", "value": "b7a86ea42141594c9dbb115c0e1f4249.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6010835-0d04-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687002545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687002545, "uuid": "c99a3a80-d60f-42da-845b-1d58746b9855", "comment": "Malware payload", "value": "8c390292fb5916ec70e5c64016675687", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687002545, "uuid": "352ddbdd-464f-4617-8297-596fc8374383", "comment": "Malware payload", "value": "5de1a4ad452af2f5bff7b232c22e2f397d1af97a95ee427d85ea927986d8b31f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687002545, "uuid": "ac303a21-f744-4628-9334-b629a8bfbbc3", "comment": "Malware payload", "value": "31f29e9d7ee34bde08b2456559203879379fde0f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687002545, "uuid": "5ec878f9-7642-4cc0-adeb-ed53ff318ee8", "comment": "Malware payload", "value": "f7788852ba8a0bc97cbf34bb53379d52b7cdc68689398b9a46c26715393bc037fba713890a654dc2bb9362aa0915dd42", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687002545, "uuid": "457767bc-d899-467e-b9d3-60d51ddf2c70", "value": "T196D3CF15B6EAC967D61106330FDBE7D93B39BC0C9D56C22BF210B76F6C7D5A08612282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687002545, "uuid": "1285a00b-88d8-46f1-87b6-2eeee93d99ca", "value": "3072:ik07xEjkTkwRlrF+ix0p7dhlV/cDK6IN7EXDwXLCCJ:iDEjkomQgshoXDOLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687002545, "uuid": "f58701ca-1a12-41be-a5a4-dff3a274ffaf", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687002545, "uuid": "5d044cf1-7b5d-426a-b264-4d6832dedab5", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687002545, "uuid": "a0d6a7fb-a17c-4c03-9156-866051d9bb15", "value": "8c390292fb5916ec70e5c64016675687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84a1fb1-0d4b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687032936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032936, "uuid": "c7783f81-f046-4053-877c-007ff34c95e5", "comment": "Malware payload (Amadey)", "value": "52dc06ed8a8ede9e22b96e9acf1949b2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032936, "uuid": "b1ef5348-bb09-41c6-b805-9624ef0e1334", "comment": "Malware payload (Amadey)", "value": "5def806156638d2795eabe2316f883d7bedaa757fd63c27482a496e7c0ab2763", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032936, "uuid": "f66edabf-a6a7-42cf-b486-28bb86591881", "comment": "Malware payload (Amadey)", "value": "90f14cdfcbcff45669960c6623f705a7c4c9a4a0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032936, "uuid": "6dfc9e2b-3c6d-4e26-a999-af9d441cfe5e", "comment": "Malware payload (Amadey)", "value": "b129d83f1f5a3480ee1ad9d6164c0922f3c6de629910d40dda98d530b8949dc4ce5c529bc1ac3fb48854e227d1c1cc7e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032936, "uuid": "66a7c376-f7ff-4a6a-8d69-85020604b3d3", "value": "T1A7C41262E7E89032E8F567B058F606930B357CB58DB482A732C5684E5C72AD4B53373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032936, "uuid": "b91c28a9-73f6-4cb8-a7c1-7fa2131d75c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032936, "uuid": "d15cc11f-0c5b-498a-8042-bce4e15b046a", "value": "12288:xMrVy90sp4/zutTu1nIjW0BE8TCHqyfpu9ePYiu/6:kyrp4/z8SKjWI3Wpnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687032936, "uuid": "8a6977e6-c134-4c3b-a56b-c2bdb96aeb3e", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687032936, "uuid": "a0e7c67f-02f8-4515-a649-53a86a47d105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032936, "uuid": "d74e906a-0b50-49cc-b57d-a6f0a1d0ad92", "value": "52dc06ed8a8ede9e22b96e9acf1949b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead15959-0cf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686996084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996084, "uuid": "1cf23f23-de55-42e2-8de8-e450c4220bb3", "comment": "Malware payload (Loki)", "value": "55dc7ad59f85bf7a69efb82ddbce33fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996084, "uuid": "e4708eb3-122b-4989-8fb6-a74889fe2123", "comment": "Malware payload (Loki)", "value": "5e0a6bf1cb4d379d238d51cdab8bd64b47c10c2921f3f2cb1f6da2b33c8ac332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996084, "uuid": "4943c2ac-d50b-4aa9-874c-1ca86421c6ca", "comment": "Malware payload (Loki)", "value": "ade555997acf1d43029cd140b1d66f0cd2e8f0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996084, "uuid": "7caa90c6-456e-42da-9d13-a1956f226561", "comment": "Malware payload (Loki)", "value": "d0e7c796778784c3118037b06a6028f6be55f24f042477f5702ef0f1713d81c5229d3f81058ab8c919b3178ab314da0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996084, "uuid": "52dd9041-1567-4c17-9088-14b0965fd621", "value": "T196C42399539BC70BC1970BF51C107930177E9AEA341AEE634DC7B1D8C962F214AA4F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996084, "uuid": "40bf3502-b56f-42e7-995b-a25f2d82f83c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996084, "uuid": "8c1fa8b5-8170-474d-9528-5f377154fb53", "value": "12288:j5LbzIu9+r9CEmNMaumCDFBUVGJtE9h4IWWb7qbVvem:j5LA9jmNMFnFCSK4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996084, "uuid": "21ba4563-31ad-4926-a1f6-1ae140b9aa56", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996084, "uuid": "e62e3ff6-ad54-47ff-acc4-36e4ba6b2ed7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996084, "uuid": "545f6ba8-da60-4d35-baba-257930c9d0b4", "value": "55dc7ad59f85bf7a69efb82ddbce33fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d7f228-0d4d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687033837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687033837, "uuid": "90f66ede-eea3-44bd-85aa-a5cb34d714cd", "comment": "Malware payload (RedLineStealer)", "value": "fd169eaedbb476e6e8b9373036b43df0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687033837, "uuid": "18fa2fc7-e0ef-4a4b-871b-25bc7efca434", "comment": "Malware payload (RedLineStealer)", "value": "5ea65da532ee70eabf6ce6745c285d5128ecb4cc7f49a28452d437a33b52e71b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687033837, "uuid": "d181479e-9033-42b8-99cf-a7070c32260f", "comment": "Malware payload (RedLineStealer)", "value": "7928483a40b9ec0245a4c58caee72d77ffa7fbcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687033837, "uuid": "744a1ed7-a90f-456c-b082-a32c38f0bd85", "comment": "Malware payload (RedLineStealer)", "value": "825a232e51a9f182db57e4e00d86ba8015ea64891c88f0c184b8013c978cbbde4f8bdb1d96ddd02c47fa32d5076ab73b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687033837, "uuid": "c304e3b7-3b00-4a7b-b530-e114268ecfd9", "value": "T13D05226366E88063D4B257B0A4B30AD70E327CB15DB8836F23805D5E4DB3641B676B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687033837, "uuid": "9061b717-f03d-4a19-a752-5966bb1c99ee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687033837, "uuid": "64e9ec8c-5770-4a89-bfde-141071dcfe0e", "value": "24576:gyDLvgXlgrE+FBiaZSAFyXpGEWSj1zL/68RD3V5hSF:nDjMlb+FbgpbWSjx/fRp5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687033837, "uuid": "b174ea2a-0e4f-44a8-a45b-8fdfbf465792", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687033837, "uuid": "45a0ebdd-9dde-45af-b9a3-80ea79feb4f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687033837, "uuid": "9a71872e-0df7-4a8e-8a7b-ff0c538454b4", "value": "fd169eaedbb476e6e8b9373036b43df0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de587d1d-0cf3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1686995204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995204, "uuid": "ab132d77-3f96-48a0-9f70-9f5e5f6e37a6", "comment": "Malware payload (ArkeiStealer)", "value": "dc3352babcf165a455d86f015a26b742", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995204, "uuid": "366b536a-fe81-4e61-8b82-7f205f80530f", "comment": "Malware payload (ArkeiStealer)", "value": "5f4de2701910791472fa25d6782de8cbe53e39e1cdfa3908413d01d82c2e62cb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995204, "uuid": "5a332e32-adbb-4f9e-8357-3e47268a1fae", "comment": "Malware payload (ArkeiStealer)", "value": "1fc13a29c121ff53eb74cb3c202e148cb92d3dd2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995204, "uuid": "2fb78ba4-3c76-4580-8cdd-2c71623fc6d1", "comment": "Malware payload (ArkeiStealer)", "value": "50f7d937d4ce160bcce144b49e25e59593ee1a2273c30cdac3db9fba0c325b91446c1f8dfb1d5a77acdc5cfda0ac0808", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995204, "uuid": "e1fb53fb-bcd9-49f7-a11c-b2c29f3a4673", "value": "T18A941803D6B23D44EA76CF729E2EC2E8B61FF6508E597B6D5118DB2B04B1072D263721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995204, "uuid": "d0b8f764-25aa-4f3a-ba94-fe8dfec76cb9", "value": "f719d133eb0a7f30a0b9bd8ad8b269ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995204, "uuid": "701f6166-e769-4a1f-b531-2bd5376f8a5b", "value": "6144:YYeNUWL37Z8OECYnGl3f5CgJPmubuC1SdOR2T3rlBU+1:YYeNprKOEC0GfYgQ+MU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686995204, "uuid": "e6c74e5a-c092-4ca0-8163-29f1dc057cb1", "value": 410624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686995204, "uuid": "9a33913a-d2c2-47ea-9a02-747eb744a712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995204, "uuid": "b4c86a77-92b9-40e9-96fa-c504c8674ae5", "value": "dc3352babcf165a455d86f015a26b742.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be333c6-0cf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686996139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996139, "uuid": "757c7180-874c-4d23-93ce-3950aeef469f", "comment": "Malware payload (GCleaner)", "value": "72cf791a4ed7e9d09ed9424e54a22c27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996139, "uuid": "d1935668-a863-4daa-a27f-b841f92578ef", "comment": "Malware payload (GCleaner)", "value": "6087a2f0f1249bb3ecf33d86fd3eb904f77ab0fdf5f4ba440e5790c84f24afde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996139, "uuid": "5d766129-f45f-449d-a8b9-8e5f607d549a", "comment": "Malware payload (GCleaner)", "value": "e36eb10c4c3a9c8b1ca6bdae95ecd92b11f4615a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996139, "uuid": "5d602306-6319-4a48-8a73-a1b43d40a39f", "comment": "Malware payload (GCleaner)", "value": "8b3e83c4eadd942425e30893516697298e2f081e5c18a9451786ff19d66fa3f115d9672d09c7d39af278caebaf4691b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996139, "uuid": "f13a01f0-3a0c-44a7-83ad-5ab00436017a", "value": "T10654F11276E09832D8752B715CBBC6D55F2EFC924F355A8B227C2A2F5DB02E08A71317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996139, "uuid": "50af94f7-9657-4de6-b17f-d1d4634da367", "value": "bc6756801ecd28fd46322f450f7e2c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996139, "uuid": "ee205990-608b-40ae-acb3-034ad2648795", "value": "6144:voXpMqZkI4xX0Sq4CFKpUIn05C43Z+G8ec2VoH:vGpMqeI4xEV4CFEUB+Uc2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996139, "uuid": "0ac6dca3-3e3f-4770-863e-8a55792aba5e", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996139, "uuid": "10d77139-7d84-4973-a1ef-2b051b804f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996139, "uuid": "cc1345ae-ae53-4dd5-9ef6-4164d1e6fd1b", "value": "72cf791a4ed7e9d09ed9424e54a22c27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35920d0-0d3b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687026028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026028, "uuid": "a814be05-3597-42b5-9cf0-aac60d97dee1", "comment": "Malware payload (Amadey)", "value": "62ac7f6bfbec74201ecd3c543d471a00", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026028, "uuid": "786f2681-03d6-48f3-a2f4-3705c0682e9d", "comment": "Malware payload (Amadey)", "value": "6173dc53f3ee8fac2a364496d428673f009d13b966b3471624809b5e91d39bb1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026028, "uuid": "7cee2c92-4801-4e94-8431-4bf74735a8f7", "comment": "Malware payload (Amadey)", "value": "65cd25c3c1ad138e661928c8167afd78ca9cd043", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026028, "uuid": "802d4f4f-6842-4e1c-a6a6-9aeb60c3931d", "comment": "Malware payload (Amadey)", "value": "2a0f80c6e85da0a008b18ca452f570a9a44cef50db921442dc8d7a863d39c86afe7ace322fbc4c32d7f85557ad8f0430", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026028, "uuid": "04c49244-87cb-4b92-9844-a5899d8ba19b", "value": "T192052306BBE52432DAF15B741EF926C30B32BDA54E74C71B2657689E0DB2690E07073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026028, "uuid": "6681342f-3571-4291-991b-a892fd140657", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026028, "uuid": "c898aea3-9ca1-460a-8989-b98a614cf518", "value": "24576:jyPcKUMabSqPfNYu3HtT+lavHsOQaTGci:2kKUMa+uqu3tTiazG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687026028, "uuid": "03da9add-1a17-4237-ad1c-6903976f4ea7", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687026028, "uuid": "5a3b6f4e-4975-4b5d-be46-336aa42bcd1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026028, "uuid": "77061ada-cb45-4e06-b3f7-74888fb40a03", "value": "62ac7f6bfbec74201ecd3c543d471a00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1bfbf6-0cf4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686995631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995631, "uuid": "d14de0eb-c23d-41ad-b1e2-9290a406ac02", "comment": "Malware payload", "value": "111cb53077982c5663366b1444d8cd1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995631, "uuid": "8c0ec1da-dbc2-4b42-af29-4da94b792af2", "comment": "Malware payload", "value": "621073c2fd07300a3d202b5801f3c17869f0aa73718033492ac986aafd9a897a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995631, "uuid": "155ee8c2-8572-434c-bdcd-351ee080fd65", "comment": "Malware payload", "value": "e488375512598815d999c1b1c262342c0140298b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995631, "uuid": "e24a3e62-84a2-42a0-9509-54d3de823a98", "comment": "Malware payload", "value": "02d34f773364b01193137fafb0cd786a8acb2d412a1bcdc513b99747a2287dfe70c54928b009c674fea189e06643c22e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995631, "uuid": "ec748bec-e008-4902-ba40-29188d56f290", "value": "T126E64A07E89191F5C4ADD170C6369262FA303C845F3067D73B64FAB92B32BE46A79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995631, "uuid": "9ff6d590-9141-4028-b1e0-a13d323b6331", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995631, "uuid": "4a28cc0f-0cec-4637-83e6-331ca1d1a572", "value": "98304:TClrUORb2nth32ic3gefxEu/4/dd+oy+0Zg:TgoOt2nGxgeaf/dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686995631, "uuid": "b93ecd3a-412a-4447-981e-df8e952b2a6c", "value": 14533120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686995631, "uuid": "2bd6b428-2316-4f6a-96f7-5608661ba02a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995631, "uuid": "c2b22346-3f7a-4fea-975e-3e562fac3c2c", "value": "111cb53077982c5663366b1444d8cd1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cde210f-0cfa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686998047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998047, "uuid": "cca14009-ce3b-41f7-b425-d5c07e35307c", "comment": "Malware payload (RedLineStealer)", "value": "dcf3f58df5796ec24d1a2dc944e26e1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998047, "uuid": "319f54ca-439e-4d8a-bbf7-b169ceb65a69", "comment": "Malware payload (RedLineStealer)", "value": "6366eb832db7377d14b1065e56360344c77d4233d896ffc56538f2c3c563014d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998047, "uuid": "19065630-1f63-4a41-8f7e-8b4720b9eee7", "comment": "Malware payload (RedLineStealer)", "value": "8f562806926e39df5bddc0ee05e78b65a24d88e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998047, "uuid": "46e54cec-aeb0-4e53-a2e1-2f9c9cdef4a6", "comment": "Malware payload (RedLineStealer)", "value": "dc1b844b4151541428dab90992bb3150dc49fbb38a1e9cccb2213b8ee332947b5ac6accb9ede84fab8bc42369d78984e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998047, "uuid": "cd21f4c0-0f69-4116-9ff6-be588001cd3b", "value": "T138052222AFE85436C8BE17706CF627D70A75BC515878D76F3754AC4E19B3284A83232E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998047, "uuid": "c2fab359-a940-4a5a-b99b-e094496c6849", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998047, "uuid": "bdf571c1-10f2-4dff-8199-e4f0bb986d6f", "value": "12288:GMriy907S2I0yDWIFUaKH52PokTSQNPVp1JKAH7pYC/ShRv9w8Z3rtvV6df:AyASMyi6KHlSVp7P1KRFw8ZhVIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686998047, "uuid": "b0f0e9c3-7f3e-477c-8dac-50ea85789bf6", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686998047, "uuid": "c069ebed-6628-4361-8141-18639fa5652f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998047, "uuid": "c8410278-50e7-4690-a93a-e17e772803e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73488a3e-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985575, "uuid": "a05cd0fd-2332-4972-bcc5-b7cc77a8da3b", "comment": "Malware payload (Mirai)", "value": "47843c177b44514c784e8133c61e45d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985575, "uuid": "2e70d618-c8a5-48d5-9927-523d5bab230f", "comment": "Malware payload (Mirai)", "value": "64d62a0dec2b62ff1d0896716b4ee5a2f23f8ef817d129e736b39ac73ce0e7de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985575, "uuid": "8faaa3f2-7b08-4330-bb0f-2dc83bc13b87", "comment": "Malware payload (Mirai)", "value": "8a9360e8973e6c277d1c460aa7687217c2de036f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985575, "uuid": "e1f3fd79-bca3-4467-a20b-7ef1fc63e076", "comment": "Malware payload (Mirai)", "value": "edae77ef91a005829c6d628445c2cd93b5ef71068a7e56bcca8f71aa6c898bb225c44d2a4270a822ba5fbc4f28fb6160", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985575, "uuid": "3de6811c-a01f-40f1-9762-72bfea72b7ca", "value": "T176E30745FC519B23C6C612BBFB5E428C772A1768D2EE72039D256F24378B85B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985575, "uuid": "15426778-52b2-4bd7-96dc-7a32b988520f", "value": "3072:7pVPmDkW553LlFju4gvsPtLp5yiYOhK28WI:7pVA53pu4g0PtLO28N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985575, "uuid": "f977d946-585f-43d9-bfb5-41b6f19316db", "value": 145964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985575, "uuid": "a8b76cf1-6a43-4368-9ab6-97bd70e40fde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985575, "uuid": "a0082657-383a-4125-bb35-beb4685eef3d", "value": "47843c177b44514c784e8133c61e45d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4c9b49-0d15-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687009513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009513, "uuid": "cdc2c799-8671-4c50-b0fe-6c1bdc6e40cb", "comment": "Malware payload (RedLineStealer)", "value": "b9d55297a7aba54b133fecc4a0925042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009513, "uuid": "c87e02a7-7220-484b-9e04-17655ddedbbc", "comment": "Malware payload (RedLineStealer)", "value": "65906dd4dc0b1830b4d29c799940d85c00ae9c8069e597ddc9418a102f3418c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009513, "uuid": "3ed105de-59a2-467f-ba51-38971c226fcd", "comment": "Malware payload (RedLineStealer)", "value": "49eeee34e6824ea7c46ba716ce058153588652a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009513, "uuid": "87c389bc-6906-4e31-809f-e37888ab4a58", "comment": "Malware payload (RedLineStealer)", "value": "204320774a34dd4715673b8fa897ec187057944597a089e29e62aeb93433c2977bb87436725010633546850df39f91f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009513, "uuid": "c09c6fa3-ef94-44e2-b8c2-69c3f3dcb6c9", "value": "T104F4124376E80126ECB92BB018FB03832B367CE59D7482673A465C5F5A737C9A53137A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009513, "uuid": "ee0bb486-1293-4b72-8de9-30f683103569", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009513, "uuid": "6ce49e1b-aff4-466d-95c1-6101088ce087", "value": "12288:AMrpy90q802eCTGyG6XR1IuML3U7Meb2XD2b3Qpib73RX60qrAyDjN9ffHo94u9N:ZyZb2Q0XZ973b2XD2bApg73RX+MWZhoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687009513, "uuid": "a26845d8-f3d6-4301-98bc-bc005b7b1cbf", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687009513, "uuid": "74db71b8-0032-4229-956a-5912def22d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009513, "uuid": "1cb93908-0f4b-41d6-9bed-65ffe4b0a854", "value": "b9d55297a7aba54b133fecc4a0925042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fd45a7-0cf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686995940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995940, "uuid": "04599fed-92ef-48fc-8bf0-eb0e1272c674", "comment": "Malware payload (AgentTesla)", "value": "28cef7a30348b7605c3e20208c2f79ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995940, "uuid": "bc18fd13-e7c5-482e-bb40-dd4a68f0a7ad", "comment": "Malware payload (AgentTesla)", "value": "667657cd3f5cde93cfedd17ce283ce3bec2c6f296c9350de87e8e57eadf71831", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995940, "uuid": "cfe02149-4c6a-4cdb-88ac-f5b64b9d42ef", "comment": "Malware payload (AgentTesla)", "value": "0eed34050f0e04757b46660365316d1ed1676fa4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995940, "uuid": "413379c7-7fb9-481f-879e-483c737bf7d6", "comment": "Malware payload (AgentTesla)", "value": "999853db5f6d598f76ef565a81fe104e2b95d7b06b5ff0b06ed01d0c3484ea9a4a5d15884de5e851146cc011caeb29e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995940, "uuid": "c8cf80c2-ec8c-42da-8b1b-b516b9e6fb96", "value": "T1DD34AF993251B7CFC82BC839C9EA0C64A6A176AB1327D247644712DD8E0D6CBCF157F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995940, "uuid": "62a55704-cae0-49fe-a46b-3e17d3874b66", "value": "6144:j03mjlC3YAM2xfSu0Wz66L7D9gL1tBBcQdH69nhaOq:A3Z3YT2FSuPz66LW1BcQdaDab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686995940, "uuid": "e6841bae-9d2d-4c63-bd20-1e0a4ae9a14c", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686995940, "uuid": "fd9d79d4-699e-4881-b99f-6fb37f8185a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995940, "uuid": "ba6a65cb-3290-4f0b-a0d1-9a2dbbfe84f4", "value": "Yeni sipari\u015f _WJO-001,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abd01ed-0d3d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687026631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026631, "uuid": "ff6327ee-4121-4781-a04b-3ebaf5495d1d", "comment": "Malware payload (Amadey)", "value": "d2d02f238629d9c739737a64c35ae18d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026631, "uuid": "8ccf838f-d31d-4797-bdc3-124d94353f62", "comment": "Malware payload (Amadey)", "value": "66902f8d4ca94f8efe3322ccd8ff36cce820cef45151ea394c17424aafee37cf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026631, "uuid": "1db35740-c911-416c-ade1-e29a1ec30374", "comment": "Malware payload (Amadey)", "value": "def4ae333529e8c74b7bb7f071308c09fb97caba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026631, "uuid": "1567bd21-5e36-49be-8b0c-d550c26039f4", "comment": "Malware payload (Amadey)", "value": "df89fbda586888f0f189aaa03450a8b96e6bce45cf055496231f8dc136202dfdf979acb47189aae9a10415f978495a5f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026631, "uuid": "3857342b-16d6-48c2-a388-02e1327b55c9", "value": "T119F41213EBE84172D8B51BB004F70A930E397CA22D75463F3B90995B4CB3A85B5B537A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026631, "uuid": "1b2933b8-396e-4d58-becf-cdaa75356811", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026631, "uuid": "d212d3d9-92b8-44cc-a4ec-b5f82a0aafe6", "value": "12288:AMrXy9095ADC4Q4rJDWr6wYPPetD3Sa1j5JX1kshnZKQot7tA:nyhDPQYWrFimtDCa1j5d1zh0r0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687026631, "uuid": "facdb528-d40c-4135-af8b-d3509e87921c", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687026631, "uuid": "708aa6b0-f06e-42fe-8a10-c0a1fede28cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026631, "uuid": "8e548d29-8728-49c2-9434-1cdc268baf1f", "value": "d2d02f238629d9c739737a64c35ae18d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e901b5e-0d0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1687006639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687006639, "uuid": "1d85802f-7c07-4ae6-ab1f-db366996b601", "comment": "Malware payload (ModiLoader)", "value": "484d0d1f70bc74d0fcfc6857cce0089c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687006639, "uuid": "a3422d14-f57d-4600-9c28-ee2cae7e52e1", "comment": "Malware payload (ModiLoader)", "value": "66fe2f93be23c53935820ebf3aa6f9cfa5b570d8ff530181021b12b613250ade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687006639, "uuid": "c5360b7c-a6ab-4a44-a5d3-90f00e5ea136", "comment": "Malware payload (ModiLoader)", "value": "4d5179cdf9638e5919e1c6e4df47d9b06710d7a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687006639, "uuid": "fd06fa58-fb19-44ce-b218-d5782419cbb8", "comment": "Malware payload (ModiLoader)", "value": "b374888a8c485fbf19afcbb17da9849531f59c347683704c91ddd4ed0180dd82e7eb6a0c78a54b2eb0c4e0b94e785716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687006639, "uuid": "bba156e6-9227-4a9a-90dc-0f9584030b00", "value": "T125258EA2B6874837C27317789DEB5F986815BF113D286C457BE87C885B3938678343A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687006639, "uuid": "60d7c119-ce98-4a54-b2bb-7bdef9bf18b6", "value": "2ebaf47190fd1bbd26fec0b446b1ee09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687006639, "uuid": "4f521bd0-d7d4-4bb8-8090-94fab92a005b", "value": "24576:Zs/dShaR6+yPvvIYHGrw8R+d7BOQ6nAz0:Zs/uC4JHGU0gBOQ6Az0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687006639, "uuid": "c82598ad-ea41-47da-815d-fb9948e83ece", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687006639, "uuid": "8ee3eb76-5196-421d-a860-dfca401483a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687006639, "uuid": "20aca323-e6d4-4140-a6d6-42231b1893da", "value": "ProformaInvoice_HABIDIEXPORTSLIMITED0010383002937829.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0cfa84e-0d4d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687033836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687033836, "uuid": "d2d8f4ac-430e-4873-a5e2-02fc355bf1cd", "comment": "Malware payload (Amadey)", "value": "6cb4b35dbbeb7d95b32d9ef204858b22", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687033836, "uuid": "1637b751-0805-4fc6-ad9c-6a7e6609d482", "comment": "Malware payload (Amadey)", "value": "67ed5eecffd87eb5c74c987d44a7ba4f66deb18aa899a5b3bfa42837eab7e13d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687033836, "uuid": "7c238434-8f96-4690-b261-c5eafc0f679a", "comment": "Malware payload (Amadey)", "value": "46b51c244caa857681a752774cc070f1050fcfd7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687033836, "uuid": "8e298baf-2865-41a7-bde0-07a71eed7b13", "comment": "Malware payload (Amadey)", "value": "2a0e8dd97346b0900526045a526b46d8e182734b8d0f1b1dd582f01d932c6a4430dfd117215c95c6a5bd0b3a6db03e4d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687033836, "uuid": "d7730f35-5c12-4bc4-aada-c12d6893a29c", "value": "T1CFF42243AAC91073CDB6373058FB57D70739BDA19DBAE36E2644BA0E0C72680613576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687033836, "uuid": "1ebe9682-cf00-45f5-a8e5-187477ac2ea2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687033836, "uuid": "bb12dbde-9061-4e74-9a99-e734c3ebb2bf", "value": "12288:KMrTy90QNOQpcx6BjE7s5eFjEo2t/UrORdhdKv9IWG6ZJCWtvRG1K:5ydWxejEPFjEo2QOznkGaJPvRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687033836, "uuid": "1d1219f2-25cb-485e-b45c-f7a64c29a973", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687033836, "uuid": "91b5a95a-fed2-4bd1-9b28-2efcc7b9372c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687033836, "uuid": "219dd03b-8fea-40ef-9b6c-d78b6c1527c7", "value": "6cb4b35dbbeb7d95b32d9ef204858b22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f7f074-0d40-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687028132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028132, "uuid": "bd730626-2388-4ae7-8640-b6d9b77573b6", "comment": "Malware payload (RedLineStealer)", "value": "f3e683f16621a9be3eb9d886fb8e96ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028132, "uuid": "dba8ed5c-cac4-4f32-9a4d-66d704fd9e8b", "comment": "Malware payload (RedLineStealer)", "value": "68a95ec42a5c30c3a792d344bb54a3ca7e0c628234d5d9cd21ffe7237dc772aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028132, "uuid": "b98726b7-7f2d-4716-afc9-7ae41ea123d4", "comment": "Malware payload (RedLineStealer)", "value": "035c8885c2b4549fc2a4d19d62cd15552d2bd7e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028132, "uuid": "4046607a-2ac1-491d-97f5-811307e53ff9", "comment": "Malware payload (RedLineStealer)", "value": "504f810617029640db18883c25a672115bae56f20cb9f70a7fb0bb91ee077c10df85cdfe0c96466cfa7d3a5a752d8d38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028132, "uuid": "f466709d-1e93-48af-a64a-fb7528fe3923", "value": "T135052347BADC4536CEB2137094FB5B971736BCA04DB0D26A2B898C0F0D72691663277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028132, "uuid": "583bb255-0df6-4572-9926-dd5d19c06bb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028132, "uuid": "f5c1b0fe-11ad-4eee-b474-0e1c2825b401", "value": "12288:oMrTy90o8rO785S34BFOpai3ZfYtYpZX2xVA0bsFraIvvmIrVcxvoaPs5MPBG/Zv:ryD8y7s7F3i3ZmYpZeIbZQwEP0tTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687028132, "uuid": "927bfa15-1975-4424-8fb4-62f435001f27", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687028132, "uuid": "aa9460eb-fa77-4682-bcee-f45fa647803a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028132, "uuid": "ff5c2247-572d-40c2-ab5e-310421de01ef", "value": "f3e683f16621a9be3eb9d886fb8e96ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8423e2bb-0d4e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687034137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687034137, "uuid": "066b6408-afea-49b6-846c-ecb9e8336b8d", "comment": "Malware payload (RedLineStealer)", "value": "6a4b8d88ffefb78d3d54f5ce9bbbf4ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687034137, "uuid": "0a1e4ff7-e9a2-44c7-9cf7-0a42da13ac8f", "comment": "Malware payload (RedLineStealer)", "value": "6981e520a13ee383cdef06c7863b0b11068705b0541c6d3fe0d5a68829af85b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687034137, "uuid": "1f1e9ba6-5842-491d-8ca0-12fede650a01", "comment": "Malware payload (RedLineStealer)", "value": "744a64db4676784c6cb5b2b798aff0092c972cce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687034137, "uuid": "eaa411ac-4607-4441-af84-9076f9b7bdd6", "comment": "Malware payload (RedLineStealer)", "value": "20baf9afee2249df275ff0998567e77e902babb237cebdd8451283c7f433ebe6be0461056fce67b50f74af77a8ba360a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687034137, "uuid": "4171014c-a30c-47f7-823b-02bc418c2a10", "value": "T1BAF4121B97DC9472D8B523B01CF713870B36BD628924836B6392A96F1C739D49036B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687034137, "uuid": "cb572ec5-0afb-4ecb-a1c8-fdb36f7ce8b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687034137, "uuid": "22e8d717-5b90-47ff-9e0d-cd7e3b4c97a8", "value": "12288:mMrTy90FFCUz4Hcw92glslPbMlWO79J07CaQQZHW5Kkk3A+rye14p6xQb:FyZcw92gmI9J07EQZHW5p6NWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687034137, "uuid": "265b8b7e-5e6f-4705-ae89-54097b97682b", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687034137, "uuid": "e6136644-77b2-4ea3-82fe-2edef1854eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687034137, "uuid": "86c4cc1a-5b71-4690-9016-8ed59ec63379", "value": "6a4b8d88ffefb78d3d54f5ce9bbbf4ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6ff028-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045430, "uuid": "eef87e97-f6a9-409d-b952-0229b0fab0fa", "comment": "Malware payload", "value": "84c28f54274c66c05516fd54f11d262c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045430, "uuid": "e7155171-732d-40d9-a015-1d4250a488c2", "comment": "Malware payload", "value": "6af1bb713178c03c4b79c9bc7f9f21dd17b53bc445a3d1077844a65e47ef6bb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045430, "uuid": "dfc1c758-3a6a-488f-a3e2-a7fa0f2929d8", "comment": "Malware payload", "value": "0da83448da45ac8a282f1dd6749bf7efd7fd33da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045430, "uuid": "0146387c-4064-4a6a-ab4b-9f3f68172ae6", "comment": "Malware payload", "value": "680c4822bec0815dedef973ffc6475a062fade07dd8c9962ff3142e2e42852aaa005c09897f96b1c3581a3507aa56e3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045430, "uuid": "9a0f5dab-621f-4ed2-9225-cb92816448b9", "value": "T1D4E32A02B30C0A47D2672DF43A3F2BE193EFAA8121E4F645255FAB8A9171D325546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045430, "uuid": "fdd26ded-fc97-4c9d-a5ab-ba6dc442d33d", "value": "1536:m5nSLtC/s3qkrkm0xpuvE01dVwwUqJ696zkpScUywgqvAIY/G09DqQVP1hgdEjP:3Am0xccslG6USzeIogdEjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045430, "uuid": "4b05680a-c2af-4652-854e-6dd0bf772d8b", "value": 150392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045430, "uuid": "2b2c83eb-097b-4c56-a947-589c7113d4d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045430, "uuid": "7790433e-3b36-4958-b564-a3db7008b349", "value": "84c28f54274c66c05516fd54f11d262c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2b7da6-0cf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686996143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996143, "uuid": "5ff01b23-32d2-4660-9f5e-7f446dce087c", "comment": "Malware payload (GCleaner)", "value": "5e119eecd77365699f0179d988263261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996143, "uuid": "3e70dd68-083a-4c9b-9bb1-7bb0f011edfa", "comment": "Malware payload (GCleaner)", "value": "6b4e2acea2705d1155e3663c38991580485397f0353ce2a8d662bc821140dd7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996143, "uuid": "ceab8bd4-eeeb-4a90-87c5-938f9ecf3f97", "comment": "Malware payload (GCleaner)", "value": "6ab0b18c17f126dd66b7fa77c0d51c8dd651f657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996143, "uuid": "b5c9ff93-6915-4ee9-b8a9-b3d37ff4d18b", "comment": "Malware payload (GCleaner)", "value": "2c6296064d42f704a9cdaa20428671f84d0a10697d3e95c1ddb292de48128127ae126aeade4064563ac0b252bdc709ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996143, "uuid": "13f56235-691b-4295-aec8-47cb85b363ce", "value": "T110943A4362E17D50EA656B329F2FD6EC771EF250CE493B68221A9F1B05B12B2C173702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996143, "uuid": "63bb202d-9edf-4b98-8403-f3f6f0c36413", "value": "ff663290422cfc5dabe317e4ebb150ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996143, "uuid": "f850447a-0379-43aa-8ede-5175950ab8e0", "value": "3072:vEVb9SBrbII3PJktFF+uAgNF7cjT1v3iyrbxymwBILpEXRtxFl4ncjLRq26jgr4n:+SpbROFnr7A1fjVyT8GFl4EsltsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996143, "uuid": "df05635e-241a-433b-af8d-d274ab1572f1", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996143, "uuid": "0d51454f-6411-47aa-a112-57ae47138ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996143, "uuid": "86f4821e-4849-4373-9d2c-c0ad04421567", "value": "5e119eecd77365699f0179d988263261.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e42f46-0cf1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686994007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994007, "uuid": "7c0bb4dd-b42b-432d-9848-10cefdc7c3e0", "comment": "Malware payload (Mirai)", "value": "66b172104f418393ed6ef40498a43b87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994007, "uuid": "059f5bc2-bb06-4a48-ae44-965eee0956d5", "comment": "Malware payload (Mirai)", "value": "6b81c12ea3260f7d519b74513bc89d933ef2832cac6e5fbe5849606676ea523f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994007, "uuid": "0c33135b-3bc0-452a-8bba-ce72c6bd19c0", "comment": "Malware payload (Mirai)", "value": "6e96ea120b1e895917e9c7d5a405108ead88f59f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994007, "uuid": "6eacd00a-12f4-4141-9810-f108d4abfbd0", "comment": "Malware payload (Mirai)", "value": "d73df13fee4a6ec740af319d98896c1c553b9e1b0b31570dbbbdc71358cb35b6d668100b30d43a41170f415e423f2397", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994007, "uuid": "fddc27c0-ce22-4562-b5c6-6c17c2ffea46", "value": "T1A8F2E1FD454929D2CC5954B334788FD23F598FA5A31F3A871631EC80E82A1BDA8F6B44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994007, "uuid": "bd19441f-c53d-442e-a906-e9364aaee6c7", "value": "768:LDjam9OP/dOFFnT4lRtrHzRCfbR8jEHROgIFJgGlzDpUYs+:Lf98/gFpKtrHdjSu/VqYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686994007, "uuid": "1c437f99-2567-4d6d-86b0-02c31c340c43", "value": 34952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686994007, "uuid": "63b11a79-afdc-4b0b-ac07-d0e30d57012a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994007, "uuid": "c02c6b8a-7246-46ad-aecf-3f84b741ebe8", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.WPT.6801.2799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9a8d81-0ca2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686960249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960249, "uuid": "39ac3717-f52b-48ec-b93a-6568f8f2b69f", "comment": "Malware payload (RedLineStealer)", "value": "eb33a69eb74b70dd48cae20c6ca89e9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960249, "uuid": "d2397a1d-b501-46c0-b35b-c2d966bc691f", "comment": "Malware payload (RedLineStealer)", "value": "6c73a82f77237b6fe7b2bd7d71cfc78cf7daa49202184e0cfb2cda1816922188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960249, "uuid": "ed25c236-fed3-435e-b8af-07225cf41232", "comment": "Malware payload (RedLineStealer)", "value": "6bb737b358fe01d4e42a7092f2ae7729d2971c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960249, "uuid": "32b580a7-b6b2-446f-9b9f-ad8c013d7507", "comment": "Malware payload (RedLineStealer)", "value": "069cbdd869feb5db396b614b701e2be951af7f9304bec2712e91704b0cac05d7ca87274c3d1aeb783195c603ab1bdc45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960249, "uuid": "39f32298-6816-4443-84b6-0c57732744b7", "value": "T186F41203ABD85067E9F567B09DF713C70B30BDA60D78962B2719AE590D326C0A43277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960249, "uuid": "208a6d0e-61f0-47c8-b6ff-ce83b20a1bb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960249, "uuid": "5680342e-33dc-4ce7-8829-298b0243d9bc", "value": "12288:gMr/y90Er6BW2/D9IE3ukefB2oMH78TyNkr5LnjZI9MKdrHk6v+FLuHx7vLHk4mz:vy7rAWrE3m0H+kIO9MKdrEY/L+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686960249, "uuid": "73c9bfa8-5c75-40e2-8241-18a7b4091aab", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686960249, "uuid": "47019f9c-2175-4d32-9457-d129c4e4f8f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960249, "uuid": "b00917b3-42b0-4fb7-b38c-2cc32253ca1c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4eb3a90-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687045466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045466, "uuid": "73be9810-e9bb-484e-b5cc-9334430c0ca2", "comment": "Malware payload (Mirai)", "value": "10f9f15014590435f6a620fa51f2418b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045466, "uuid": "065e1b60-e464-4719-b0c4-0df1a9ccf0bb", "comment": "Malware payload (Mirai)", "value": "6d2353de4174187adc079b6736c09639c5a8b364f722df12480b1ab91fef449c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045466, "uuid": "83c1c3c3-398b-4e2b-b66a-d852622a5e35", "comment": "Malware payload (Mirai)", "value": "7653bb3931231d6280986e0f5506844978c5bbdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045466, "uuid": "54df4401-d304-4c3a-ae51-e37192dc886d", "comment": "Malware payload (Mirai)", "value": "2fb093ab17dbb4aaf3844ac65aa3ef9102109712613794117046401716c29842e0204e2a19662c20ae2b8d86e59e2671", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045466, "uuid": "2778db4d-7665-4022-b41f-796a70ab2233", "value": "T1F5631956F8814B22C5C5027AF92E118E332317FCE3DEB2229D216F6077C696B0E7AD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045466, "uuid": "220c2544-a5f7-4f9d-b371-e59c6b994e8b", "value": "1536:hpnSzfzQZTJxP0CM9L8qR2C00bZMa/anAZzKIJAiWfcv+Dfvp5mYo/B:QfcZFuCoi1argfcv+Dfvp0B/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045466, "uuid": "eff5e98e-9306-4021-b0b8-197847e8bdb4", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045466, "uuid": "23dee174-72b1-4fd1-b631-aa41b002e5b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045466, "uuid": "68b9ee70-81a9-487f-b987-ef6ed6e86db8", "value": "10f9f15014590435f6a620fa51f2418b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd598e5-0cb6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686968869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968869, "uuid": "245cf439-3ba6-447b-b960-8f130721a071", "comment": "Malware payload", "value": "52bc206552b8aa93b3c425fd5a2ca240", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968869, "uuid": "55fa7c06-fa85-4017-973a-1d58317d114e", "comment": "Malware payload", "value": "6dcf0f320d08dd3840ce186a8498fa05698759d8dd3d357c501dfab0ddb532a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968869, "uuid": "ad658984-cce4-4fb2-8033-6f26d8c137c9", "comment": "Malware payload", "value": "c0c12f1ed8098c5efc2e1f409b9a22297c68e006", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968869, "uuid": "1a4550ca-2e39-4b40-9796-7bd50d2155e5", "comment": "Malware payload", "value": "a511a8853642f977207d6bdbc67d5a2ec971e8cf1fae3bd137fe15c14c7293a2bb5131d1862c38562b2c50e9db4fa5e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686968869, "uuid": "4457a962-ddb1-4f9f-9cb1-c5d3c7d47296", "value": "T10286E75774E25252D0F23BB678BD80E432271BBAA7521B696C04EF387A3B4C90E3D715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686968869, "uuid": "db529e09-407f-4767-a889-3598a5b3623a", "value": "98304:QlO1XtIqQRp3A7jxw999w0fGD4t3qoIR6jtQca:QlOSNseaca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686968869, "uuid": "0c6325be-8191-4579-a2d7-c57c4888f8e6", "value": 8192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686968869, "uuid": "9b1a703d-6bd1-4efd-898a-ca78f3001468", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686968869, "uuid": "aa6301a6-9566-4118-98aa-592604a28dd6", "value": "SecuriteInfo.com.Trojan.Linux.Generic.298074.6867.31909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fb8620-0d55-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687037260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037260, "uuid": "d9a46d06-5367-445b-bac7-ebc48c4ff8a6", "comment": "Malware payload", "value": "409c28690da128061ee113d6712761da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037260, "uuid": "e4a5a354-2719-45b9-bc4a-dd0d4c31941d", "comment": "Malware payload", "value": "6dd9741da7c768548a3b532bbd963fa806865fdd6a7907683de88ad4bd8363f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037260, "uuid": "92ed7305-8c11-4fcf-9e68-74d72baf306e", "comment": "Malware payload", "value": "ef9c5dcd8c0bf31e2ec6461f06d8951bd7646654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037260, "uuid": "cb23bfbf-4a1c-4de3-b8fc-0760d551dc79", "comment": "Malware payload", "value": "c1ec5858113c3b5a0a08532145d4345f58c408d59268cf68a7f7aed5cfbdb625a05f23c7816705e04055632d8bed96c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037260, "uuid": "5d40e593-d4f9-4aa0-b7ed-87312ad9e5dc", "value": "T10566237263815148C4E98836C523FEB176FA1E3B1A4119B435EE3FCB3F72497A613A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037260, "uuid": "4bb0a547-43d9-46f7-9c84-65b25f45920f", "value": "dcf3f1cf7cb4126097080cda88edd360", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037260, "uuid": "06437fa1-60a0-4d6e-ae94-dbba137968d2", "value": "98304:eDGnOnXzMysJLH/Q3sxN//5WQpKKeyX83CilIgpCLjF3u1bgWdyWRjVKTBQrP0Wo:1KXoLZY3yNYgKeXSC2qReOU3rBJ4+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687037260, "uuid": "d0570902-8aae-42c0-bdc4-660032c43211", "value": 6703104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687037260, "uuid": "080cc018-1cab-4691-b008-71103fb1cfc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037260, "uuid": "9e387d93-3c2b-4916-9c8f-bb66dfa6b421", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0c90d6-0d2f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687020698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687020698, "uuid": "2d0ced07-21c9-4656-bde1-44d5b073eb02", "comment": "Malware payload", "value": "18cfd6a2bce56992ab38dd211e18b497", "object_relation": "md5", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687020698, "uuid": "9c1b8618-f8c4-475b-a6aa-fc95d2ff7554", "comment": "Malware payload", "value": "6eb611fda1f2442a68b80bf0e4e2473cb41de49d1b880f2a541606d102a6c4aa", "object_relation": "sha256", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687020698, "uuid": "ee47f22c-12b0-4bb9-8ba5-02232048b8cb", "comment": "Malware payload", "value": "bf357a19cd4431857009f856371483b223046aab", "object_relation": "sha1", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687020698, "uuid": "f85dd43f-1401-4b9f-8470-1b48a980dafa", "comment": "Malware payload", "value": "892216278039f10bc7e80e744a7329ee7a553a3f7a4ec2a5bf1a0bb495c08e8b7ef07fa239e76e2b78a0c36c6c77cb58", "object_relation": "sha3-384", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687020698, "uuid": "ebd799f4-0891-46a5-b4b3-6b71435f2742", "value": "T13EA5338955C6CC66FB6F2C7E2CB2551223BAC0DB6C03E36A1ED531A16A2D9F411853FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687020698, "uuid": "e0749545-3d3e-464c-96ee-72aa192ccc9d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687020698, "uuid": "49b0a7a5-fe29-4d16-b19c-b31ccd7398e0", "value": "49152:zp0NVisTVEQLavIiyrXuT/S15HqUq+BR2W6g6CvWrrykhKj78NDr:zWyoiyaT4Sq2WOCurrjhKP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687020698, "uuid": "762b4653-b9e0-4322-bbac-0783cd8770c7", "value": 2220040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687020698, "uuid": "36754d10-6a5b-4536-8e93-a7036bc71394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687020698, "uuid": "45a65a72-ba18-4e9e-9fe6-23fdeab5c0f1", "value": "sc0pe_carved_decrypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bc84cb-0d5e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687041045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041045, "uuid": "c5fd23cd-dfe5-4bdc-a66c-f32eda41aed1", "comment": "Malware payload (RedLineStealer)", "value": "1d91484b4e5b2b23207f6ee7d375d1b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041045, "uuid": "a4f7dd9c-9838-47a2-acb6-1859a046c98c", "comment": "Malware payload (RedLineStealer)", "value": "6eff779a6cb922aedf32da7fd302ee49c9510ae16b110265f925886ef4392d50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041045, "uuid": "5d92caef-e50c-4bd0-ba81-efbe459dbf03", "comment": "Malware payload (RedLineStealer)", "value": "dc176fd8ce8f14693cb90e084f6363489828e817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041045, "uuid": "a632d929-7927-418e-ace2-79f6d28f2e12", "comment": "Malware payload (RedLineStealer)", "value": "8f945057ecb0dbf7bc0c75d83916b3120665b6429942e258a2c5baeef408a0a1b143a23fc88169c1d2eeb6128d2c8c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041045, "uuid": "c8c0a3dc-7549-45a6-afe9-8185be075e1b", "value": "T1A8C41203BBE85832E9B807B095F612830E727CA16E78C72B2745955B1C73691B578B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041045, "uuid": "f074e898-2251-4e41-81a2-66c120cd6993", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041045, "uuid": "4a64259b-c740-4173-9e27-2e50030891b5", "value": "12288:AMrWy90FlTAp4RtVIQFEv2hFRIVivAeKMtxQpcXmXt:myCFEv2hFRIV3zExQpEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687041045, "uuid": "83299e9d-7498-459b-af74-193c5c9cd620", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687041045, "uuid": "71b556b0-3942-487b-b017-92f24ee185c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041045, "uuid": "1b5908e7-78d8-44ba-be32-10994280a6be", "value": "1d91484b4e5b2b23207f6ee7d375d1b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e839a0c-0d32-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687022128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022128, "uuid": "c4886bfd-fa6b-4f01-a36d-ddb8d762c430", "comment": "Malware payload (Amadey)", "value": "981f59ec6b38380dc7dab5d7bd3c98e7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022128, "uuid": "2875fb10-f4cd-4245-961d-317b39b17922", "comment": "Malware payload (Amadey)", "value": "6ffdcba5e380bcbedef428199c1d500d23688ebb5e65940aa7d0dfbb56e35170", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022128, "uuid": "9be7cf25-c3c9-47e5-a0fb-2b991e854241", "comment": "Malware payload (Amadey)", "value": "e614ce2380006efd1d8e93da0b640822c9915fe0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022128, "uuid": "55dcaaa2-b000-4744-85b5-333aeea7ef1d", "comment": "Malware payload (Amadey)", "value": "49df73d837951d29a7c6af35c61f9b568225df263c24013c0b6f756b9dbb5382d36ab7d4efcab5231d6f05ca3d8f421d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022128, "uuid": "9d479f76-8bed-47ff-ae98-f2eb2b617adf", "value": "T1C8F41283B7E95533E5B967B00EFA12D30B3BBC72882583A73744A8551CB26C0547A77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022128, "uuid": "a67299cb-55db-482f-aea3-e53d6d4b16e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022128, "uuid": "5c72c663-8a22-491e-bc9b-8139d5f6a693", "value": "12288:EMrny90XnrIJPP5eros2MSjccQ7lWqXE72HzBFHpgvPHF/BsdvuLTJKGMRm:jy4rMIrWMSj3Elq2HxMPHFJHTJXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687022128, "uuid": "c0acb964-b535-4ce2-a6ef-273310714b90", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687022128, "uuid": "cbd30464-bb1c-4857-97f4-ead7aeeecf64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022128, "uuid": "f9bfd6f4-086b-4acb-876f-a34aa0cd3709", "value": "981f59ec6b38380dc7dab5d7bd3c98e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f7a079-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045434, "uuid": "6188a09a-9436-41fd-87f6-06f54f4d151a", "comment": "Malware payload", "value": "8a6ac58319775e85d3b4c79266cc09c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045434, "uuid": "990c58a6-84d1-4c73-8452-9357b7e8721f", "comment": "Malware payload", "value": "702a203b1f96e426fbc1fb37661508655f64fa9c41735340110bb39153b6a22f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045434, "uuid": "820d1e8b-d4ed-48e0-9a04-cd97279beaca", "comment": "Malware payload", "value": "b787dbd611186510368bdc6933da28d3127a61f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045434, "uuid": "825a460f-6190-4da5-90ba-da51fccabe89", "comment": "Malware payload", "value": "c7b86bb37522466092643831e59d9c79abd15b6b81b59c018e73c71399c7047ab6fb88d3634b5e662bbc7e515229d08f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045434, "uuid": "33ebae94-3e9b-414a-be34-18758b086964", "value": "T1C5F31A56F8819B11D5C112BAFE1E128E37131B7CE2DE72129D246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045434, "uuid": "d8232c67-5411-47d1-b55b-058efc76ee49", "value": "3072:XqdyU2XUz88CuXdUrDr/qaxRUG8ztCwCmCSLRN0G:6dm4suXyr3iasttCgLLRNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045434, "uuid": "e5f1f4ae-e9dc-4aca-8280-6b4d161ed014", "value": 160860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045434, "uuid": "56b84be9-5c2e-4f5d-bfe1-a5e08222b433", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045434, "uuid": "8b117f55-eddd-4f1d-b84d-90c451d3e944", "value": "8a6ac58319775e85d3b4c79266cc09c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5db360-0d18-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687011015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687011015, "uuid": "40a0c76c-2ab2-414a-a982-82a27121e498", "comment": "Malware payload (RedLineStealer)", "value": "e439ff7422297228ae85f1099e767880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687011015, "uuid": "0289a149-3890-4a34-b0b9-d5d1db2d9467", "comment": "Malware payload (RedLineStealer)", "value": "72025b5e5573fca60b30101c65282ab9a55b5464dbae7f1b62c7346f45977762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687011015, "uuid": "f3d07f40-d0b3-481d-a3d6-b5da146c11fc", "comment": "Malware payload (RedLineStealer)", "value": "38271e0ef13179eeb6503a50202f55680b7ac141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687011015, "uuid": "02cb8db8-3122-4199-ad24-f68d79d6c567", "comment": "Malware payload (RedLineStealer)", "value": "1315dce45623fc61fe2cd68d26dd2c0f82f6c756346fbf999a8eb45a17201f48edd46e226309d6793357a0505392e02a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687011015, "uuid": "f4a8a07e-203f-4614-a2f0-dffc131c7a75", "value": "T13CF41206EBE8853BD4F027B048F742931D39BC619D7563272B91994E1CB32D8A5363BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687011015, "uuid": "3f7e8cde-f07a-4edc-a609-91a1151200ee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687011015, "uuid": "b3ffbdd2-696b-4ecc-a8d7-19e97036da6d", "value": "12288:dMr6y90ZxsnFEoxRvQxashdntj4ov6FXk7kAnsHIU2WHy+dZEY:vyvf/shjj36FU7nWHy+MY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687011015, "uuid": "68a69eae-242e-4040-9526-916219cfaf5e", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687011015, "uuid": "f1f1f31e-7bb2-4f41-bc04-a02db836bd28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687011015, "uuid": "84d6914f-2bb0-4788-9626-724ccb2a0ae7", "value": "e439ff7422297228ae85f1099e767880.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c9a03c-0cfd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Zyklon)", "timestamp": 1686999449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999449, "uuid": "6fcd21a9-6635-44ee-b17d-a55bd0276429", "comment": "Malware payload (Zyklon)", "value": "b70acc0e339d43ad76493fb41821fc27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999449, "uuid": "8af7a28c-7c53-42da-bb1a-45b2d6462161", "comment": "Malware payload (Zyklon)", "value": "726616e89178a4015688829238955ea63693c7721bb52d9fde1b8fb9c096a8b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999449, "uuid": "503f23cb-cf66-44d0-aad2-fd3a609ac458", "comment": "Malware payload (Zyklon)", "value": "7de66888f590761cd5ae193d86f7a7de0cae51b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999449, "uuid": "25790f59-8b5f-415e-9928-00ebea5392b4", "comment": "Malware payload (Zyklon)", "value": "ed2e387bab8b22aba783f0327d53ec1744477562734ed9e1a0377ca3e5e89b38ea0853334c44698b1cfb74aa4e69b20d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999449, "uuid": "dbea0cdb-f464-461a-aeb7-64a5627d5bcc", "value": "T14AA54B25B5020CB1DD4E01F2C6ED013A5BA0FA161764E1DB27E2A7CB5BCF6C2BD5D24A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999449, "uuid": "6a074751-eb1c-4d03-9cae-43bab02a4f45", "value": "49152:DDgMXr92YrJXX3ImWCVr52/MeZOnjDmNlqKxOnjDmNlqO/UzbPZHOnjDmNlq/z9H:alMvSeYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686999449, "uuid": "2a09092d-cce3-4ca4-99eb-8f679d5fb6f3", "value": 2144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686999449, "uuid": "2da2eb30-f6ce-4502-860b-7fd9d98f0bd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999449, "uuid": "ef4639a0-571e-4de3-945d-89cb0614c2d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ef1980-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985583, "uuid": "2a0a8d3f-45d6-42cd-b21f-db1217937931", "comment": "Malware payload (Mirai)", "value": "bffc0d90cb3f4d521943b307799d9109", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985583, "uuid": "bbb783b6-8828-426e-9977-07c8c2945501", "comment": "Malware payload (Mirai)", "value": "737dd7dbfb04132e90d875ba0f9d8e633452f93b050642fad8905a6391599711", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985583, "uuid": "977dfaf4-6a4a-4507-9f61-e09ab4283678", "comment": "Malware payload (Mirai)", "value": "f9417cd6199f660a276beab8c8e0f50402edaa99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985583, "uuid": "50633557-8bc6-4ac8-9f67-cccd23a5713b", "comment": "Malware payload (Mirai)", "value": "4f9ba68bebe7a4a80bb4c54b83cf4f122f4765b99fef574b6f4f4bfde07ddc2c10042a617aa14549d863ce031f6b9b2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985583, "uuid": "322b0e8b-6c68-4660-99c2-7a146946094a", "value": "T1C7C35B77C82A6E58C668E1B4B4B08F7D5B939921814B1FBE5967C2B48043DCDF50A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985583, "uuid": "8e3ec042-ff06-4172-9f1e-91b05275254c", "value": "1536:8aPi+4A3x7rEuGSECiKQcnN7UneRGtiwGWL9dYEvUEvUp:8xGx0pSEcQKPR6rGWBdYKhUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985583, "uuid": "c7ca789e-c3f3-4efb-a655-30fb3d5b931f", "value": 129644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985583, "uuid": "59a93c84-4121-492a-a697-a247fc0e0bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985583, "uuid": "de48408e-3422-41d9-a9b2-0aaedd65f079", "value": "bffc0d90cb3f4d521943b307799d9109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc5348f-0d58-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687038344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038344, "uuid": "81f4b339-b0b2-4cd1-9209-38452afc95b7", "comment": "Malware payload (Amadey)", "value": "86d67d596f0e24582a267de1737ea803", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038344, "uuid": "760ca797-70b1-4463-92c7-ec2d3292f1a8", "comment": "Malware payload (Amadey)", "value": "73861fb9934dbb50980b122d09c40410b9d8647a41ea3e979ef2962548e443c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038344, "uuid": "4007ca55-fe3a-443a-bb19-e6a898f4a46a", "comment": "Malware payload (Amadey)", "value": "e77af04cb3c1a6a76ef724f964720ccc193656d1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038344, "uuid": "ddf61469-963e-44da-b06f-f1fc0588f039", "comment": "Malware payload (Amadey)", "value": "ddc55de7237b8e4ab85c894d9134e633b9b1bb8202bf780e4333bded1491c18448f4920ed986f585a582984f858c61e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038344, "uuid": "87c0f846-4498-418d-a8c3-3b7dd7f5f287", "value": "T187C41252ABD86133D5B5173009F612E30B357CA20E79476B27A8998F1CF37C4A93276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038344, "uuid": "b4e7415d-1e47-424b-b8e9-d04484f5686e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038344, "uuid": "2dd0407f-0cbe-47d7-8361-73e199d8853a", "value": "12288:XMr+y90mBHwbdqLfMmguy0JScSbdniKyzxPULAN9sWk:py7BIyfMmhSbdn+zx/N9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687038344, "uuid": "179dc006-713e-421b-924e-852bf05e7b96", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687038344, "uuid": "15956fdb-0f3f-4b30-b594-f0cb4fd0dd6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038344, "uuid": "11926a1a-387a-4074-ac57-f0474cbac0bd", "value": "86d67d596f0e24582a267de1737ea803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f764b76a-0d25-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687016721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016721, "uuid": "218f806c-1619-4f6e-ba40-0c8a3a2f6d66", "comment": "Malware payload (RedLineStealer)", "value": "77896b07b28192731ee67be06fd6edfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016721, "uuid": "b135c852-abc2-453d-b75b-e622de093c46", "comment": "Malware payload (RedLineStealer)", "value": "7562587ce4a4f30824c2ffd365d89b657e6674fb0eb7be99e6192acc83de0df1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016721, "uuid": "3e35fb9f-0986-4746-97dc-bb231e910e95", "comment": "Malware payload (RedLineStealer)", "value": "34810bce45c4d7b583a883c5220459820602f479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016721, "uuid": "c08d7d68-86b1-425c-aff3-6dc43c015a47", "comment": "Malware payload (RedLineStealer)", "value": "5425ae921d5af60780b125d64cf02618fea9205e037a4d0c38523664d1be3d794553ae02b19721cc3e96d95d77707a46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016721, "uuid": "1bdb646f-815c-4590-b578-96568cde0670", "value": "T11FF4124277E84077E8B8A7712CF607831633BC61497847573786AA6F0D336A1A475BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016721, "uuid": "53e6c00a-3940-42e7-a329-da2d0ad11561", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016721, "uuid": "bd12a451-9e46-428d-a2c5-d8caac02d578", "value": "12288:/MrMy90oVCfb3aShW7WgzAPWNEdMFeXCeTqQbDq1Lqbr6ZX:DyQTKSqz8gEdMFeywbcLqbr6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687016721, "uuid": "46314297-3895-4a11-b962-07a5f2f2ea99", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687016721, "uuid": "eb96db05-d22c-47cf-a25e-6837eaa90dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016721, "uuid": "ad2d85ea-d0dc-4dbe-90dd-6b8cfef6dd6d", "value": "77896b07b28192731ee67be06fd6edfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8406715f-0d16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687010085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010085, "uuid": "e5a4f244-a1a4-4d6f-ad86-b74abf4612c5", "comment": "Malware payload (AveMariaRAT)", "value": "48690e7b35349095f56c813b3a2e297e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010085, "uuid": "075d3638-82b7-409d-bbac-aff1bb8b5526", "comment": "Malware payload (AveMariaRAT)", "value": "76896ea5f7fac128470c01ad27b9a2fa60c8af3f69e890d98ed73d4e5d838dcb", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010085, "uuid": "6f3b4003-fc84-40f8-a5aa-610507fda7bb", "comment": "Malware payload (AveMariaRAT)", "value": "1779b6bb4570555ef65e12cd89b698b2b6421013", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010085, "uuid": "31bc48b7-99c2-4500-8138-d46578430f59", "comment": "Malware payload (AveMariaRAT)", "value": "c4a95b8a51eb42dee1db0736f3dadacaa40c0d5f932daf32b92fee0ea7a7759f957eb7cea65c60c0913837b3fd9c29b3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010085, "uuid": "eef44a38-9bf6-43ae-a60b-ff9412fa34bb", "value": "T1AD35B23E9CBD52376670C6A6CF94B866F094D3B731121C39A4D36289861BD4B3AC713E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010085, "uuid": "e4d04390-d154-4ca1-a98e-1520fea53003", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010085, "uuid": "735ee2ed-d304-4824-a997-f2ab1f3de849", "value": "12288:sKII+PeqNpt3l2vgPdL5TkHByL7If2PYykE4nS:fIIBjvQL54HByL7If2PYykE4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687010085, "uuid": "99d87c46-5011-4d99-b871-e67f540c8c75", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687010085, "uuid": "23963da9-2e19-4d4b-aa25-5dd9fb13ea8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010085, "uuid": "a877cebc-c95d-4e65-bc55-122b32419277", "value": "ORDERNO2579800001110011010.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8621e805-0d53-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687036287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687036287, "uuid": "caa4971a-165c-45ff-b4d0-e5b31de9e26b", "comment": "Malware payload (RedLineStealer)", "value": "3ec62536112a84d85aa7ff6b80c63897", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687036287, "uuid": "9173c510-2ae4-41d4-8fec-adf4746d5c8e", "comment": "Malware payload (RedLineStealer)", "value": "77ed247a8a0ffdbb8d70105951d3fd48a1a51a2b26da85fd06d9b96c253e93a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687036287, "uuid": "04c1d589-48d0-4343-a1cb-8ba18ae01d30", "comment": "Malware payload (RedLineStealer)", "value": "459b7b55897aed1526ac1d9a45720f69d23e25ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687036287, "uuid": "f6f0bafb-7da9-4cac-ac21-15db5b1e8a4e", "comment": "Malware payload (RedLineStealer)", "value": "ab6c3697ca739e2a4b95d314afae70af314ad977ebe28a59212880a88be7276cd79cdbcbc56943faae674103e25b6201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687036287, "uuid": "e544a797-242a-4b2f-bb52-635cf43dd036", "value": "T12F44381235E0BD24D841087F7479429BA6BEA9DFF7D8C4FA112420D72A172992F7D33A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687036287, "uuid": "b366bd48-b69a-433f-902d-bc05a6b3e76f", "value": "25880ccf8fbadb8c8d443e4dd707baf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687036287, "uuid": "68f3aed6-cfa7-469b-a373-e9974f4a05fc", "value": "3072:l7rXdCDiIwxPYkyxCb7QvcahFqpxmt8xk1bHDgrdh6Cmlz15lKdAxe:pEDSxyCbqcahIPmtSub0riCmlzLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687036287, "uuid": "34987364-b3f6-4386-b946-a8af3e162029", "value": 273528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687036287, "uuid": "c4da32db-963a-4844-bd00-f6dace444511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687036287, "uuid": "5c1aff01-0e59-4617-a258-bbf2b4c6b73b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd808e47-0d2c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687019737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687019737, "uuid": "22d057b4-a406-4e1b-8da2-187459a9d780", "comment": "Malware payload", "value": "ffc35c8c15ed7443f72d142b92f01479", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687019737, "uuid": "125f8665-d137-4465-9c94-366bb80c6352", "comment": "Malware payload", "value": "78c584f39aec8a1210d836d85873b1954dfc06ae31d1197ad9f487e764513467", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687019737, "uuid": "b344030b-b7b5-437f-8db9-7ee4fd2441cb", "comment": "Malware payload", "value": "5e05b822ad644b4a649b9ac39142a17b28451207", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687019737, "uuid": "73471547-9cff-41ba-9a03-939ade397a97", "comment": "Malware payload", "value": "1a5b806a3ead65794f8bd98aaa1a795c96fb543d4b6429ed6a9f381ab644c746cf1fed9807397bdbd2dff92306b36bc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687019737, "uuid": "56eef347-2d1c-4f40-b039-b8085a3b68df", "value": "T17463029CD9A9402DF71C1A380B0B90548589D74F52D3CABA09DC1DB62D79F398B8F39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687019737, "uuid": "008328f7-bc78-4f14-b0ed-4b21e5219237", "value": "1536:YUcPb806aDjTR3vHUKKxQZHYwjW0kEIf5rixI9gxUmM+:YpPb16aDVPfKxQZHYz02ROYgyml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687019737, "uuid": "efe109ac-9add-4bd6-beff-6f13b099d658", "value": 73152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687019737, "uuid": "7eb003bc-ecf3-49db-a595-138d23e8f793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687019737, "uuid": "8b2ae030-ef04-4e30-8534-67bb30f0cc00", "value": "ffc35c8c15ed7443f72d142b92f01479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b80fb48-0d62-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687042631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687042631, "uuid": "d75f3769-0836-4884-affb-9acd7a5ddbc0", "comment": "Malware payload", "value": "af0d0d05f6551917df7f616622bb0c5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687042631, "uuid": "15189f69-8ddc-42b0-94b7-374f0405c617", "comment": "Malware payload", "value": "7c9303c2eb34e7b129484552c7d84e095cb99236da8259cb38e98e9564a92ad5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687042631, "uuid": "cbdaa638-eb72-4091-bf19-e7e121f89c22", "comment": "Malware payload", "value": "87ee921522784cd9a743bc9f0b82d14f3063ae8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687042631, "uuid": "a4a9f5e4-fc9a-4596-bc73-46780e66c3c5", "comment": "Malware payload", "value": "ab6ae0b033006ce0faf4a48f346d5e72e86c6f614ab28d34f2b0c9b24a32fc23fa2b3dd52e00d0449989a5ff625bc9dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687042631, "uuid": "f948faba-1641-41dc-af4a-40173f7d7260", "value": "T10CE34A07B5C184FDC8DAC1B44B9FA53BDD71F5981238B16B2BD4AE222E5DE205F1DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687042631, "uuid": "2814e2b7-0a3c-410e-88fa-ce88c5682036", "value": "3072:6VXSryDehN790i7D6wYNhva14/U/S9PkMh5ARHD+ldsuAqln4:6VXSryq/9mY4zPTNd2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687042631, "uuid": "9f6aead2-a678-4fc0-a163-06c5371c77a6", "value": 155944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687042631, "uuid": "c90b48d9-f78d-4d93-909d-5c889e63e644", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687042631, "uuid": "9e1382d7-ba75-43fe-84c6-31172eaddc8a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ee1536-0d13-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687008913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008913, "uuid": "a01e4fdb-bf9a-4d88-b1c5-c21fea4fa51e", "comment": "Malware payload (Amadey)", "value": "7acde40897d2bb9e537e85c391c03368", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008913, "uuid": "2526d901-7f97-4462-b8e1-6745dbcf7604", "comment": "Malware payload (Amadey)", "value": "7cbb423d947fc3a76d885d062240c5b5acd53d6828f0e10ea6cefee8c7eea431", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008913, "uuid": "156cffe3-e0b3-4a1f-8c30-68b340a4ebc2", "comment": "Malware payload (Amadey)", "value": "23f85e8a7c62eedb52913285634e85a05dea1815", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008913, "uuid": "d4b6d80c-ae93-44a7-869e-4672d1fdbe23", "comment": "Malware payload (Amadey)", "value": "433e003526524ae15e569e3bc4872231de8042f3d5cb6da18cf10bc35d38c07bc15b69b84621ae553e3ce42046d1177a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008913, "uuid": "d11cd05e-5c0e-4cef-8ff6-6764fc0cd2b0", "value": "T104C41252E3E85173C4E51BB154FB07C30A367EA18D74835B2386AD1E4CB29A4A97237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008913, "uuid": "937ba8a1-a83d-49c9-a7f6-f7c49d436c9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008913, "uuid": "607e31c6-1f47-49e4-a7c8-48650f70a8bf", "value": "12288:YMrGy90N3FlfcVRDe65yYiL6xReGOJuXW4VNS39vcG8OYnYxFNcfgF:uyQ3FBmMYiL1GOuXW4VNS39EGlXCfgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687008913, "uuid": "e99c2df6-1dc5-4915-ac0d-bf4a006b4803", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687008913, "uuid": "2bd28946-156d-41bd-a9fe-c73cafaae776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008913, "uuid": "6b24d4b6-b2ab-46a1-a2f1-ad9ed388467e", "value": "7acde40897d2bb9e537e85c391c03368.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326d2907-0d15-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687009518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009518, "uuid": "6d7c97a3-ca62-4d9a-8d36-d6ed44e23f27", "comment": "Malware payload (Amadey)", "value": "ac74ea13d34afa3bf6d7bed8c3362a33", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009518, "uuid": "23963830-0dd4-4c32-9a5e-57dff47c3175", "comment": "Malware payload (Amadey)", "value": "7f1938beed0d0e4058ece6afdb6203be598a1929cc154be0b11c51fb24c41536", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009518, "uuid": "0fa2acf3-cb4e-4392-b6f3-bf19aa836c32", "comment": "Malware payload (Amadey)", "value": "05bc06fd7696c798cf05852513e39a5ff63cb9b3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009518, "uuid": "efbcefde-585d-40d2-8f6c-6b1549a57e6e", "comment": "Malware payload (Amadey)", "value": "564ab262cb0e6d9a9350edef54a9eb605f267d6bb0dabf00d37b1e92e33c155b8e19c1c134caa9fadfc6be2abac51d18", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009518, "uuid": "7257d7fc-dadd-4263-ac14-884b4c6780a9", "value": "T158052342B7E841B3FAB4273028F903831B39BC719A7497A71685DCAE58736805A3577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009518, "uuid": "8441d410-092e-4bf1-8f29-5b2d399e457b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009518, "uuid": "49c5b903-7a28-416a-8332-b9b30ab613e1", "value": "12288:gMrsy90E5I+vSvgwyudsBdReW+pQVn0bNBo3yaXX1RQNPwEBA4TriGcUkDJKVRvw:8yLJavPyFBdReZNzaXUriGcN0jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687009518, "uuid": "4305ba3c-40f8-48cc-a64d-72dfa9a8e8fb", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687009518, "uuid": "e0604cfb-0a21-4704-8111-c13100343016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009518, "uuid": "59fd8335-56a0-485d-af3b-6efb1654d736", "value": "ac74ea13d34afa3bf6d7bed8c3362a33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abf2dd4-0ca6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686961912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686961912, "uuid": "215fe415-b031-49dc-a99f-e8232972a47b", "comment": "Malware payload", "value": "31f56ca35afe42c72a7a128a155840e9", "object_relation": "md5", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686961912, "uuid": "1547b778-42cf-4edd-b83a-4198295d1932", "comment": "Malware payload", "value": "7fe8d63c68dcd691c2076ca94d8e0faaf95226675e89c31393d6bf7deabcf2c5", "object_relation": "sha256", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686961912, "uuid": "71e24ab4-b3f4-4faf-ad34-00325d7e75f5", "comment": "Malware payload", "value": "abdd8ffe6090e3939e575cccc07dd40fce77ef22", "object_relation": "sha1", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686961912, "uuid": "01309200-a792-4c47-b29f-cbdea5d80a1e", "comment": "Malware payload", "value": "913b48a8d276f0381f94894d66dadc5c1854341c51948950d5a2092792dcd67c3d8d003620b291c98a433504e18958fb", "object_relation": "sha3-384", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686961912, "uuid": "fd7b3b01-59b7-4672-9d24-4fc98525c9c7", "value": "T13B33AF146F87E976C92C1F3E84D6190613B5F388A113E65F345E298C8B267EB0B52B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686961912, "uuid": "7e341cc7-d2fa-4093-9b8b-2b6e0417f40c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686961912, "uuid": "86c0e7d1-143e-4947-9832-b21bbb8bb902", "value": "1536:ua3E4nFJPugMS+6qCzxZkg1+99y3ow3n:v0+FJPugMS8CzxigI999wX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686961912, "uuid": "85648aaf-d106-4f6f-9d14-231f01af10aa", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686961912, "uuid": "f2c5ed8d-0775-4d34-8039-5cca223b6c79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686961912, "uuid": "eb3dc688-6fb4-409e-bdb5-6870f82f165c", "value": "sc0pe_hidden_pe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7983cf4-0d2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687018761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018761, "uuid": "bfed038a-e0b8-4333-8a0f-9e432e84ea03", "comment": "Malware payload", "value": "e065273795d65a53b1201ecb09cc543c", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "pass:2023", "colour": "#68473F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018761, "uuid": "06c92eb5-fce7-44cd-b805-342d0fffecfb", "comment": "Malware payload", "value": "805f3adb9dcc3e10a2590153fcb89bbc59583abc195970a625393e2746d572d8", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "pass:2023", "colour": "#68473F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018761, "uuid": "9952acdc-c494-499e-9717-0434d13e5726", "comment": "Malware payload", "value": "6525359828280e5d8750519628b2cf8ff817dbd3", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "pass:2023", "colour": "#68473F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018761, "uuid": "dca442de-916e-47ee-ad96-418737f9137e", "comment": "Malware payload", "value": "2c7911993b6f3ccd0e67e00e5fefcaa6893e7f993f2d3709585ee909575dc168da962b6d0032ced75f1c68b78090d628", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "pass:2023", "colour": "#68473F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018761, "uuid": "bb99d014-a077-46bc-a622-4bf5d8514b97", "value": "T16947337B9A43EFA9CB29651DD12D24FC8968C05D08F28311BC19056CAEDBDF7B4147B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018761, "uuid": "a50661d3-6da7-466a-ad9b-93fee6a31bfa", "value": "393216:c8nW+qnKMmJvJC2Pa5iUPgTKMuNofZypQhqxE1OPjOjjBn4XUtWl9RW5pmCBdGNC:VNQaJCya5iUDyJqxYuMd4XACD2pmM0NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687018761, "uuid": "4acda621-db74-4eeb-9796-fb56feea4e77", "value": 26438894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687018761, "uuid": "da80f1eb-7659-42e4-93a3-3d76bb80b641", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018761, "uuid": "bc53afec-bcab-4bfb-ae06-cf29a7f21b2b", "value": "Password_2023_Setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85261287-0d4e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687034138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687034138, "uuid": "40bc9c01-805b-433d-a012-7391b9873b63", "comment": "Malware payload (RedLineStealer)", "value": "92844037238adadbc1e9c9605413bfd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687034138, "uuid": "b48876a9-d152-4417-bbbe-ab82547f4fbf", "comment": "Malware payload (RedLineStealer)", "value": "813f3255652fc8ac950a4611d9497badc1c1a621e4f271d5dcee883fa162f1f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687034138, "uuid": "87d10b64-3188-4c3b-b055-188a6613c850", "comment": "Malware payload (RedLineStealer)", "value": "a8c3ac2da434291b71c35bceadaeaaa570cec0ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687034138, "uuid": "ca28a748-3e50-4a1a-901f-5e36c1bc1320", "comment": "Malware payload (RedLineStealer)", "value": "3b42c0e5a2eb12f4614a500855bd31f4ee705dcccc38ab5f9621d8968f6e60282d301780d55cd09981b3ecb2e5d06dd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687034138, "uuid": "a5b915fc-48b1-4ae1-8f54-e149d1f3e2e3", "value": "T144C41212F6E44076E9B60B7458F602C70B3B7DB29E3892932386D49E0DB399479B1737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687034138, "uuid": "415aa55a-574e-498c-a5f3-e551478bbe00", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687034138, "uuid": "deae6539-628f-43ef-b3bc-f3480302f51c", "value": "12288:tMryy909fIKxvnje245dZxy/RJG7sjzKcSpaEYpjhsrhMk5:LyQfl0WRA7sXhfEYQKk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687034138, "uuid": "b01aa57f-7bca-4168-a8f2-b6b1e646b23d", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687034138, "uuid": "20ae4aa4-d550-4d16-9448-69b236abe2f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687034138, "uuid": "5eb419c2-62a2-4a33-8b04-aa666fbb9ee5", "value": "92844037238adadbc1e9c9605413bfd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17b4bd6-0d67-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687044950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687044950, "uuid": "f95ddb0b-e68e-4fb0-ab84-1ae0f7e895c0", "comment": "Malware payload (Amadey)", "value": "ee4a5ee308b60b42450aa3f39bcf0e61", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687044950, "uuid": "c338ce8b-6e7c-4ca2-a1dc-d5bc646755c2", "comment": "Malware payload (Amadey)", "value": "84250afc3aceb11c177e01b8683fa4e4d9d3b2674fb4df84b2053bc7de8116f9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687044950, "uuid": "3c0f52a3-59ef-413f-ba3d-f451f299ff1f", "comment": "Malware payload (Amadey)", "value": "a0a4560e7bc95d2d6a33394e0571944477d9545d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687044950, "uuid": "b8a94a67-74ab-4cfa-aadf-ca7cd1c52160", "comment": "Malware payload (Amadey)", "value": "4ca6eb22d0f38101e881aa117146545625e79d9cb46c5ea43b337c927ee12636bfccb6a05ab5dbb10ab8b47043cc0dc9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687044950, "uuid": "c5d1ef6d-2276-4991-a379-e203a28a7d40", "value": "T19C052346FAC99072D8F02BB444F702830B35FDA15E79835B165068AE2C33AC5D5B67AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687044950, "uuid": "f4f87b3b-94d4-411c-a47e-ce5975030e1f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687044950, "uuid": "21038a27-1c30-45dc-8981-e2fe9e7dc471", "value": "12288:uMrTy90yjEcriom7pjG42L6FeShRbwtU9SsMDR8TcxeXkr8ShkaBfe:5y5j/rJb4yueSXQU978iT+e08Sh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687044950, "uuid": "500d5c9b-5a69-4fa1-9eef-91e5c7d86bf0", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687044950, "uuid": "9ec88504-cebc-41e7-9f20-cd4e7885c4e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687044950, "uuid": "e877d4a7-ecff-4743-8c8c-df7ec33eebcc", "value": "ee4a5ee308b60b42450aa3f39bcf0e61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4056da35-0d57-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687037888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037888, "uuid": "8e2a0f99-f347-4f9e-82d0-37dbbed104b8", "comment": "Malware payload", "value": "2154c91bb1aadb085b01e49cfa36d62b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037888, "uuid": "87fc6514-7caa-4e9b-a4f5-e66bfeb1cd89", "comment": "Malware payload", "value": "84c69609af5177fc052f67ed410e8d521dde14662cbd31f8476a3d3b317eaaaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037888, "uuid": "98b9c6e2-3c54-4b19-989e-71832244fe89", "comment": "Malware payload", "value": "a84551d491211f7ec07491146a67d5672d1f37c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037888, "uuid": "570db208-a24c-4fac-b1be-f1860e352385", "comment": "Malware payload", "value": "a450fcaa52639cffdb023dfc28402de261350837f92d5709e74214abec8118453a6712764a3b93494cc8d88bd139ade0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037888, "uuid": "3d26cd2a-6c38-4638-af50-9c6f274fceba", "value": "T117444B03B2E17C51E966CB728F1FC6E8760DF5504F4A7B6E29189A6F24B12B2C163F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037888, "uuid": "3bfe2ac5-04e4-4178-a61d-6d53be65219b", "value": "04b17228a03b1d4a739b2c7487c1a1b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037888, "uuid": "44061c1f-d545-4692-ab6a-f58a5d125853", "value": "3072:bP8DMSGY3nMLRt0euCDItMYyumExJ8BGy5PaVSeROZ:LCMJSnMLD0eCtMExJ8BVgROZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687037888, "uuid": "b34bbd73-d3fc-49fa-aeb3-20523858b3dc", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687037888, "uuid": "bf997525-0366-4a1c-8028-223f70506271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037888, "uuid": "c888817c-075d-4e53-a06a-ca1e3ccd3060", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343b4b08-0d5d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687040445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040445, "uuid": "86a03a65-ddad-4cc5-943e-66f222ebbe93", "comment": "Malware payload (RedLineStealer)", "value": "fa81d90815bee5e141858a5c7d4a7bd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040445, "uuid": "31021a96-7eb0-48f9-b990-df6b61c2f57c", "comment": "Malware payload (RedLineStealer)", "value": "84eb889927b7db5ca8565bbcf86c3e9960a41637651d9ceb2994725c76bdb4c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040445, "uuid": "a9d509e2-1668-47db-945e-d88b2ba0960e", "comment": "Malware payload (RedLineStealer)", "value": "31a6d2e85f2493021668107b012e1e5906a449af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040445, "uuid": "6d9030fc-bd2f-4d43-bd7e-659adf054033", "comment": "Malware payload (RedLineStealer)", "value": "846a818fe68c19eca238157741928b7873c909e32fdc62a1358d2338c6ba844958f1642b5f990801b4f0afc30df39b78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040445, "uuid": "4f9dd114-fe95-41e5-9c9b-c90cfeeedd2e", "value": "T1C9F41202ABD85072DAF62B706CF646C30A357C915DB8836B27456D5E18B3AC5E73233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040445, "uuid": "62e5f044-89fe-40fd-b08c-f7afe07fb8dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040445, "uuid": "8bb6cd5a-6f10-4030-ac7a-0000635a96f5", "value": "12288:+MrHy90WQvj6S+qO2NYcAOag0tqJjO2EElYtTKUTewmdCKSAt4CjeRJD:xyKjjOi5CgkAO2EE6pKzwzBzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687040445, "uuid": "4e39186c-c932-4728-9ee9-70b0bf88c0d7", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687040445, "uuid": "74d42dfc-9369-4ddf-969a-4f14bd481592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040445, "uuid": "b812a3b3-51cc-4c56-b8cb-ddcba18037c3", "value": "fa81d90815bee5e141858a5c7d4a7bd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db464fa5-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045450, "uuid": "8476e655-6b85-45ab-b6ef-1b5f64c154e2", "comment": "Malware payload", "value": "ad0e8afd6c2e6ebff1b48f81f054f294", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045450, "uuid": "3f841c9a-1e60-41b4-8755-150978e6aab0", "comment": "Malware payload", "value": "85ca9c11594a4125e7e802d5c047ebe962195d02042e87039f7176afb4a57e18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045450, "uuid": "476eb0f6-09fc-402f-bc26-1e30fb9bd444", "comment": "Malware payload", "value": "90a854e8e3154b11f7df53449cc366a1bfa58c3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045450, "uuid": "51539043-fc61-48cb-b595-5711f1170fc2", "comment": "Malware payload", "value": "2ecc4a35f7718b6187f0150d74765bc8ecb6a5dd031a227030aa0764b11ede0c29f1c88aec2951639cec12b1ec9257da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045450, "uuid": "1e8062d6-c710-4679-b602-b80903be194e", "value": "T1A214D90AAB610FBBDCAFDD3702E90B0539CCA55722A43B363674D528F54A54B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045450, "uuid": "11ff0edc-66ff-4619-9a82-955adf8b9bb3", "value": "3072:JGv+r3PO5wGQZdN+z9+JjFxqLg9ciPm+jm8ff+FC5i:JGv+ewGQZdN+zOqM9c25fgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045450, "uuid": "9bf64789-1352-4ba3-9392-927184480530", "value": 198684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045450, "uuid": "b31236c8-e7e3-4ceb-9edb-dfc15d2db490", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045450, "uuid": "936dd364-d2e6-4a65-8d75-c076f53aa306", "value": "ad0e8afd6c2e6ebff1b48f81f054f294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b52c2c-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045499, "uuid": "fdb3c922-c64b-450c-95ec-39fe754b2348", "comment": "Malware payload", "value": "bf365b02c47d80d79737cd58180c6caf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045499, "uuid": "3d124ab9-daa1-44b0-902a-9e5f86b38bcf", "comment": "Malware payload", "value": "860292db42fc3b262f8694481153046b512f2922cb24e2c188adcc77f0a85465", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045499, "uuid": "7abb2971-425d-4911-ba8d-8ad916d375cc", "comment": "Malware payload", "value": "b1e02f3513c7d437806a2a584ad3c33ef9194d8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045499, "uuid": "85ef61ed-ac03-4d95-8a8d-d22e47333ebf", "comment": "Malware payload", "value": "d626be76effcf1f31ef0ef3dc546ea5f257112740c19b68e630d5ebfaa8139ef7f1a8225eeb329a8e07069a215ae0ec6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045499, "uuid": "e0eab0d1-f74d-4d87-b9b7-0fc83beec5c5", "value": "T1A3334B02B31C0A57C0A35AB0253F5BD097BEEAD022E4F689351E979A9671E375482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045499, "uuid": "e1b5aafe-f0d9-4cc2-9f90-c03d1914a079", "value": "768:pO7HKtChgliRuLR/QPNIHGKh2QCeylNEWIk92mk8HcjItggqYIFRxtKSow/QIo0:89c7Gylh0mWH26HPtggX8xgM/QI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045499, "uuid": "c8ca07a5-fd3e-408a-9e5c-124a4bffe1af", "value": 54792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045499, "uuid": "8de0e73e-87de-46d6-8589-8ce65d6596ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045499, "uuid": "e89bc0ef-3b5a-43cf-a453-e1966e80c4b0", "value": "bf365b02c47d80d79737cd58180c6caf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfeaedc-0cf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686995794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995794, "uuid": "cf3bde1f-6210-4bf1-bf1f-7e2ba309ab34", "comment": "Malware payload (RemcosRAT)", "value": "e0907862b96f0342e3ca578ba753913f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995794, "uuid": "2bf3a86f-fb8f-4378-bae0-b3c85fabff30", "comment": "Malware payload (RemcosRAT)", "value": "88487a1a199fd2edca3ed2c60997116aa4ce1f63f2fba7b68be0ad9b96ca88be", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995794, "uuid": "41a86564-22a4-4e9e-97ff-7d119680ba14", "comment": "Malware payload (RemcosRAT)", "value": "318b5a1509678d55e225d178e05cb154f836854b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995794, "uuid": "6b1b1a3e-f6cd-4309-af74-297dc46aaa32", "comment": "Malware payload (RemcosRAT)", "value": "65d5a921ab37b301557a9eb5e304e314a59b60f9986f152934c93bca93402360a3f665e26a6876c4d4b556ef4ab07e69", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995794, "uuid": "6a322f58-43fc-40c5-aa76-3a70712a5fef", "value": "T1FEC2FA96E79B03798F8111B1271E1BC9AB6DB13E735150B138AC937423A9C2E43766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995794, "uuid": "c76016da-a489-4002-8012-b80d0bbe175d", "value": "768:iFx0XaIsnPRIa4fwJMMta0zX6TBUTRjUY15v:if0Xvx3EMD0zqTB+jL7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686995794, "uuid": "791ae22b-45e1-45aa-8866-2c80383e0461", "value": 27940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686995794, "uuid": "aff21c59-2070-45e7-a192-151f42cb09da", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995794, "uuid": "a670664a-3d92-4430-9563-0c94857f9105", "value": "NEW ORDER PO FMO23-00946.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abfd76b-0cf9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1686997426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686997426, "uuid": "d1e90609-a9e2-454b-9117-7f1356224b25", "comment": "Malware payload (Fabookie)", "value": "e61232c458a31d10cda9bb4bec57c44e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686997426, "uuid": "26a5eba2-72d9-4240-abc2-a52cbf6e5673", "comment": "Malware payload (Fabookie)", "value": "8864d8f7f148c66afd1d7949abc041310d8b8837249a817c57f74a68e9c320ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686997426, "uuid": "02094531-15ac-421c-9abc-ebd007ff402c", "comment": "Malware payload (Fabookie)", "value": "f9c3e0ab05ab86ed37dc13317adaa56550dfa339", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686997426, "uuid": "4c34a4bc-79c3-49cd-9c71-3a213c84577b", "comment": "Malware payload (Fabookie)", "value": "5e040882d41140ae0d2d000f32da77e5156bb475ad8138afda6d5150207ebb986bf86aeb587f0accf021ca7a17179741", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686997426, "uuid": "8296b607-30eb-4ff3-8e49-cdb27544becf", "value": "T143742981F3DA4028E072C679CEB18363EA767C155B3096DF07609E6A6E73BE0D535B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686997426, "uuid": "01cfe13e-1334-463b-ab67-0d3c1363120b", "value": "e80f9d537b01e2bcba0fde7f5238b2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686997426, "uuid": "588305e7-9002-4685-bafe-0fd30c6f9909", "value": "6144:6F18RIT6Ram4StJ3rXDW49KJ7SkD4DiaODgKYleQ4hPP:6wdpXDzo3DMWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686997426, "uuid": "ec4549c6-c780-4641-807d-67fee564f670", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686997426, "uuid": "4be5c8d0-dc77-47f3-b21f-3a2b25659f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686997426, "uuid": "8534709b-2f05-4f40-bbe6-3707a4731279", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52be071-0cde-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686986115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686986115, "uuid": "74a00838-e259-42e2-a2f0-1452ba8aeb8c", "comment": "Malware payload (Mirai)", "value": "f04e6e89244e380cec757bcb43f296f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686986115, "uuid": "8a3a3b68-a61d-4d9d-a45c-39f6038c67dd", "comment": "Malware payload (Mirai)", "value": "89967e682cc022b0c3ac6979fe668a28a71c6fe0c470f7c4abb9de413c843c9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686986115, "uuid": "856a5b88-a3bd-4281-9421-c696b2a71299", "comment": "Malware payload (Mirai)", "value": "fbf9383103fca86f16d7e3a525f5c905287f6099", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686986115, "uuid": "5e7c6851-8255-40a9-a6f6-1c1aa68cfce7", "comment": "Malware payload (Mirai)", "value": "46a8a87e6812e63c2e350931110121b7014b0d0fdb4dddc8d982af2308e71f30beb4ac68ae4efc41e2aaa9cc5e172049", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686986115, "uuid": "da426af6-042d-4850-b01d-0a1dbf02b673", "value": "T107B36B1B6692C5FAC08352B92BDFA1618823F6790B36331773D4BDA43F158C96E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686986115, "uuid": "8901d3df-039f-429b-9cae-332254697bf4", "value": "3072:BF2ndCa9qRBFZm4z1EYfcbJwphaFsfjJv03CKPCNVOXinYuM8R:kMVm4z6YgephaFIdcFPCNVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686986115, "uuid": "eb3d4e56-07f3-4ecc-9d1b-8560ff07cbc9", "value": 112336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686986115, "uuid": "cd092521-51e8-42ec-8099-ef33d50175e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686986115, "uuid": "e8a1da04-1cd3-40d2-affc-25497771e55a", "value": "assailant.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65e7bd4-0d25-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687016719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016719, "uuid": "edc9ef36-df2f-449f-bebf-3c603fa4f53a", "comment": "Malware payload (RedLineStealer)", "value": "86ad279bad69207995df9811c5332b31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016719, "uuid": "36b20a6b-9ae6-4d89-ab75-de08a2d107fa", "comment": "Malware payload (RedLineStealer)", "value": "8ae0ab31139e334c1321c0bb6880a7335abb14222a80429ed309fe2e6f43b57b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016719, "uuid": "b769ac0f-cced-4674-ade7-46bff7662852", "comment": "Malware payload (RedLineStealer)", "value": "84ad90b185ee1252862ab7784549d8f3ac7c7258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016719, "uuid": "82b7b2b8-1fbd-4f2c-b25b-50a81ae227e2", "comment": "Malware payload (RedLineStealer)", "value": "2bf459a86194cc8c03ae5d5153f40ed985316177cf8f818c1c15dc1d48bc3f569ba41865f4deb024bd5f9294f601e87d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016719, "uuid": "5e69cd82-fd49-43d5-bacd-92a2ed00f200", "value": "T13BF41257B7D88437E8B927B099F702930E393C619834873B2786E99B1CB3794A571327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016719, "uuid": "be0abdef-c02f-4266-9af0-b8cbb7060451", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016719, "uuid": "dcdde04e-2008-4ea2-b555-878af7dbb25b", "value": "12288:LMrly90/kOLR5hmz+alzoY6JL4QmL/rXjOm8aa1SaCOweweiqVsx7CI:6y2bhmz+acSVDrXKhaa1RBCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687016719, "uuid": "32e130cf-6205-43c4-a45e-de331a3fd624", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687016719, "uuid": "8d3776d8-8577-4fe1-87c7-d8cb1875df28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016719, "uuid": "40359add-dd80-4e79-afbd-e0d020faab6a", "value": "86ad279bad69207995df9811c5332b31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc224141-0d2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687018822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018822, "uuid": "db616bae-57a7-45de-a419-52ae695118c7", "comment": "Malware payload (RedLineStealer)", "value": "a4b20a3f9b42fc0442b17d3daeb30952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018822, "uuid": "400810c5-7359-4cb6-8755-2a8782962792", "comment": "Malware payload (RedLineStealer)", "value": "8af68d964529e9dfec9d6b2735f0f1b9664e75097569170b376cbd7da1b6dbf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018822, "uuid": "83021e1e-57cf-4092-a798-2518e4737506", "comment": "Malware payload (RedLineStealer)", "value": "cb8e296a95f6a1791493fcaf594a7eae54bf7e0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018822, "uuid": "58f20e85-7f29-4261-a439-c55f28696527", "comment": "Malware payload (RedLineStealer)", "value": "2cd3e5b494f94132c68cbcd87916986b37945f7282d5922b4719c93c90ab02e2ca86368cdb79c4e2f973506ffb9bc193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018822, "uuid": "a2375de0-511b-4ab0-b026-b875c832bae7", "value": "T19C44391235E0BD24D805087FB479469BB6AE68DFF7D8C4FA112421DB2A172892F7D336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018822, "uuid": "7c78fcbf-309b-44ba-99a8-c77fad408098", "value": "8b20c0aa1a6b70c064e1b0a2222ddac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018822, "uuid": "96e749cc-bff9-4a8f-abf7-d90537fe71b8", "value": "3072:oLesSJCc63felypR0Hgm6SeqsRoAmgzmkm0GxpSHyQrpbRutnlz1sRt0xe:+dSoc62+Seqs7mgzmkm0G+pr3uZlzWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687018822, "uuid": "f303aa75-4079-413a-8c79-c7b9568148d1", "value": 269586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687018822, "uuid": "66095341-3410-42c7-ba23-0671a70d06f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018822, "uuid": "43bdfe74-10f7-433e-be1b-1437a3197aeb", "value": "a4b20a3f9b42fc0442b17d3daeb30952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef17cf3e-0d5f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687041617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041617, "uuid": "61c14584-9240-40d6-a129-80db6cdc4195", "comment": "Malware payload", "value": "68253d46d7fb2bcec3b75786186a860b", "object_relation": "md5", "Tag": [ { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041617, "uuid": "c1d52f69-7267-421c-8e07-f0c4330e0135", "comment": "Malware payload", "value": "8bfc3e2cd1255d66d65150bc24ef06f930a6c37ec11927b43492317240141138", "object_relation": "sha256", "Tag": [ { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041617, "uuid": "b6a31db6-d156-4d77-adbf-0b77664d5cc7", "comment": "Malware payload", "value": "502fbf04cd73f4badfcd19c8385118539ff57838", "object_relation": "sha1", "Tag": [ { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041617, "uuid": "e071ba05-8c8f-495c-9262-b251459f891c", "comment": "Malware payload", "value": "b1290f7e551c3333d5563889a72c19cfef34edf8ceb31aae2ead47277ec3a744e9be11bd9c1db5bde2a8b83363b43b9c", "object_relation": "sha3-384", "Tag": [ { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041617, "uuid": "c6a0f693-1c16-4803-9833-f6dd981ba20a", "value": "T1BA84E0793E3DD0E287EC9FE5BC46B4DC2AB4C0EFB601116EE212D20A1FA057568D66D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041617, "uuid": "0c77be08-c282-4b46-932d-e8fad9178622", "value": "6144:aQk20teiGj2tvu8vQTPdklbScNPL1rKzlsp7l4QtnqxSbVCZhdP+jC9PANe:ap2008t28vQTPQWiPhKzKgQtn66CZ/PP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687041617, "uuid": "d76c67b0-1e5b-4041-a20d-8a5e6fc70004", "value": 392809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687041617, "uuid": "661d63b0-42a7-49e8-b5a4-e97157f928a3", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041617, "uuid": "96705af1-d446-4f50-8a8c-736434dbc658", "value": "photo-1606567595334-d39972c85dbe-Final.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a7e1af-0d3d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687026630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026630, "uuid": "9c2f1c7c-2a7f-46a4-91ee-ef7e6c58d538", "comment": "Malware payload (RedLineStealer)", "value": "6a63cab7e8ada71b100bbceec0f09a3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026630, "uuid": "66632363-ab02-4e98-bf8b-d299ab776530", "comment": "Malware payload (RedLineStealer)", "value": "8e6a8e75f97bbdd3e54140af31bfdf1014abcbc4fa9164e06bb6385504668824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026630, "uuid": "aa35eddf-d61b-471c-9d51-f60d1d57c179", "comment": "Malware payload (RedLineStealer)", "value": "1af4bf316b487a1eb960ae3f7a3aeb695465a00e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026630, "uuid": "020cd7b5-450e-4117-8dac-a572d73024b4", "comment": "Malware payload (RedLineStealer)", "value": "04f05d390595b57978c03206d0cd482536460d039c7a2051ca1f22d9d5b9cc0d1edbd5c5de2691f0a63eea58c2de6e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026630, "uuid": "e5954c46-14e3-45f8-8e5d-3a341452c361", "value": "T1B0C41211E3ED8133E8B2677018FA03930B36BC905974C36B2259695F5CB32E8957677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026630, "uuid": "62269da6-484c-45f9-85bb-71d648ab6c5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026630, "uuid": "eac95e88-79bc-4325-a5ac-64dd9435beed", "value": "12288:6MrWy90/7PbMqV27dsLGEp1lCZQscn1Nb4UstXKd4IqNEG66:Ay8F2hsip8DvaHNr66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687026630, "uuid": "59493756-347b-4a6a-a985-260aa39aa3b3", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687026630, "uuid": "5e19a18c-6796-47e1-bc81-9f0b45d189c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026630, "uuid": "15fa08db-5bd7-4b2a-a008-b9c42b1e6d59", "value": "6a63cab7e8ada71b100bbceec0f09a3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07220f8-0d67-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687044948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687044948, "uuid": "86e6ca04-08c9-48c9-a48e-f75373417532", "comment": "Malware payload (Amadey)", "value": "91b2bc44dee21af84cf900960af42c87", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687044948, "uuid": "f541c366-5a92-4174-a7b5-22f5b0cc852a", "comment": "Malware payload (Amadey)", "value": "8f1dfae61cbfd98979fa45deebe12cc5209900cca48709461cd48a66e75119c0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687044948, "uuid": "a7f63e28-6d78-4746-9915-16c10e26e8e7", "comment": "Malware payload (Amadey)", "value": "b1e3d081d92dfb4cf661c5374640b90df740879e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687044948, "uuid": "172e342d-2e6d-4355-a359-dade64dc9c79", "comment": "Malware payload (Amadey)", "value": "e2b6d9ecb10cdf9290cc7294d26f3b62e0e8550238e4a96a8e2a7498aa52ee9591fa359d9b77a6c9f9c8920cfb7607d7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687044948, "uuid": "7d4d549a-048b-4b7c-818b-236ca85ada57", "value": "T132C41242E6E99272F87517B028F613431A757C619D789377B3C19ADA4DB26C0E83233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687044948, "uuid": "8d42b700-56a1-4aad-86b7-ce1df1cfb781", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687044948, "uuid": "c7c27c0f-9e17-4d96-a0f0-20961fd9dd5d", "value": "12288:4Mr/y90otM24wImCLlgko9OHHvMVhCtE6qcup3x1xSL36QLhAsHz:nyM24wIdLlgk60vMCEAL3h3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687044948, "uuid": "a1358bfc-d449-422b-9a10-e953411740ee", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687044948, "uuid": "880b1914-c672-4eba-83d9-aa5978d7a41c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687044948, "uuid": "4cf04775-9067-410f-914e-1bf2523f3059", "value": "91b2bc44dee21af84cf900960af42c87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dab257-0d08-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687004039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004039, "uuid": "a95b6c5e-b058-44d3-80e0-6e03a14543bc", "comment": "Malware payload", "value": "a6bfe6a9d4e664e1adc45784817d55e6", "object_relation": "md5", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false }, { "name": "pw - 2525", "colour": "#E80A54", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004039, "uuid": "7ff83d85-7d83-49c4-aafc-91b9db0cab1f", "comment": "Malware payload", "value": "90b268cf8f1e93cc7e45c89fbec2cebe677a09cb9ed248bab5ce09c6cc8bb314", "object_relation": "sha256", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false }, { "name": "pw - 2525", "colour": "#E80A54", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004039, "uuid": "c6b648ea-0d8d-47fe-91ca-bb30dc1987b9", "comment": "Malware payload", "value": "3b8e45b1d7b78d46dbf33a76158caa7a4291a661", "object_relation": "sha1", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false }, { "name": "pw - 2525", "colour": "#E80A54", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004039, "uuid": "8755133a-2134-465b-99bd-be62dcabf62c", "comment": "Malware payload", "value": "fdafe65f7179a6b7071a9f63cdd2d864ff56ffb3a1de0f177d096b318264dc45e519c6841d7b475740f6ea8a9bea4d26", "object_relation": "sha3-384", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false }, { "name": "pw - 2525", "colour": "#E80A54", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004039, "uuid": "e4321659-c1ea-4831-9e35-b3ad7ee2e3eb", "value": "T181817E40FEDF479EFE1C89A9814F1B98A60680D9AB48F4F314CE07401E701AAC950B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004039, "uuid": "5453e987-7efb-4964-903d-d0e652028553", "value": "96:q0PgXhgOCYhBbrR8ZW1+Ku+7yOuuSBWUj3zOQ2y0OKUXTbk:q9gOJ3PR80IKu+wW236Q2y0O/X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687004039, "uuid": "43f368c7-cbc2-4c94-baec-ceb3ae9548fb", "value": 4153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687004039, "uuid": "8bb05a2c-cbf0-48d6-a6f2-254ee1d72398", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004039, "uuid": "e4a41025-6c3a-4e9e-80ae-378dd341cd9c", "value": "Detalles_Informativos_Del_Proceso_notificado_Nro\u00ba_=929982892-21.Tar.Tbz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8002b7fc-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985597, "uuid": "404bdc21-7003-43d1-9567-4406f3993c77", "comment": "Malware payload (Mirai)", "value": "574ddec035b1b2bdd6bc5b286eb75887", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985597, "uuid": "f9d934ef-510e-4fc0-bd32-e9f62886cf77", "comment": "Malware payload (Mirai)", "value": "910cdba98957d029ee26fc838067711dcbb64630bb82dcf8990b3c5124f56396", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985597, "uuid": "37a60691-4a7c-4026-b8dc-44ea84cf4857", "comment": "Malware payload (Mirai)", "value": "44e71f1aca2b9cae0a4bcf23c169535cff517e2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985597, "uuid": "832f656a-b70d-416b-b729-2059223475a0", "comment": "Malware payload (Mirai)", "value": "2ed9b5a9fbacecc0cfd0ebc02c2cca847a6245cf93213b89e53519c4b307e8e264975d70ec37ac1f5a23ccab881c52e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985597, "uuid": "7154819b-50e8-4699-8406-2454a9b8141b", "value": "T14AE33B06B30C0E47D2632DF43A3F27D193EFAA8121E8F644655FAB4A9271E325546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985597, "uuid": "7e2bd479-8882-4b41-ba8c-da9550804230", "value": "1536:KCuuBvjHT/wk5twxpivi0yIfu4mOq8z6UNBAMNAtvQvAPWgIfIh+JRV/gU2/:04twxkqqVmjUsMyVPQ3f2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985597, "uuid": "d59d0278-4c70-471b-9dd5-721ab81f40b5", "value": 146116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985597, "uuid": "78c2ed38-9969-460a-baa6-40608360d376", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985597, "uuid": "7ea09dec-ba09-4a1b-8995-7acdf0f79652", "value": "574ddec035b1b2bdd6bc5b286eb75887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aaeedd3-0d62-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687042550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687042550, "uuid": "0007480e-7600-4ef2-9abe-fe27d7e70fbe", "comment": "Malware payload (Amadey)", "value": "ffabc2b52eaaecccb5cf6eb76e28d027", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687042550, "uuid": "4b8d1ed5-cf72-4502-9c9e-8049b6d6e834", "comment": "Malware payload (Amadey)", "value": "9203485feeba4f749887a7510b1dc765995a51d9a8e59f76229954d33641511d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687042550, "uuid": "3f9f9f73-5df6-4c97-97a9-995a338c3e10", "comment": "Malware payload (Amadey)", "value": "8518e14b4efd2076bff141b5ec6008422e3b0cc0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687042550, "uuid": "6452a885-2904-45e5-8e4b-3cec8f7d641e", "comment": "Malware payload (Amadey)", "value": "4537be829a9cd50876597e644ffe620e2f04969eba6feb5a133bd5d4a6aa62d6c9a8e429e02d1f84bf5ed6d1c80b60e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687042550, "uuid": "7bc4fa4a-b488-4e70-822e-e268ddaf0146", "value": "T129F41212E6EC8462CCB62BB06CF603C71B327D618DB547AB27895E5E0DB36C4A53131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687042550, "uuid": "275213a7-0976-43f0-bfb3-9891e5d26d5d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687042550, "uuid": "f92d7e34-22ab-41ee-a71e-149670cacd2a", "value": "12288:mMrwy90RzubhQNtgebWlUbksx3VeahchbKNPARzaMORRM/Uv7MXN7d3s:eyZNKtgivbp3cqTJszrORa/qoXN7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687042550, "uuid": "02d18398-8c35-4b40-ba68-e4b79cb80151", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687042550, "uuid": "e1bfb8d8-b11d-44d9-897e-05cc190fa635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687042550, "uuid": "324f9ad9-f77a-4c53-b0ac-8a4d924f23ea", "value": "ffabc2b52eaaecccb5cf6eb76e28d027.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23700718-0d13-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687008634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008634, "uuid": "78bc417d-3c28-4824-8aac-5cf17947cc0f", "comment": "Malware payload", "value": "bdd3f500dc784c0f597d9eca09ec4c92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008634, "uuid": "89dfa300-15e3-431f-bf18-dd7e1723e1a2", "comment": "Malware payload", "value": "920d519caed6fad76c8205ab38d984baccfd97405b1ca5ada793cc50140183ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008634, "uuid": "98e8e7cc-2490-4cdb-b6a9-c4b8e7d516e0", "comment": "Malware payload", "value": "a951390d50a09bd2c24f1633fd6a6b0af82a1d11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008634, "uuid": "b46ec4ad-5dcb-411c-b81a-0178356d8c55", "comment": "Malware payload", "value": "826e104bb023cb89890df350ea8a94bf2127e8b2f179cd7873f6d2e19cebc6bcc78e0864ba06c3d0fcd8aba3304aa8fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008634, "uuid": "12cc4554-a01c-4950-ae70-5139090ce4fe", "value": "T10C15D01072989F53E03F87F595922130C3F52623F57FE79A9DC312EA2966FA08A815D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008634, "uuid": "5bf5e2c1-d3d9-44b2-a5a9-5bd21d71e3db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008634, "uuid": "b15a3166-9afe-4be8-8eeb-a89450d1bb83", "value": "24576:O9YkZl9bXjZk1S5LA9rQhqduoBsXFsrpJGzUO3c:OvXjZks5LAGAyGrpG3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687008634, "uuid": "5bb94113-7c0c-4b0e-a4a1-37b306001004", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687008634, "uuid": "b914ab3a-f5ec-4297-8c7c-4336719b0a76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008634, "uuid": "cf2336a3-c2ea-435b-8d70-b4bbb773609f", "value": "r5911404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719c7d4b-0cfe-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686999746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999746, "uuid": "c3fe2ec8-6202-470f-9f8a-f448c9c42a77", "comment": "Malware payload", "value": "a473bb1d81b62d15e4cfdca1ddd76261", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999746, "uuid": "c3152383-063c-40f4-a840-475b8f67b6b7", "comment": "Malware payload", "value": "9271b609db698f886795f121d1d110acf0a4959eaf5d94a93ade96b6a6cf0a95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999746, "uuid": "7cd030a4-9ce9-49c6-88de-1a4c45a220a6", "comment": "Malware payload", "value": "ab477c9b7cee0d06fe383fae792f56bd2af16d11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999746, "uuid": "95175bb8-7c75-41ae-90b7-92cbc9f3e450", "comment": "Malware payload", "value": "b79dc782ec6c7ae85ae7f75dfcc8b1109c95694c41280ffa0513cd30777637e036d1a7480085943669fdf0fa090a56d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999746, "uuid": "b7c244ec-a6fe-43e4-aa05-4fa256d6678f", "value": "T179152354223BCB36D4A20BF44D55AAB003FB52EE3C5AEA636C53B1D56B92B7100E4DC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999746, "uuid": "cc89a55c-5cb4-43a6-b3c3-6aac15b18dfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999746, "uuid": "7df10352-af81-42a7-888f-6da1e06b4236", "value": "24576:/5LA9vxw0DWCF5tmunPob8raYezHzTooN:/5LApppJm0Pob8eLHvpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686999746, "uuid": "009fcd2b-b3ff-497e-9a7f-e98221324c0b", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686999746, "uuid": "2e7ac6ba-9906-46c2-be55-b2a9660b20de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999746, "uuid": "124c4eed-7d8d-4b43-b440-01e8e00590ab", "value": "a473bb1d81b62d15e4cfdca1ddd76261", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fc89cd-0cf4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686995384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995384, "uuid": "a881ee8d-5a3b-4876-a960-d4a8803e5dd2", "comment": "Malware payload (SnakeKeylogger)", "value": "3fd6b0dfba92672fb38a346577b75eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995384, "uuid": "31154815-2073-4018-a2b0-29ea0469ae45", "comment": "Malware payload (SnakeKeylogger)", "value": "928e7f54ec57eff7800c64c09fc81b2d951c44f366281fa65a85da60ae98f8bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995384, "uuid": "47fa1411-4393-4b68-beeb-5e960b5bb979", "comment": "Malware payload (SnakeKeylogger)", "value": "3d6358c1b2701a312dc122f93273ebbfc3dfd21d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995384, "uuid": "3ed50f0c-92ef-4d69-a33c-8e9c79300be6", "comment": "Malware payload (SnakeKeylogger)", "value": "5d289fc7524325ac75b3c27e7379bda4cbafa1d03e0dafefa40b9d3e0acb425d0f79400df1fae28f9648b0c127ea0d7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995384, "uuid": "648a99be-82e8-4d79-8f37-eabd8a207230", "value": "T187257FD1F190889BE96F0AF16D2A653010E77E9D64A4C10D569EBB1A76F334220DFE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995384, "uuid": "78bde709-a3b4-4a72-97a5-f995efb7335b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995384, "uuid": "5db516fa-23cb-4be8-a3b6-355c1acc8392", "value": "12288:QoAcuF6mn1DHLZnvJFNiOe42KMu/N3mWhQmwmJCMpUdgKPBEVZCMdxrYow4MWoSR:OiOV/NOa8gK5EVMqC9WbeOKEJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686995384, "uuid": "894be9e9-74f7-4c49-9b89-0017f07372f7", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686995384, "uuid": "4aecbf69-1e9c-4c76-a5f2-3110c4010ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995384, "uuid": "09422345-c453-49c2-bf7a-fa85c67a065d", "value": "3fd6b0dfba92672fb38a346577b75eb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8280032f-0d55-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687037140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037140, "uuid": "86038b2c-085d-47eb-8aff-11fcb036c949", "comment": "Malware payload (RedLineStealer)", "value": "f61bca6295fd63482c677ab74a16ef40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037140, "uuid": "0cb21e70-d746-4bf0-974c-654c3a5031c3", "comment": "Malware payload (RedLineStealer)", "value": "9456c0f1d340d89235a3b4c2bea52961d5c800d788e60cfeb7cb80341b1975fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037140, "uuid": "e73b8459-b8aa-4854-a605-7848ad95ea05", "comment": "Malware payload (RedLineStealer)", "value": "14f35c7c49b4af87d77c26004c7c391ebe8b883f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037140, "uuid": "d33afe52-f053-4915-ad15-7bcd3c82e533", "comment": "Malware payload (RedLineStealer)", "value": "6d9495782171c76a606ed54e545099b1ce73ac8e50acefd80f0eb847e7391437deb21074da22953adde0a5629dfdced0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037140, "uuid": "6aaf19d9-123a-4aad-a716-7d1c4beb1984", "value": "T13B052383F6E98073D8701BB048F782C70A37BDF258B4866F6645665E4DB1BC5A4B231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037140, "uuid": "9499c669-ff24-41f4-98fa-40e5ad2797b5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037140, "uuid": "ac3c9a1d-770b-47a5-8698-1606cef2deb0", "value": "12288:XMr0y90ctS1njHfm4Si3LJ1wp2UpkF4MQEz+tw7+Xy0lFTSdawRkw+ldsTdAch:TyRIj/jGgUpkF4fc+tw7+Xl8+Ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687037140, "uuid": "33f8d6a0-d255-420c-a83b-fb41a9df4d31", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687037140, "uuid": "42b7b9e1-48b5-48d7-8407-c23d637d7310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037140, "uuid": "631ea76f-f79d-4f91-830b-bfeb8bd28999", "value": "f61bca6295fd63482c677ab74a16ef40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2ea21f-0d10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687007412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007412, "uuid": "db0c85b0-4098-4c96-ac92-e39c097807c9", "comment": "Malware payload (RedLineStealer)", "value": "bd7eeb9e91a5c39241c07c8aca32737d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007412, "uuid": "4fa1d893-d72b-4678-937e-5e223030835d", "comment": "Malware payload (RedLineStealer)", "value": "94c20bffebfb6c573109ea46246596f9491abfa92b0041e4e8b2320953f335a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007412, "uuid": "025e4d32-933d-4f27-8f4f-b36fdd980d3c", "comment": "Malware payload (RedLineStealer)", "value": "cec6ce532d984361041f0832437c09abf85096fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007412, "uuid": "7e454af4-7d34-4c6f-80a6-3c71ac08ba68", "comment": "Malware payload (RedLineStealer)", "value": "86d213ba49565787eb6e90d7d7c9de83fe94c1eaef353949621c6a871854435da19eace266daf6289b9c727421c1cc90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007412, "uuid": "8da3dfba-2cd1-4871-9c73-31aa91984871", "value": "T134F42212D7E58027D9748BB018F612931F39BDA2EAB9036F23655D9E1CB36C4A43533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007412, "uuid": "4965a7ea-429f-4433-bab5-0b7734eebc45", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007412, "uuid": "611fe69d-a924-45db-855f-a33e294ba311", "value": "12288:AMrHy90E7r7rdRrcIeueNrT5TUtijL9DllDQNisao4Zf+VtB/AX9g+hMsptbgYD:Xy3P7rdRbpeNrT5Itin9pFoD4WfAOytV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687007412, "uuid": "bf99b91f-d7e3-4773-8040-39ac0bf59778", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687007412, "uuid": "eb62783e-799b-4e99-8796-59d54de5e163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007412, "uuid": "dc796e82-bd63-4039-b729-029064fa8a9a", "value": "bd7eeb9e91a5c39241c07c8aca32737d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b473644a-0d60-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687041949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041949, "uuid": "1db5668c-8037-4133-b24e-34fa4b3a843f", "comment": "Malware payload (Amadey)", "value": "a1b5e9bf9fced59b3880792d4f0e89fc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041949, "uuid": "2c0ce9d4-b903-443c-8d78-6828b2123fbe", "comment": "Malware payload (Amadey)", "value": "94cbf46e705c23124e8e5f925361e62ede10b4265f0e03f37de6b3fc04d40deb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041949, "uuid": "6e9d3521-96a0-4c3a-9da7-e34f220819a0", "comment": "Malware payload (Amadey)", "value": "7fd431e754c49385e03e4d4dc1c5bd01586bf030", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041949, "uuid": "dfcf5c2a-e9e6-4a63-af3d-69b826c76e9d", "comment": "Malware payload (Amadey)", "value": "baa7ce36b82625238dd350bc10bf083d962b84f89a1c8a979b32bd80ad29d4e692c090c4c208f870e194107c15605e94", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041949, "uuid": "9e9cc99c-d5ca-4078-ad66-694f5561d707", "value": "T1EDF4232B6BE84033D8741BB054F512C30E32BDA55E788787279968AE0D736D1A83677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041949, "uuid": "a2d5092a-3ea2-4b1b-8b90-d648b1c492d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041949, "uuid": "ed46d8e1-57d4-4a00-a55a-bdabdf2e7a69", "value": "12288:hMrny90IeQ8SYwlYoL3Pe70yEZ0lzUuSwuNveAyEzlX4ft5r1XqZi68JW:myL8SYSLmgZnuSw8HyCGLsZi68JW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687041949, "uuid": "2b67e767-a25a-49dd-b55f-a71e9e132ce9", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687041949, "uuid": "fb7f007d-02e7-49d5-9a13-a6807e606c33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041949, "uuid": "008f1ae3-6392-4f93-93e3-88f687e4d1be", "value": "a1b5e9bf9fced59b3880792d4f0e89fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5ea806-0d12-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687008547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008547, "uuid": "2e956c39-23ed-4b59-aa1f-b0b90c73d5d4", "comment": "Malware payload (AgentTesla)", "value": "77fd7a42366f20396cfd02d3f0aea455", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008547, "uuid": "ce878be9-079f-4781-95c4-468ef7535287", "comment": "Malware payload (AgentTesla)", "value": "950de660ce5f58e7991441c5109a594382eceb65e8e16f9667f4089f508ba796", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008547, "uuid": "e07a772a-c93b-49af-823e-1db9c34ac104", "comment": "Malware payload (AgentTesla)", "value": "5111b39f87307fa49d2bb096f9a5bacdecab48f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008547, "uuid": "fec5ab90-69a9-4ab9-b460-bd51bdc365d2", "comment": "Malware payload (AgentTesla)", "value": "99f71b46c8d8eb88b408d29ee25d654fba5d1034074483257874d9153a77a17e83b69fb01d8326291d2e83e174b83c61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008547, "uuid": "8af7819e-db5a-4d1a-909c-bbfd2bb9de0c", "value": "T12B15D04072A89F52E03F87F991916030C3F52623F57FF79ACDD221EA1DA6FA18A51193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008547, "uuid": "b7024c19-c572-45b8-8cd9-aea0c691066c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008547, "uuid": "09c53548-629b-479c-9d34-6b66b8970a0c", "value": "24576:UrYkZLYdXjZz1S5LA9acijRNJ32hgxGq:UgXjZzs5LA93SxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687008547, "uuid": "8bfc7a07-9bc0-4bac-ab7c-a1f632fbf347", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687008547, "uuid": "3407afda-884d-4674-8968-477b78d1c586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008547, "uuid": "6444d163-f4cb-42d9-8a24-86c222cd7212", "value": "rpagamento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caedbb28-0ce0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686987011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686987011, "uuid": "494e8063-b4dd-4ca7-a939-0c175e226a7c", "comment": "Malware payload (RedLineStealer)", "value": "15c52bca7cbd708746d86e2026884e13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686987011, "uuid": "867f7f51-ba0e-4ab7-917f-d0d4ac590846", "comment": "Malware payload (RedLineStealer)", "value": "958431035edfb762865e04d7b7779642990562be407a3239a0d05737fdaf4873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686987011, "uuid": "dc1140e8-6448-4629-83f1-04c2f80bfdc7", "comment": "Malware payload (RedLineStealer)", "value": "200974b763a6cb5e9041b63152f77cc4e00d0822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686987011, "uuid": "9ca2e34f-6c71-4555-98d3-20c7c5fc913f", "comment": "Malware payload (RedLineStealer)", "value": "cf0dc41664990947222b052108fdf289434ad0e5b4415888848d789596795da476cff057a83e9872d05f8aec8219bc88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686987011, "uuid": "4685dce5-993e-4e86-a714-41c18b77de32", "value": "T1A50512136AD88232C87213705CF716871E32BC908DB5536A2784EFA95DB2BD875B2B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686987011, "uuid": "021efddc-faad-464a-a070-71aff6b3c79d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686987011, "uuid": "a2983813-f447-4bc0-9e06-83edea1aa24a", "value": "12288:8MrOy90AgD0V4Hvf42HOnfiRC1wBa1IzhXvPbu12ywAxFyb4:qye02PfXHdRC1G6IzhnMQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686987011, "uuid": "3e0b117e-4439-41d4-b34f-12b69637bee2", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686987011, "uuid": "ad2d185a-f7de-470a-8e1d-c844345e281f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686987011, "uuid": "a9ef220d-b19f-4e2f-8ef9-25c0baa8a639", "value": "15c52bca7cbd708746d86e2026884e13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c972d301-0d69-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687045849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045849, "uuid": "bf7aea36-ddae-4d82-be39-7e4aac2d0f96", "comment": "Malware payload (RedLineStealer)", "value": "bd57f62faf74ef42f6689b9285a1cbbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045849, "uuid": "2fb78d33-7d9f-4bc1-a6b3-10a0f362907b", "comment": "Malware payload (RedLineStealer)", "value": "9852dcf49cefdcaf67de2dcfbcf1f96e3161a3f393f0307a932e33ef9fe69ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045849, "uuid": "2671401e-c3bc-4c38-ac29-bdb730c4510d", "comment": "Malware payload (RedLineStealer)", "value": "c69dd5806ee55fe3b8646f32b63eb86b7b1a05d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045849, "uuid": "5ef4f42c-5366-41ef-9e0c-7fcfbe8425a7", "comment": "Malware payload (RedLineStealer)", "value": "c1cab091641c0052cc094facd3fc3c009eb284806d2afa4ab2cc7858389af92c7a92b82943db9c6bf4ee1cff58107979", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045849, "uuid": "fd16a5fa-002c-409b-9315-994781a97005", "value": "T126F41253D6E849B3EDB8173025F712A71B32BDB29E78476BA740A94B0D732D09472327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045849, "uuid": "b5c97c38-9989-448d-ad97-d95f38572503", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045849, "uuid": "fd9a9323-d8d8-45bc-a46e-32822763368b", "value": "12288:iMrVy90ssqbWCPcsslIPV1K/DVQoq7XtPYHdLQSyL58EBDTfbU/WZ8Z:3yvs8WCPcgVUrVM7XGdM3LWgmWZ8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045849, "uuid": "b508a4b9-30d1-4473-ab5d-4ad95c125f77", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045849, "uuid": "41a811c0-9b25-420b-9dba-0e25c203c630", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045849, "uuid": "32cfc19c-b452-4567-90be-05ed4e1e71c3", "value": "bd57f62faf74ef42f6689b9285a1cbbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f157d5-0cd4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686981823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686981823, "uuid": "9fdd61af-51be-466d-b33a-74cb355f0224", "comment": "Malware payload (Formbook)", "value": "35a057711aa053e318611df5092ec989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686981823, "uuid": "8ee04e5b-0f10-4e34-afba-89cfd0b8b3be", "comment": "Malware payload (Formbook)", "value": "99002f0c1304f392fb93c48abc83bcbe88c42854c06ebebc77617912747b7f1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686981823, "uuid": "bd1979b4-b0d8-4d9c-af4d-194283e106c2", "comment": "Malware payload (Formbook)", "value": "fa27f2a588d5747b6c8543b2f8472c43d9568a5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686981823, "uuid": "0c3e75f3-cc6d-4173-8d18-60445735c038", "comment": "Malware payload (Formbook)", "value": "4c563884f11733ca23ecdf721e2c6e9e289e291cf2fbba615d9f2a55c9213f41b84675461375632e5087124e9a364122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686981823, "uuid": "16bc8d6d-da48-4c88-b62d-5c513641ad38", "value": "T17C050241AAED4B0AD8FF63F4452095304BF2B46F7536E35E1E82B4E56A62B104F42F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686981823, "uuid": "98365bb8-9c90-401e-ba92-ff97266cc607", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686981823, "uuid": "3deee3e3-aead-4d6d-b743-cad061637a3f", "value": "12288:8wvwxsB2lZMIq2FzkhrbdYhFLWHN+hVx9AJQQEXqXdV:FwxaJIqOemzoN+5Kf4qXdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686981823, "uuid": "8e3b955a-cef8-41ad-a428-2983f9a991bf", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686981823, "uuid": "34defdc6-9d25-48aa-908e-0f37f73a777c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686981823, "uuid": "b7f55846-03a8-4a2c-8e6d-3dac74b3820a", "value": "RFQ-2004500U-PDF-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc5dd65-0d56-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687037746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037746, "uuid": "e343aeba-d434-498e-9dff-7bfa94656d17", "comment": "Malware payload (Amadey)", "value": "69e71c4d0906d3e553da8526a99ab073", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037746, "uuid": "c8f6db27-35c5-4e96-ab10-997c7edbfbf5", "comment": "Malware payload (Amadey)", "value": "9af9dabcf26c9dc46e24a321ad3077b7fe8d993ad043020a18676f3afc05cadc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037746, "uuid": "7fdfe639-6b22-4933-90e0-aab1b46cdac8", "comment": "Malware payload (Amadey)", "value": "b35183fb01e95c5167564223e68cc1951b09f710", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037746, "uuid": "f01aced3-97a8-4638-bd37-18101e233ddf", "comment": "Malware payload (Amadey)", "value": "d7293758ccb29ad7c4826d44ecd30c11b9bc7acf9b3ed492bc3822b94e147d5b31f0e63dc653623c7c765a77829e064b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037746, "uuid": "df266af7-064a-486d-906b-8a8288831284", "value": "T176F41202A3E84063ECF127B068F607431B397CEA9D74972B2719995E0D727C8A67137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037746, "uuid": "d7fa892f-5693-4273-90b2-798d8c26a123", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037746, "uuid": "c79fb0d7-6b13-4de2-bcf0-bdbfe7a687e1", "value": "12288:YMr1y90w7Ko8T7dKki09+hWrmh2UazcczaonxjscA9fEZEZGm1b1JwiVTOr:dyZ7j8HP9svatzaaxwp9cZEV1bxSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687037746, "uuid": "8bf6ce2f-0518-4939-8543-868ac16be3da", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687037746, "uuid": "15fc203c-fbc8-4d02-b227-61f6ffcf3180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037746, "uuid": "79b17cff-1bf8-4a42-bac4-92cf8eda98ad", "value": "69e71c4d0906d3e553da8526a99ab073.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069bdeb2-0d4b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687032637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032637, "uuid": "2a441d5a-2dc4-4044-9840-6b526af702fd", "comment": "Malware payload (RedLineStealer)", "value": "8375f2d2e8c4099db8405fc5f62d487d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032637, "uuid": "23eb86a0-6f2a-46c4-948d-acad7934307f", "comment": "Malware payload (RedLineStealer)", "value": "9b7d2e77a4cc911aebf94edb77187d1faa0985292c4ffbd4d9a45a355ae41991", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032637, "uuid": "778ee4c0-aae6-49b6-9366-0b6374825b47", "comment": "Malware payload (RedLineStealer)", "value": "7b93d16b382a94ae963c5876e43f80fb8298bf33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032637, "uuid": "7ecd5e3f-bdee-4bf3-a494-ff7f1b1f0fb3", "comment": "Malware payload (RedLineStealer)", "value": "70e7a379f26f39b65fbd660a2d98116e9d6b01ac537c605b7bcc79def9f957e1efb2c31f361c6e44607e82fa451c54f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032637, "uuid": "74d995e3-fa7b-4d70-83cf-91999d51b507", "value": "T1D5C41216BBE85573ECB8137018F646830A7AFCB1ADB8425B2751A85F0CB35C8A971377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032637, "uuid": "97c02b93-67dc-42bb-85d1-599b4d10c734", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032637, "uuid": "3386d285-957f-45fa-bf12-dd606517771a", "value": "12288:ZMrqy90GCoJYgxoxFjRNl0NZHmzgNSWmRfPqjD44egvzYSZLQcV:by/CmYVt0XbSrxCQlazYoQcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687032637, "uuid": "eb0fa203-b799-499f-ac57-1eec59cf28fa", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687032637, "uuid": "28291a10-aed6-490c-a444-b1a4b7a6cbed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032637, "uuid": "ca814a4c-588d-47e3-b0d1-dea25b185376", "value": "8375f2d2e8c4099db8405fc5f62d487d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7d705c-0d50-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687035038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687035038, "uuid": "2ff0ba3d-dc50-46a5-ba0b-700b32bb28ed", "comment": "Malware payload (RedLineStealer)", "value": "9712928ac1daccfc97e85bfd9a66e55d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687035038, "uuid": "812af519-5da9-411a-934c-3d4b1fcbe98e", "comment": "Malware payload (RedLineStealer)", "value": "9beee2d4848622c5bb3686e2a73de440a035a92b902965c051f2ec00d89a0855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687035038, "uuid": "74e4170d-63f6-43a2-87df-3f5414e83379", "comment": "Malware payload (RedLineStealer)", "value": "2b2c6820b39d2c5498edc9da9cc6924739fe0aeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687035038, "uuid": "5968b7ec-976a-4197-8e65-ad6ce0b84745", "comment": "Malware payload (RedLineStealer)", "value": "fd778a1899dcdf7110e831243421f5230cd67a164c091c594088df3de1abb4015d5126287f2dedae7285c32933955ff0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687035038, "uuid": "7084fc7f-9dce-4ef1-afe9-5362f8a8016a", "value": "T16A44290235E0FD24C402087F747A429BB5AE68DFF7D8C4F6126421DB6A572992F7933A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687035038, "uuid": "6723dd90-82ff-440b-8472-40c171668dec", "value": "8b20c0aa1a6b70c064e1b0a2222ddac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687035038, "uuid": "5a84359c-fd9c-4336-8bbf-6f182ac8c39d", "value": "3072:K+djdi3E8H8Cpt/myieubmC1oPj7cmaRp7INH1Kr5w/Exlz1wlt0x+:KR3THjp8evC1oPsmaRp7INMrgExlzKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687035038, "uuid": "8dbbc7a6-92a2-4f7e-ac0e-75ef7b78d72c", "value": 269590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687035038, "uuid": "36ffc131-82f9-4ca3-9ae4-ccf7b3f69cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687035038, "uuid": "56a6e92a-0a97-4184-9148-dfd6fb5075f5", "value": "9712928ac1daccfc97e85bfd9a66e55d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446fb640-0d26-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687016850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016850, "uuid": "191aa5df-1d79-4bbd-8126-d73e546d368f", "comment": "Malware payload", "value": "52c92a98599418bb4056a40fec0e7215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016850, "uuid": "966cf300-0592-41cc-8896-752e58c64ea7", "comment": "Malware payload", "value": "9e2c3deaf8d6d45b7bba16a7d85cb061dbe9af87b3b58f17c0a501cbae04d68d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016850, "uuid": "98f7e6c8-7ae3-42d1-95af-1814e672c486", "comment": "Malware payload", "value": "369feba414cdbd8a5543f8c00df2ca693de296df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016850, "uuid": "e3da78be-5373-497f-bcb5-004408bd4c32", "comment": "Malware payload", "value": "6f47b9f4fcdb5f7a956b64b7567b19578f16cfc6d2780199dfc920e8466d49c73efddcb31a544718bc74a9900293e490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016850, "uuid": "498649f6-cf0d-4593-a0f3-566fbee5749d", "value": "T176625B0ED7EC4287D2DE07399CA30380437AF7B61B135B1E67C961592D233A49396BB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016850, "uuid": "1e727b48-0801-4366-8a48-cc0dc8eae93f", "value": "384:b9VbyW+zZcQVdOU+5BqfnJeFNUXFrahjR79rrN/kgTM:pVn+zZcQVdA5sfJZFwBrN9TM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687016850, "uuid": "bc021509-771d-4fb5-91f1-512c14535620", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687016850, "uuid": "9d865963-ee2a-4047-adbc-1d3f459ccc10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016850, "uuid": "ad1976bc-d897-4b61-b708-6d7074c8702e", "value": "CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f896daab-0d3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687025742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025742, "uuid": "b3b77692-37f8-4966-b06a-35317b306b17", "comment": "Malware payload", "value": "be2a1668352f1be7c355b94d5b942721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025742, "uuid": "f26ab59c-c8bb-4040-9059-b58ac9d34a57", "comment": "Malware payload", "value": "9e53bc6c5fcbb2a32ca55647e429318879a80077aeb83a45f9745fce86e3ff8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025742, "uuid": "4434a9c7-551b-43c1-8ca1-00c80240fa87", "comment": "Malware payload", "value": "6012e12e862862760cd8e507e20621837aa8348b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025742, "uuid": "fd79b8d1-42a8-4499-8aa7-64518805d9b5", "comment": "Malware payload", "value": "b42c2960ef1fff936a7ad5a2afbb42fd7363ee0bd5e4afd678152fd755d413a3ce8f97fe45a4e7a0716121698c155985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025742, "uuid": "3ffbe9bb-b011-4fe3-8243-96852006971e", "value": "T147957E66BBE1C0B7C2633630864E83796675AD704B35478356D12F3B3AB41D2993C2AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025742, "uuid": "e1b1577a-1606-4ba0-9ee9-2f79b43e3ced", "value": "939b027f0ff264582be430f1ae0c8f9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025742, "uuid": "bb145583-d0df-4852-881d-14e206a4840e", "value": "49152:+TiwA19KK3I0ophz97WMxdTAhXIk8qfrg+T40+O4YLR1mVqAAaIR6nlPCyBL:919KK3I/hz99xdTAhXIk8qfr3D+0ObBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687025742, "uuid": "8d495194-41b2-42a1-b926-fac52fa01975", "value": 1882624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687025742, "uuid": "c96c9c89-83f5-488b-976c-2395a1b10c1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025742, "uuid": "3f10aa3b-4ced-4917-88cd-433c88a974c8", "value": "Lerche.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f43d46-0d2f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687020924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687020924, "uuid": "1f274162-b102-405c-9066-82b43ac15f19", "comment": "Malware payload (Amadey)", "value": "768907e3624172ea560e0788bcf7b80c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687020924, "uuid": "18320bb2-4c00-451f-876d-64f8c28c82d8", "comment": "Malware payload (Amadey)", "value": "9ede690d40718ea6d69d8191d139b9e742029b9ee4c69db37526c4d5734f5cd7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687020924, "uuid": "9c213c90-a0bc-4f69-956f-90dddf6015d5", "comment": "Malware payload (Amadey)", "value": "58e5b2e3fc5753a612edbd74d89dee9b9d02f7af", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687020924, "uuid": "21d0916d-6059-4ee3-a0d1-1fad37bae9da", "comment": "Malware payload (Amadey)", "value": "9c41fbf9734c6a58c2bb09906acb8d7d8849a5416d56548e75cd4d9067a513bfcf0451838cacbabe0e3ae45b1c45077a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687020924, "uuid": "122648ee-8a35-41c3-a947-32599d4b5dfc", "value": "T1DCF41263AFD94273E9B4237059F713830B3A7CA19E70976A6A44995F0CB2B84753133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687020924, "uuid": "2eebab82-f764-411a-9b76-82f8b048ce7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687020924, "uuid": "ce183420-4c9c-4f05-8439-ec455f136ede", "value": "12288:CMrPy90Vf1kO8OZzTMuaY8Go0HLZAcbKcZ0o/7hKUDiksoD1:1ye9HkuaY80fkINzRp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687020924, "uuid": "d098402f-3c56-40ed-a037-9a2b4ac91227", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687020924, "uuid": "5d42d424-c039-4aae-85f3-a6e8bebeee0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687020924, "uuid": "fc8b2afa-7b3f-495a-85d9-c0503bdd0a14", "value": "768907e3624172ea560e0788bcf7b80c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075b2680-0ca3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686960483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960483, "uuid": "b1959a48-f960-44a4-83ab-398d0e183a82", "comment": "Malware payload (njrat)", "value": "b2e367c6898a19bdb7e3a2964282c9d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960483, "uuid": "b05597c6-2f98-4d47-aa92-8523911164eb", "comment": "Malware payload (njrat)", "value": "a0fa7e9b5c6734869c7a92761dac887d43b8e9068d936f4b3c28b4650691210e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960483, "uuid": "6f62da79-3bbf-4b51-aa24-5be73274da44", "comment": "Malware payload (njrat)", "value": "0c4facc89b78b4b7aa3c8233512e42a3ad1b9942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960483, "uuid": "2f66f6e1-ce26-4b3c-a68c-650a5a7a8284", "comment": "Malware payload (njrat)", "value": "4dca583119e02c352dff5f09883ce770e21a35167ea016763ca1922ef7511a5896e37ef69425c44558b10fce226f63c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960483, "uuid": "2ec15583-235f-4126-b4d7-f07177c0e2bd", "value": "T13D64FABE76448F10CA743531C3FB43F407AE9D926572FB4A3E843679852A262FC09796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960483, "uuid": "88f929eb-cb16-4839-9b2e-abacbfe364a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960483, "uuid": "7c69e8d6-be15-466f-b818-8b9bacf556d7", "value": "6144:FM1VmhXdxhmGrHuni29vKHnS0Lg32+7HLQLY1:QuhRFHLc2+7HLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686960483, "uuid": "ce454378-1291-41fa-ac28-44cd9f8e68e9", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686960483, "uuid": "2435f333-f935-4ae5-92f8-78227c1dfd0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960483, "uuid": "748621b3-96f8-4812-bb1b-b5bbbbf9ad75", "value": "python.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a470e1e-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985587, "uuid": "478bd337-c81b-4195-93fe-0820731d3aea", "comment": "Malware payload (Mirai)", "value": "3fd5693a6e1a921ce24bd90e77cc1896", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985587, "uuid": "14a5b536-7cf1-448f-85eb-a067a17b86f8", "comment": "Malware payload (Mirai)", "value": "a22acc5035d05a111879a9763f09d8c1dfb6778d65ea59efc99dbdb045681a66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985587, "uuid": "94804e3c-1ade-42bd-9000-0b8dc23f745c", "comment": "Malware payload (Mirai)", "value": "eeb8a2a731a11ff3649474295eaf755225eba4d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985587, "uuid": "e5a62205-cefe-45c7-9532-379b4fa5d390", "comment": "Malware payload (Mirai)", "value": "4a48351f0dbd8206fda7e34c340d5dec65ca2940b9ebba121e7a89b989b3821d202d5d8766ed1361edb3292485715dbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985587, "uuid": "b8105a7b-99e7-4eae-bb50-11c0476ed97e", "value": "T188E30956F8819B15D5C152BAFE1E028E33131B7CE2DE72029D246F347B8A97B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985587, "uuid": "106c2e98-14bd-4638-8781-a8b16d764e47", "value": "3072:b8ni/MYUsUyqqXnJXYrDDaCYIOrKcgqyrCzThKasUz:b8nO/CqXJXKXaejcgX6Toabz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985587, "uuid": "d64b5d7e-b6d7-4c86-9f4a-6bccf7ccb084", "value": 155120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985587, "uuid": "5f2ecf00-7413-4420-800b-fc26d8074f79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985587, "uuid": "330229d3-f66a-4f3e-ad9b-73309f1ffb87", "value": "3fd5693a6e1a921ce24bd90e77cc1896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce3c783-0d5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687039762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039762, "uuid": "56959064-c0ca-4364-9c71-c03616f30ae7", "comment": "Malware payload (RedLineStealer)", "value": "fd90d2719cc760abdc2f91050e495ad8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039762, "uuid": "9b20f55d-a41c-47a1-8bfb-e0251deadffe", "comment": "Malware payload (RedLineStealer)", "value": "a278d11f7e42485f8d7dfbf90be804e509e99bfb44d8a7e262a24df04a0d7139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039762, "uuid": "f89860ae-774d-497d-a710-79678888f935", "comment": "Malware payload (RedLineStealer)", "value": "7c45981c5997703f391cd0c3305fa44dabe45cd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039762, "uuid": "4beedefb-a8e8-410e-aba2-d082b849d7a8", "comment": "Malware payload (RedLineStealer)", "value": "5e24a08ef424eefc6065840f6830715b2191561b80dd0aa6e2a7cfeb4c4030773f9418295bad4b90f22ce02551a7cfae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039762, "uuid": "8e645467-fc1f-4f7e-b7ff-093146f8bb4e", "value": "T14244391231E0BD24D805087F7479429BB6AE68EFF7D8C4FA152420DB6A572992F3D336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039762, "uuid": "6ab61e4c-c407-49d4-964f-840c66894d90", "value": "8b20c0aa1a6b70c064e1b0a2222ddac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039762, "uuid": "8c4341db-347d-492a-9af8-ce0be487bd86", "value": "3072:4N9Rfziks143+baayyNYosZWmEjRLgsmcfo+sNE+HTUr9h+9ylz18Ht0xu:cLiksW3983miRtmcf6Qry9ylzmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687039762, "uuid": "08e48005-850e-4dc1-bf26-71d8400d9644", "value": 271120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687039762, "uuid": "c3ec20cc-dce8-4794-93b6-87381ac6ed8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039762, "uuid": "907436ca-003e-43b2-a75c-18ae8eefa115", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc4b97c-0d3d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687026930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026930, "uuid": "4c343cc0-6931-4e3d-86e0-421a3d086d1c", "comment": "Malware payload (Amadey)", "value": "4e03f03602d6839bdfa984b52a1f485e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026930, "uuid": "db1c8b96-7dba-4c76-80f8-2a3e1a0540f8", "comment": "Malware payload (Amadey)", "value": "a2eebe49ef99cdb63be5f84076c9a5dc04cc91ea1f02055eec666102f6b6c4c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026930, "uuid": "b2d877d4-dd1e-4caf-9581-4d2a7a547f9b", "comment": "Malware payload (Amadey)", "value": "58509074c6982b20a1e52e0d3852c3d01701f2dc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026930, "uuid": "abad06e0-416b-4eaf-b543-61e5726300c9", "comment": "Malware payload (Amadey)", "value": "bdee2435221a02155f3e476a742d620742e714c4cda9ecce11fec790e6805572176fae0df5e911786797b8fdc79bd964", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026930, "uuid": "397d75e3-beb1-42bc-9791-9c364d2b6575", "value": "T10BF42249A7E94473E9E1277048F20A432A343CF08C78977B2391A99F58739D0D5B6B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026930, "uuid": "ec3c2f14-4784-4110-ac88-cb1d6af776b5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026930, "uuid": "e2f1062f-544f-491e-a7f8-fbe75c17d621", "value": "12288:VMrAy90e+zXlyNtPqEFDDsr1Eb87Z5HR+fR71Ricsd1sC07TFY0rwlqR2rvcgm:lyTM1yNtIr1S8d5MfRx5sfw7TW0Z8ID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687026930, "uuid": "61605333-ae89-4dc1-9cc8-7bd7e74e76d9", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687026930, "uuid": "87977221-13fe-4114-8a16-fd325f334112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026930, "uuid": "eb6aad20-0768-4848-aa89-56686e31a353", "value": "4e03f03602d6839bdfa984b52a1f485e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a396f6d-0d28-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687017799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687017799, "uuid": "471d7403-3443-468e-8957-b3ff9bad21b2", "comment": "Malware payload (AgentTesla)", "value": "7cbd0188ef2e297a6c59c9bb02fb2323", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687017799, "uuid": "ad79cd1a-7449-4f3f-ae61-25ae3e22ab91", "comment": "Malware payload (AgentTesla)", "value": "a311a2323e38246b9733d42c4e29619d2d85692c4ff4f99b8cf933f42bd5035d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687017799, "uuid": "e030f0db-5065-4a67-abb6-974b1d9ab6ba", "comment": "Malware payload (AgentTesla)", "value": "da0e5a1c954ec680ad0d53a40dfaf549681ae671", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687017799, "uuid": "ea4a0704-52f5-468a-bb87-4ff168665da6", "comment": "Malware payload (AgentTesla)", "value": "294d4c06bd6ed6564c0350fff83bcfd1d527715d4c7189dfdf9a2350bc62a0e8d35d9cf2a1906772b9813867839f46ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687017799, "uuid": "26e5972d-b653-45bd-896b-48c56c053027", "value": "T16635B33E9CBD42376670C6A6CF94B866F094D3B731121D39A4D35289862BD4B3AC713E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687017799, "uuid": "947c7e1a-78d7-47a2-8223-3d6ff636a233", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687017799, "uuid": "9c0ed10e-d8b9-4e28-b2dd-8c3a82e1c5a2", "value": "12288:VtbcxjxW83xPsfLAGaa+JuyARqK0HLZU0jHbZonpeiM:Kjxp3xwLATARqm07bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687017799, "uuid": "44ce7404-1e03-47c5-bbb6-bdcc38486599", "value": 1137664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687017799, "uuid": "24375347-5e16-43ef-bcc0-254720d562c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687017799, "uuid": "8d10f98e-9bce-4cc3-9647-653f7adb85f8", "value": "20230612_BAON_97xx8_3412.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0069eba5-0ca2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686960042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960042, "uuid": "71000778-3327-43b7-a536-476e5fb5d40d", "comment": "Malware payload", "value": "d24a37cda54268557443774b2a714799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960042, "uuid": "565f10a9-e555-4d62-9350-f920ca924b35", "comment": "Malware payload", "value": "a79b72f3eb7b981e49d7d687d0b80e2a248b5a6fe19a68038887183403fa50b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960042, "uuid": "70427268-43ee-459e-818a-29c7696a3e41", "comment": "Malware payload", "value": "ef76ec386c7695f9d75df7b579269d7680b677b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960042, "uuid": "e5ac3906-a642-40f8-92a1-bb6caad43105", "comment": "Malware payload", "value": "16089f98f6e5ffb7b0bd80a87cdc2d4fa4dd56ee744c54fdcb03aacdcb97e32c44bcded45971627c1dd218feae34fbc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960042, "uuid": "0973a6b5-5e39-4d9a-925a-d5281abd4317", "value": "T1DAE4236BEEDC6416CC4C58749CB7D7A27FA74D50A3C099A4179E74A35EAF06CB80022F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960042, "uuid": "3afb9eb5-c34e-4f91-a51a-391ee5afc981", "value": "12288:8Pvx4Cus3DtAj1WhM4Ysn5zRXNqoJzSn6WKYlDUIw0QeDCuJUrom5X95i71ED+Vv:8RxusT+1WhusfdqoVS6WKwDzw0QECuun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686960042, "uuid": "de0eebbe-37c9-4cfd-913f-dd8de6f84119", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686960042, "uuid": "6ac25b8a-57a3-416f-9c2c-59d48b3b7241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960042, "uuid": "fc93ec95-2e81-4462-aa71-dfa8c7df2f6f", "value": "ChromeDrivers23-061.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c50bde-0d23-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687015517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015517, "uuid": "ff5e8cdc-519a-4f91-9d4f-04b966329540", "comment": "Malware payload (RedLineStealer)", "value": "ccf02f5717a3361eccef61321e633d29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015517, "uuid": "98d1a49a-76bb-42e1-9643-404523e7e62a", "comment": "Malware payload (RedLineStealer)", "value": "a84a517102d26a77dd41d9bbe73fc2f30221b5e841b5997831d30f4c973bcb6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015517, "uuid": "ca677395-28e4-40c8-8cee-6b86bc99e53d", "comment": "Malware payload (RedLineStealer)", "value": "874620e6283cc5350aeac0b7317723d6dbf02d59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015517, "uuid": "08f4933d-195a-475f-bbed-2ca8705ffce9", "comment": "Malware payload (RedLineStealer)", "value": "20a4212cdfe731d45b14b30e3086c16189c0187b9d1f646c0e3b54266294ca40f776496c7947dfe6eccfd26ffcb2e7e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015517, "uuid": "ed6a4be5-282d-45b3-b25d-27c7d2c17224", "value": "T19B444A0231E0BD24D801097F7479469BB6AE68DFF7D8C4FA116421E72A272992F7D336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015517, "uuid": "7f4a5a53-3ade-4f6c-925d-7c8bec47bde2", "value": "8b20c0aa1a6b70c064e1b0a2222ddac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015517, "uuid": "5f2ceff1-487e-441b-939d-f35f6fcd8d14", "value": "3072:S9da5s6CCNUGypR0Hgm6SeqsRoAmgzmkm0GxpSHyQrpbRutnlz1znt0x:CUstC0Seqs7mgzmkm0G+pr3uZlzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687015517, "uuid": "c4d334c3-77eb-46f1-8a58-a7fdbb541a2d", "value": 269083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687015517, "uuid": "ff5bdbee-ab7b-4e70-abcb-6c88d5a10874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015517, "uuid": "81a8ca09-acab-4d71-9b45-feb11dfa2ae8", "value": "ccf02f5717a3361eccef61321e633d29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362a17f4-0d56-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687037442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037442, "uuid": "e5f1bf08-1da2-43f9-b48c-4c070645b824", "comment": "Malware payload (Amadey)", "value": "d92395b08d68078bc9f7539ded79abfe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037442, "uuid": "cae67ba1-5ec0-43ff-b435-d3394b016ab7", "comment": "Malware payload (Amadey)", "value": "a8d458f09e64e73810d4883609484f0eb69d32be5ff3df3953bf5dbd8e91739a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037442, "uuid": "b68515c1-d12d-4358-b46a-93fe8658771e", "comment": "Malware payload (Amadey)", "value": "92a1803aa48331efda302c7fb075f6efb5666ef7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037442, "uuid": "ed09b1e4-d7e6-4ae4-93be-c3a12e938d37", "comment": "Malware payload (Amadey)", "value": "d9a984ee8d0fb6a1db168262985bead368595403d52b7375f34840616b5a2876283f5748be3d896abb789796a6189b65", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037442, "uuid": "ecf90197-037b-4c94-93e7-cc20aee94921", "value": "T19E05221BEBED8023DDB8177508F20B831E357D611E64872B3782999A6D732D4A83173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037442, "uuid": "747c9591-e78a-4e84-983d-48090286a856", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037442, "uuid": "82699a90-2b91-45ed-98ab-1cb0fdc23789", "value": "24576:iybXWd6/zp1a+dcwLtr34yAG/PtUv5QE:JjW8/zp1aiPLtEyHPtUv5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687037442, "uuid": "1825e75b-80ca-47ad-8c04-887e2d7a1851", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687037442, "uuid": "d5100afd-ffd0-4653-98ed-9a8d891199c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037442, "uuid": "11f7a39b-a99a-4991-aa19-3ebe5924939f", "value": "d92395b08d68078bc9f7539ded79abfe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e6814e-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687045494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045494, "uuid": "95e55dc1-6580-4f50-8ea4-4373fe837039", "comment": "Malware payload (Mirai)", "value": "f8ce58423efda2128cfce92fa170a761", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045494, "uuid": "856fd7e9-1a54-4d5f-8b99-caffef8215bc", "comment": "Malware payload (Mirai)", "value": "a91e4e2ee5d7ac3380dd2923b41d88e20f5d757aa14c1de4acc5d9fb930ee1fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045494, "uuid": "80d74dd2-ad0e-4a2c-9ab1-19cc6c734d29", "comment": "Malware payload (Mirai)", "value": "7dd7a14cd29329cb7305f47f5f3b77de3eed09aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045494, "uuid": "f3230ce0-8845-416d-97d7-a0b92d543228", "comment": "Malware payload (Mirai)", "value": "dad3b7473f37cbc460ad7147a959dfe1a43074a3e22865094e0393a4bdeb45980ed17cc48bf3404ced1c3370869dd974", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045494, "uuid": "e007fa5a-1e49-4659-b379-49118645ce1d", "value": "T1B3D33B46EB418B13C0D61779B6EF4246332397A493DB73069928BFF43F8679A0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045494, "uuid": "e9dab94e-c24b-4510-9e7e-4f1dc0041945", "value": "3072:TNyTMSxpF8c5BaWvJJpDYL4n8zxp2ip/g2H4s5KM/9SCY+744b:TNyTMepi2BaWvJJpcMn8Ga/g2H4IKM/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045494, "uuid": "f1398e9e-3ee8-4ae4-8ec6-013afd408cb6", "value": 139944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045494, "uuid": "2f78863c-7294-4eab-8cd1-31d5577a3c5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045494, "uuid": "190a627d-c7ce-4c8b-ab78-fcc4a62ea855", "value": "f8ce58423efda2128cfce92fa170a761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f3084d-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045444, "uuid": "0697869f-2867-4854-827c-06a6f3d644a8", "comment": "Malware payload", "value": "524ff1443e4c9b45f39653add041a19d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045444, "uuid": "306ab64e-e50d-4af1-bdc9-9ea82c07852a", "comment": "Malware payload", "value": "a9657f76f4ae28416be03393428370373f693e3684247bc1f7a9ef771f3b85cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045444, "uuid": "ef68dddd-4fff-4201-92cb-8f0f40143088", "comment": "Malware payload", "value": "ecd703c369809ad67c6d5ded65de3bb6e77e4456", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045444, "uuid": "a4fad303-e275-47d7-9cc2-c0ff4ccf2da6", "comment": "Malware payload", "value": "78bd5cb1f99116912134fb152a1e93c8456c335383455b81b416cb21b6e55a11eb3c6a0de637fba654ba927ded82968a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045444, "uuid": "f38430f0-2ea7-469c-b533-2d0f010a8570", "value": "T105433A21BA760E17C0D6A8B621F74B25B6B143DE26E8C60B3DB10E9EBF715406543EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045444, "uuid": "4f23629e-6573-40b7-9bc7-92623512b751", "value": "1536:tidYXhVfx2kCWDbrAmiAQ0975Bdt1RqlaH:gdut979VVqlaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045444, "uuid": "7bde055e-0273-4c07-a097-4e5cc359e0de", "value": 59472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045444, "uuid": "a116f9f9-ef4d-4f63-a7f8-a2b2d6f8352b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045444, "uuid": "c0df0c02-2fd4-4d6d-9f0e-f4884e76331b", "value": "524ff1443e4c9b45f39653add041a19d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5542948-0ca2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686960372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960372, "uuid": "584fd2b0-92ea-4e78-a224-3158497c670f", "comment": "Malware payload (Amadey)", "value": "3b692cf7ed2d7bc525aee33e06d6cd85", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960372, "uuid": "76b18fa6-7fda-4d88-a1f3-17bf9690e890", "comment": "Malware payload (Amadey)", "value": "a9aa330acf2b797a439459579927510f45b78af32070fe5fe9005af22f085806", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960372, "uuid": "0c8a3efe-ca7d-403c-af97-c763e3181402", "comment": "Malware payload (Amadey)", "value": "c62653f0b1945ce5da6d256e2a829669523e43f5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960372, "uuid": "835f669b-b1a1-454b-ad21-61afcea95449", "comment": "Malware payload (Amadey)", "value": "1576ffee22cc191f54a1a891d52da71f70d48f7e2e0108605a061ff01e4fd77f0f590bf39692ec869e99b022c22ba1db", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960372, "uuid": "245cf67c-7cd0-491a-9a8d-2077f906702e", "value": "T175D41223A7E99632D9F9633108F607930B36FCA54A74C3AF1784585A2DB23C4A572737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960372, "uuid": "c5833ebf-1725-47a9-89e3-26c1fde4522c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960372, "uuid": "7a776b3d-153f-4e5c-867b-82045510f1a6", "value": "12288:EMroy90N4S6u3nEuWcx7I+MbMA3Bf4d6G4krH1wobMuY:syK4SRckI+Mbz3BAdgkL1w4Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686960372, "uuid": "98b589b5-2dea-47f1-9eb4-9653f0c0031b", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686960372, "uuid": "c552c33e-45b2-4624-945e-67aeabf7bfe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960372, "uuid": "d13239d2-7029-44be-bd87-640d9f90ab63", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce3198e-0d5f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687041345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041345, "uuid": "f60a1c92-03d9-497b-99b6-e665b2568146", "comment": "Malware payload (RedLineStealer)", "value": "4fc7d78a4c319b7d8da65ee93906c421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041345, "uuid": "4f62fed1-1725-447b-8f38-bf98f1198f7d", "comment": "Malware payload (RedLineStealer)", "value": "aa71dc06308768bf3bdffb588b1d9c1c0acf592019ece0b7eb63142795749918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041345, "uuid": "0758d651-690a-4688-9152-2005e2a5873c", "comment": "Malware payload (RedLineStealer)", "value": "ee63c12f9ac7b61190b39881cd540b10e8812877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041345, "uuid": "79b1f42d-2627-48a4-9ec3-151321307841", "comment": "Malware payload (RedLineStealer)", "value": "84123f63abdfee9413d85a0b30f365f8ad85e614925ab10cc07a4dc4230631b98dc7fd8365f81ba69d77a572a7ba8e30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041345, "uuid": "b4941003-f973-450f-9d12-8202804c2ee5", "value": "T118F41213EBF44032E8B9577068F203C70776BDE00DA4866A2785A92A0D73BD9E935377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041345, "uuid": "20c6fce7-c76e-4e0e-8de5-f899b7ba4951", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041345, "uuid": "04d7be38-4604-4c25-a27e-4e13cfa32035", "value": "12288:nMr1y90/gy9w3D35QhG2zVAJQg+/g6qPTiWQze80l4Ev/pDFBvVy8i7hr7x6xu1Z:6ymgy9wTJF2aun41K5foD5yp7hMxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687041345, "uuid": "f9b59ab7-b802-4648-b83e-29ae3e9838f3", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687041345, "uuid": "26fae67e-f277-404e-8e30-81cdd73fdc12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041345, "uuid": "b928110e-f02f-4c30-bec2-dbae8e5104ec", "value": "4fc7d78a4c319b7d8da65ee93906c421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305468aa-0d15-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687009515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009515, "uuid": "a4fb5835-d51e-4426-81b2-339a01f51657", "comment": "Malware payload (Amadey)", "value": "8c0bfc76036fb7756fe7782fe8ff5218", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009515, "uuid": "ce2289c9-c77a-4ad6-9035-58a57193b2f1", "comment": "Malware payload (Amadey)", "value": "ab0beb85685ee66680b5a312b06eb2266b8b6b90b3146083d13dd02f7db42f63", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009515, "uuid": "0281c818-e776-427e-9d23-c6c0440849b4", "comment": "Malware payload (Amadey)", "value": "2041d3a938c83a318def8c5a236cd09484a07ab7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009515, "uuid": "24fa7bea-c2f7-466e-ac9f-8101bf5bdbf0", "comment": "Malware payload (Amadey)", "value": "84d2e4b147adeb0122980d06e2a547286993d3639234a0d205932acf77ef6624d4655bde1c39fadbcf915f6ac2d322d1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009515, "uuid": "c8905b8a-7a4d-4193-b381-d3624d27c6e2", "value": "T1CBD412126BF804B3C8B527B068FB11C30B36BC956A74835B7311AD994AB35C4AA7573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009515, "uuid": "aaa09052-c35b-48ce-b5b2-f427f76c2ec8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009515, "uuid": "a2ee7444-52fd-4f18-a66c-cec7890b5a28", "value": "12288:NMrqy90Ste95jOuz8HIQMwQszUOrj6xBePDVUcQbCl5sM4cT/cSpK9V:jy74AIQMt6p24D6IsfcT/cSMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687009515, "uuid": "a581db30-4fd6-4710-9f84-2a72040dc04b", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687009515, "uuid": "b92dd660-8e3a-46d4-bd88-371fb5900f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009515, "uuid": "ecaf646e-30b9-4972-a825-229e51754d36", "value": "8c0bfc76036fb7756fe7782fe8ff5218.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09833a82-0d24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687015892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015892, "uuid": "e963e8f8-d741-432e-8177-74d298309854", "comment": "Malware payload (AgentTesla)", "value": "75ecef0987bb65f60e18663e7d6ce9c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015892, "uuid": "735a344b-9e81-4bbe-b0f2-e7d9f7a21059", "comment": "Malware payload (AgentTesla)", "value": "ab3230837e2bd9c05f2046d480cf1d789b97d1d06c545f1b39e1fb0dcfb1e1a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015892, "uuid": "30ab6ad1-a253-420f-8855-15ce763b21d5", "comment": "Malware payload (AgentTesla)", "value": "00479df336289454df6dcfd51c160ecc966744f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015892, "uuid": "a1b01def-d09b-4d65-a6cf-9f8e13e8172e", "comment": "Malware payload (AgentTesla)", "value": "7b69150e8b24330086460b2de64cc245ad892bdf304348926384716a510c9d76ab3c719262df44e237b0aa12f5096e43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015892, "uuid": "4b7235fd-f733-47cd-91c9-6adbb48c9ad1", "value": "T144F412849AED5716D9BB1BF4946051344FF2F85FA536E31E1E42B0DB9A23F014A02B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015892, "uuid": "051ee09c-4113-4a7c-b5b3-2c3df8b0a3d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015892, "uuid": "f9a2f898-0dcd-444c-ae62-d02cdb145ffe", "value": "12288:N0jnABUeJnFm5ZWNuaGagriwYDQHmq7ju7gxu5lKEXqXdVw7:ejAioFgkcaFVwmqv1xu5s4qXdVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687015892, "uuid": "1dc3cce8-a437-4030-8f8b-dcb115fe4399", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687015892, "uuid": "f07f0629-457f-4812-a0e4-fc05f9dd9e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015892, "uuid": "347214e5-2e8a-4aa1-b2d4-ffc2efbbb6a7", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a9d4e0-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985579, "uuid": "11e15c74-1581-487b-9104-f82e21fb7d11", "comment": "Malware payload (Mirai)", "value": "0ee0cc39c5562f56648ee53c60d3b3c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985579, "uuid": "8d80f90f-2f63-46f5-a997-9568585ff3cb", "comment": "Malware payload (Mirai)", "value": "ab8118b0d66641be0d70d8f799e6e54d1b73e7c0346aa3c33fa2306674f3b39e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985579, "uuid": "17de19ba-90f2-4c7e-89f9-2be9b268046d", "comment": "Malware payload (Mirai)", "value": "d684cf21389543c3ca6674d2f72cac6a1853382c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985579, "uuid": "43356323-c178-4745-a1c3-78dea195cb3c", "comment": "Malware payload (Mirai)", "value": "95c684b0fea31136e4ac1bf45274349fd50ecff29cd0a86944b5183144092e6e7171f74be0544acdce54f876229d2506", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985579, "uuid": "f4b5f91c-7511-4865-8e40-565d50d550f4", "value": "T1A3F2E015EA5DCA45E46F34367EEF1F8D5420A16E43A446A6878C3DBFA60FF087921341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985579, "uuid": "4f1403cf-cde4-4d85-9258-f38a526741d9", "value": "768:RIIuDmEMV50zW474rohWIrEmmk8UrF9knbcuyD7Ufyq2:iDBy4jWIrEs8mF9knouy8qq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985579, "uuid": "d3160644-f6a5-4384-b1d1-88edad9586d8", "value": 34976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985579, "uuid": "45983050-ffdd-481a-bb34-88cfa02a1615", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985579, "uuid": "4741c5b5-b954-41db-a4b5-6dc4948ed6f8", "value": "0ee0cc39c5562f56648ee53c60d3b3c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966e9ff0-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985634, "uuid": "e42c5248-9f4b-4a70-84bf-b465e881ddeb", "comment": "Malware payload (Mirai)", "value": "5e7b37ee6370697cf078bf13cd34d306", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985634, "uuid": "92693bef-55a4-4ce6-be8c-75b30c26ad78", "comment": "Malware payload (Mirai)", "value": "abb2d9e416343e55d897751c8b3c24af54990b24ad49f818e2b949931ad3e0f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985634, "uuid": "e92668b2-c0a1-4f1d-91dd-cfd6ba4cfc30", "comment": "Malware payload (Mirai)", "value": "b1c490c30328b2f1a4800ef093cefc2c91e52869", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985634, "uuid": "95229fa8-61a9-4598-b26c-dd0e9756afee", "comment": "Malware payload (Mirai)", "value": "954184cbd71b04b427e7a8321273b5f7d3553cb7fe426baaec7c670ff68118c36bb19261c04dd2a112f7fcd3b1601245", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985634, "uuid": "615d7f70-cfb8-44c9-a577-c82a3b2d06f0", "value": "T1BDE2E128E1D049D5DBBFB1F01F98E7D1A7F26ADA03679DF222E4FE42AC940200415AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985634, "uuid": "8bc3945c-4fda-4d65-8b56-6c0e391eb0e0", "value": "768:joaTmv9U2PWTjVrndECmpWH5G+r+VJF083RY4uVcqgw0RTWXK:joaTmv9kTjVZtXDr+VH08hY4u+qgw01J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985634, "uuid": "6ec43f68-b701-4d66-9d93-6dd9f57055b5", "value": 32184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985634, "uuid": "b6db2ae9-6d3d-4832-b68e-c09a251c19b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985634, "uuid": "0a42235b-d440-4c2b-ba98-89361e7b4267", "value": "5e7b37ee6370697cf078bf13cd34d306", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e6afb5-0d13-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687008912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008912, "uuid": "89425ec2-373a-4e1d-88e7-4641e3d35e59", "comment": "Malware payload (RedLineStealer)", "value": "6158491c55c59e56f19a62f04f314935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008912, "uuid": "ce18c134-9373-493f-99e5-0e25624b0bef", "comment": "Malware payload (RedLineStealer)", "value": "abeb7c5703055d812a6ec24cd8584e63cef4df723ebd33f3f9b7a133cb72507d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008912, "uuid": "9776d01d-90b8-44f4-ab4e-3f6b8ab0efd9", "comment": "Malware payload (RedLineStealer)", "value": "1ce3aae5e6161faa55acf70ac4625ebae30f9438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008912, "uuid": "da6e099c-314a-44fc-a7be-b488c29897b6", "comment": "Malware payload (RedLineStealer)", "value": "24b71075fedfbca97488dd6c753480b5ccc042badc6cbb427e6ee1ed6779343b8df9b89fa3f222547984bb3ca237290a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008912, "uuid": "94fe956c-af4a-4153-b3b1-de9679cdc690", "value": "T1F0F41317F6D99073EAB117B04CF6038F1A35BCA2D9795627365AA86F0CB26C06532337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008912, "uuid": "064cccde-aba7-4d67-a69d-84c6e6152794", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008912, "uuid": "d5d78f57-0609-4d76-8e0b-76639ea8166b", "value": "12288:3Mrvy90K4k8hy629nI1nfbTxXCpiXBqpSzQLwY48SOan2t0tsIV4JeLsChNLF1:AyT4kK29nI1fbTxDXBnY6St0XeeR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687008912, "uuid": "d7c57ef4-c42a-46d6-9e26-76253d51691f", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687008912, "uuid": "331edb8c-b9cc-4d41-a918-5be3bd54c927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008912, "uuid": "4a4b02e9-d2c8-426b-a2da-903ed6a8e75b", "value": "6158491c55c59e56f19a62f04f314935.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dbc98e-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985571, "uuid": "2b45a4bf-c9d9-45b1-bc5f-b5b908a551b2", "comment": "Malware payload (Mirai)", "value": "1910814e602cfe482aeb1b5e1449c8ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985571, "uuid": "71e69ba6-5f5d-4e8f-b16f-ac555d192c19", "comment": "Malware payload (Mirai)", "value": "acfc6236ee8b915e55f0158a5e05801481588c4f1984617a1d5998f9ff9a06ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985571, "uuid": "e7faa6b2-a7cd-416f-b4ae-c04bc6e8a322", "comment": "Malware payload (Mirai)", "value": "cc9bcab9566b904d4aaf9781bb2f79267fdfbf12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985571, "uuid": "1320803d-eda6-4316-a8b4-1988f5089912", "comment": "Malware payload (Mirai)", "value": "b9e17f27c9970319c735f97ab8fdae1718b1e58347331bc0e00bada54ff2a91c4105831cb5d497c5e52abe5839b0f33c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985571, "uuid": "489c0741-f8e5-4d58-a883-dd04dad95bea", "value": "T1A0030892BC92896BC6D023BABB7E168C33A373D8C2DF7313D8141714668695F4E33A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985571, "uuid": "68ba65b9-81c7-4acd-b51c-c869368688fe", "value": "768:3/eOy/kIhP6TuMG55Gxq3CJfzUxfjPaVzpURDFFoos6oaLtvhBPRrz5Lce:P9IhyTZG55xSafTaV6RRFTsaJhxRrB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985571, "uuid": "c8ddb376-fda4-4fc8-ae2b-7b91521afca7", "value": 40612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985571, "uuid": "114d158b-dd4f-42e1-8e3f-63b032e14fa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985571, "uuid": "b11816c0-35cd-410e-8322-82ac3b363753", "value": "1910814e602cfe482aeb1b5e1449c8ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a39972-0cce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686979162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686979162, "uuid": "14e0e0cf-f3a5-433c-8cda-b0e0b0a481a7", "comment": "Malware payload (AgentTesla)", "value": "bee428f2c0b4c99e53ebac93a7662f6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686979162, "uuid": "7c503a8a-e6aa-4fa7-986d-71a9e5e87013", "comment": "Malware payload (AgentTesla)", "value": "b0d9e970a53d36e3238693badcb386b0a7b3abf5331cb9b641f5c606899ce8a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686979162, "uuid": "63b1e183-4795-47db-b41a-54f342f52d94", "comment": "Malware payload (AgentTesla)", "value": "45e6a1e053bafbba2e1a1cd2312e7cd4a3eb16e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686979162, "uuid": "3ed4496b-c93b-402e-ada7-cca79222153d", "comment": "Malware payload (AgentTesla)", "value": "82fd7391dba8a99b706dae5f7822a3392ffead5b201554dfdda5d2eaeffc3305b5d80c473a2cf8220a6ed4348188bd39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686979162, "uuid": "916b5ae7-ebc7-4487-abc3-c69347605b41", "value": "T12EF402589BAD470BD9FF27F4617045300BB2F95BA53AE35E0E81B0D66A62F114B02F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686979162, "uuid": "3921d3fa-5995-42cb-ba83-15f2d7099377", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686979162, "uuid": "2f1b7007-50b0-48b5-afa3-1b56a58522f6", "value": "12288:nboy0PFK+iGds+A4rUVo6FfjEOn3R85KDfIatmRPm76yREXqXdVBd:ns3FKXBV4rULFozKDfIaMMx4qXdVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686979162, "uuid": "441835be-96db-44e4-a880-9dd93bb4ed6d", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686979162, "uuid": "3f647711-b73c-4aa3-8c70-9b3bea63d1af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686979162, "uuid": "3faadbfd-abb7-4961-a1af-7e63fb21ee67", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4cd830-0cf6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686996170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996170, "uuid": "c88214d6-7312-4d37-9709-1fd562a9e6f9", "comment": "Malware payload (GCleaner)", "value": "be696d46a7cfae7c25780cd433aa71c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996170, "uuid": "ace6c03b-36f4-4db0-b4e5-28952be37896", "comment": "Malware payload (GCleaner)", "value": "b212e09c6a9489428457a39c095f11a459f2975f460f65419d884adac506feda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996170, "uuid": "fe52ed0e-c535-497e-8763-97d64e5ff656", "comment": "Malware payload (GCleaner)", "value": "e7a0ad9520cfb3be1f85ef2fe07fd74bc180e790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996170, "uuid": "03ad6d12-a9cd-4841-9e24-8ff4215eca58", "comment": "Malware payload (GCleaner)", "value": "1360ce35d02f6eaea3a655809e22702b7a8eb1f71d6b763b59606a111d73067873f3310dcd74382f77b2ae80ac8fcd4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996170, "uuid": "770c55e4-a466-42d6-9848-488751fd9b7c", "value": "T17A842943A2F23D54E975CF329E2F86E8361FF6514E59BB6DA118AB1B04B11B2C173321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996170, "uuid": "143ac026-cce9-455e-b8a1-df4e75ccc65c", "value": "fcc5ef716ee1fee9b7ffaf9728383a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996170, "uuid": "9a14c09f-761a-4000-a748-f1abffc54e39", "value": "3072:x3L3dWVTrZtsZXT+rV7CrrUPUyYVEl4Q0bp1QTkcBBRR/uQ5qvwh5TY1r:jWRZCZyrVWqUBXcB/guBY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996170, "uuid": "71e3faa5-3560-4bf2-ae19-6a845981a9d3", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996170, "uuid": "22f94a38-e143-4658-b2d6-e42d96e046e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996170, "uuid": "36ec3d50-da81-4f95-b262-004b4e2e5fbd", "value": "be696d46a7cfae7c25780cd433aa71c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b2b7eb-0d56-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687037741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037741, "uuid": "82e9ae04-d0cb-4d9e-bdd2-4aa440ea70e7", "comment": "Malware payload (Amadey)", "value": "11a31b694d2ccdc1d32e87d4160def83", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037741, "uuid": "e724ef10-f5a3-4dab-9a13-a67825b5c967", "comment": "Malware payload (Amadey)", "value": "b2bbe78f87734dc66c8c8096537ef1f8d85050d576446558f32ec7ca12d00c37", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037741, "uuid": "1f795ff4-16e5-454a-97e5-4238d2b33a00", "comment": "Malware payload (Amadey)", "value": "fe79b5d2a9a4c6fc5052d73601efc343f5294fee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037741, "uuid": "c6555664-39f5-4982-a1a7-c54fd179c8be", "comment": "Malware payload (Amadey)", "value": "afe53ed03f59c2db92eeeb44fc7d45b9c923738cae80282ee21c67a0dd02e617387c1f3085e8e37d1ebb900af235a6c6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037741, "uuid": "174cf446-b7aa-4efd-b97d-f9427bb504ff", "value": "T19AF41246F1D89422D8B01B7818FA07431A39BC915DB8D35F2B96A80B0973BD4F535B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037741, "uuid": "7d93f5fd-6c27-4f26-89ab-e8d2b0c63818", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037741, "uuid": "0e1d91e3-c7fb-4c11-b957-a7b4a755d78e", "value": "12288:iMrLy90VKeGsUumvxpPcwMJn1sAvCR89uV3y9FO8gsK1rBriApfEir:xyveGs4vTcNJuAvo89uVCip11riGPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687037741, "uuid": "d47cf082-1180-409f-bac7-2ef94842071c", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687037741, "uuid": "e86494b4-bc88-4449-a449-aab0cd783eaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037741, "uuid": "3219610c-2075-42c4-840a-dda443841700", "value": "11a31b694d2ccdc1d32e87d4160def83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7363ad6c-0d08-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687004044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004044, "uuid": "6b389f61-50ef-4fa5-b6f0-c7ab4cafb85d", "comment": "Malware payload", "value": "c812fe1d9209739cfc047d54a479d0dd", "object_relation": "md5", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004044, "uuid": "4b301f3f-7966-4554-a296-5bededb7bcd5", "comment": "Malware payload", "value": "b3cca8abc7da7ce5a805487829ca73fd9d318914295d80116cba9d3eda6ba887", "object_relation": "sha256", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004044, "uuid": "1e4369f7-d2bb-4e13-be29-5560d9e3d4f8", "comment": "Malware payload", "value": "f5ffeb6dbe1f7280119afc24073c9ce7f585f559", "object_relation": "sha1", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004044, "uuid": "270a0303-4df5-4acc-aec6-adbe537bb7bb", "comment": "Malware payload", "value": "f7f1cc0e395962b580cf80a45ce7efc53455d205110f4d763027a9405dacae456079f3655c2b696eacfc201426c73652", "object_relation": "sha3-384", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "promotores14-duckdns-org", "colour": "#CE43AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004044, "uuid": "8683f157-d08a-46be-a4a8-4e54b8fcd501", "value": "T189421B1997C8E63DCDBE0A33E81326410771C5C49A5BDF6B91ACE5251DE33CB0993B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004044, "uuid": "8d12ccfa-ffe2-4d79-b1d6-433321323de2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004044, "uuid": "6481f3de-a350-4c85-99a1-75bc6f6bace4", "value": "192:JPgqlQEW0Bc47gJV01IUv2aGOsqq1Y0ShIW1vUsBZeDkOj8c82lHPK+VT:Wql5Wcc4UJS8nVY0cUsBZeDF3lHPK+VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687004044, "uuid": "c24b8799-9ede-4b10-b7b1-1510f7e832a4", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687004044, "uuid": "cb986e42-d70a-42bc-8c37-424b416f6acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004044, "uuid": "93f9218d-477e-4b2d-b2ea-1282fd18d178", "value": "KoAOkX.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec17163c-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045478, "uuid": "a440d77f-d8d2-410f-94c5-e2b5186fcd55", "comment": "Malware payload", "value": "0c0e004d06c7d99218abc81feb4a9fc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045478, "uuid": "6c0add1b-75b7-4dee-9379-cca56ae78811", "comment": "Malware payload", "value": "b5373cd13c76628c1f1382890f7b36421c685f211917898ed51b6efa387899c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045478, "uuid": "03b7744e-b0c1-4bf6-b55f-5228b74fe074", "comment": "Malware payload", "value": "54897d9cda06858d1c7a53a8d5e439ecb85670cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045478, "uuid": "8a2bc4b3-47fb-49c2-a545-d6c891b7dbbe", "comment": "Malware payload", "value": "72a7b9383a96ae9468372a86b14f29cf11fd09f881923b0bd6abbc24b6e962477092233d7d399884c5204390aaf023e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045478, "uuid": "d5a2e4da-20b9-47bc-94fc-b8d00fa2b5a4", "value": "T1EED35A73D8296E68C564D5B4B024DF792B53A69181472FBE29BBC2B48083CCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045478, "uuid": "67020a76-4fbf-4d43-b3f7-342a70dbd9bc", "value": "3072:hWU4h4MCVFmeFOWxCm6OD09JWTk0EgXJGN:hWUmKVQecWdEUTtXJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045478, "uuid": "70ea2e41-4cd0-4176-b03d-0b16de3b1a15", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045478, "uuid": "184f2caf-e7da-46e4-9d79-7c3753318e82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045478, "uuid": "acf63de0-7a12-4092-b662-3ef9cab32c77", "value": "0c0e004d06c7d99218abc81feb4a9fc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b077830c-0d11-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687008012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008012, "uuid": "a9209b52-ae66-4f1b-9539-2532565728bf", "comment": "Malware payload (RedLineStealer)", "value": "ae0b6a05d983b6b14cebea2d1517acfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008012, "uuid": "95906790-7512-4b55-b0ef-c48cfb5ae3b8", "comment": "Malware payload (RedLineStealer)", "value": "b5a399ddb6c2ba1ee189578a55c71d2e25ce0f128eda1579b9a30502adb2dbad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008012, "uuid": "2da67129-59ff-4417-a424-e0c98b9de84f", "comment": "Malware payload (RedLineStealer)", "value": "48488f0e1e9a4069616e4acf07f4120257c7e700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008012, "uuid": "d43bc70d-9cc5-4d8a-b4e2-0fe401f1b7a7", "comment": "Malware payload (RedLineStealer)", "value": "86d17be784821aba25693fe81e542c592c7922bcf62e47a00fa5de4c723f220674b47c9839a0bbe02f82353bedc3531c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008012, "uuid": "933165b1-ccae-4310-9149-8407b37f413c", "value": "T1E3443A1231E0BD24D801087FB479469BA6BE68DFF7D8C4FA152421D76A172992F3D33A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008012, "uuid": "67a6a95c-11b4-40b6-afb8-d6d24fc68d04", "value": "62ca1c062d90bdb91f15836e5741f560", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008012, "uuid": "7afbd364-3340-471b-b087-6a6ae944c033", "value": "3072:KI44CdXdCayALyxR0Hgm6SeqsRoAmgzmkm0GxpSHyQrpbRutnlz1ahAx:1qDytSeqs7mgzmkm0G+pr3uZlzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687008012, "uuid": "a23d0453-2bcd-4d7d-98d8-2057d82b4c65", "value": 274563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687008012, "uuid": "bc320a8e-37f1-4070-bfd1-0dbda1f0dff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008012, "uuid": "1ac0865c-3eed-45b7-81d1-e2846ed38e8c", "value": "ae0b6a05d983b6b14cebea2d1517acfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db672db-0d54-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687036622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687036622, "uuid": "ecde31c3-bce5-413c-a326-45544b49b8ad", "comment": "Malware payload (GCleaner)", "value": "1e49573d0a13facb3758afacd2ff36fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687036622, "uuid": "9ddc5960-96dc-4f01-ae1d-1455435973f9", "comment": "Malware payload (GCleaner)", "value": "b6140ac8bac8defcb5a9ed1525aa3dabe86801373e7f9561a086b25c8358a01e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687036622, "uuid": "2c6f9862-5f45-4d64-b01b-9ac86fb9db80", "comment": "Malware payload (GCleaner)", "value": "1ea2d710c09a0e50c2e0d3483b595fe86142b1d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687036622, "uuid": "cdb656db-c625-4b2a-8f83-00abe3306961", "comment": "Malware payload (GCleaner)", "value": "de26ecad2036d53b72bf4b98ef0fdd8a601348b794592e2726fa772df7dc8e76d82645b237b0a8ff505803c940cd4118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687036622, "uuid": "50d3c280-59dd-48d4-984e-527273ff58f6", "value": "T1DEC53393C36288B1D4638BF0BE375A248B57BE7669370048339DB56C1B772D20C9A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687036622, "uuid": "efec59f6-3549-4040-b81d-6e758ca3cc6a", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687036622, "uuid": "ac579c5a-c1a6-4b05-b01c-949fe1fe22aa", "value": "49152:s6dKT2swK/r4+7y66TQT+RrqJ85xERdUwT5nUJd/V8LEenwDOZ:LdM2UvqETEqcytmd/V0EtDOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687036622, "uuid": "ed9a8468-058b-4ec0-b736-3a6eccd6882e", "value": 2599736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687036622, "uuid": "2143ae4a-0ddb-48e6-9a3d-7e8874cee0c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687036622, "uuid": "591d4c71-93d7-4695-97be-2636878a18c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab94191-0d56-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687037745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037745, "uuid": "736b5cd7-e9ce-42fa-8df3-03b08d0a99e3", "comment": "Malware payload (Amadey)", "value": "1c057a6085207e1edbc8b965ce96be88", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037745, "uuid": "6a4d1264-f7a8-444d-8109-2b2185a6bb6c", "comment": "Malware payload (Amadey)", "value": "b6515d33c444e4c201feb0111927e260ca6ec188fef7abe26052f4af9e560b48", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037745, "uuid": "a7d644c3-518f-43a1-ac3f-e51a5faace93", "comment": "Malware payload (Amadey)", "value": "a5abfd8b36140403c6d95583b840fb59395ab46b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037745, "uuid": "3c6bd772-ecf4-4dae-9775-7fffdee99c82", "comment": "Malware payload (Amadey)", "value": "42ff5e7c1629e8d3e9b2d948e6e9b8999a9df9ad70a73cdd3c1c61a6389338844c09c7e6b7ef8a325cbd2d2083177ae8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037745, "uuid": "ac9d0910-18b4-413d-a019-38825e430694", "value": "T1330512427AE48466DCBA173068F517A30A3FBCE19D7443AB3781B99F1C721C065B17AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037745, "uuid": "3588a62f-b1ff-4ffa-aa60-9a0fee17996f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037745, "uuid": "22c43fef-9ff0-4d06-b4da-7264c484f6b7", "value": "24576:Zypwo9IDzHqj7iBMMKbK+JgbCkSaw+9Kq5C/jYVJ:Mpwo9In9SHKfbCk6krs7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687037745, "uuid": "f2bad2da-77da-47a2-a084-5c3ecd8502f2", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687037745, "uuid": "9060f43d-e577-47a4-a341-c71d9abedba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037745, "uuid": "4af13b0b-6080-4b5d-ab20-3893cae50b2e", "value": "1c057a6085207e1edbc8b965ce96be88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8505bf35-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985605, "uuid": "2c023b1b-875d-49be-bbd7-c33f8bacc720", "comment": "Malware payload (Mirai)", "value": "6d59a3081855e3cc6d67a85a61ea1b0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985605, "uuid": "1c36b4ec-1ae3-4b95-a2bb-0c2542d918e7", "comment": "Malware payload (Mirai)", "value": "b67a72b1fb58190c17ba12621003977d3ddceb2e0c6c49d48b3f2919db57218a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985605, "uuid": "10a87aaa-7e33-4034-a4f9-cca536f97aa7", "comment": "Malware payload (Mirai)", "value": "7bf57b0153a85c0c0026d74089642c33b636f2e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985605, "uuid": "50738e35-a2c0-4cd6-a17e-5ff77de4b12a", "comment": "Malware payload (Mirai)", "value": "7595d8aa1494ef3953cce3aebaacb2701873b4f06d36ee570bb058e126016e5a063554722c7af642feee48a7dbe8c0d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985605, "uuid": "b92dc359-35a1-439c-97ce-c80f5b0e37c5", "value": "T15F430224F88AF5DADEF04C33D8544256B5A4BD78C16B2BB3A315053990022A953B7FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985605, "uuid": "4822e0f5-25d4-471c-8212-95922744a824", "value": "1536:78QFX5fH62sgYiCl990WRS5oBdW6KbF3d/FIO:916O2T90WAGdh2FN/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985605, "uuid": "36e4493f-06b7-479b-a2a3-91f36fecfb7b", "value": 57852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985605, "uuid": "60cde9b3-9f70-4b81-980b-e78b1e8f7adb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985605, "uuid": "e101c2e2-d670-4bf7-9a2e-14b1b613f8f4", "value": "6d59a3081855e3cc6d67a85a61ea1b0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3add16fc-0ca2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686960140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960140, "uuid": "3b28984e-5347-4e5a-bc2c-7c89a8b64763", "comment": "Malware payload (Amadey)", "value": "bbcc8f48674db0180308c194b12a45e1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960140, "uuid": "0ae19cdd-e46d-4f65-813e-0c2b27bbd77a", "comment": "Malware payload (Amadey)", "value": "bac87051ee827b2e05115e579ba03c1e234618b1dcaa99304c0ec6a296d1a7e6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960140, "uuid": "1b24c713-ee75-4f77-a024-ba6812a2b5fb", "comment": "Malware payload (Amadey)", "value": "67be90ac6c408af791f7a650ea6e97924233475f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960140, "uuid": "a2e6520e-87d9-45db-9b4c-96539cde9541", "comment": "Malware payload (Amadey)", "value": "9a922157cf8880cdb56e7c1dbe3d8f9c1b0c1031ba75d1eec9f194e1076846f851b9adf6448408428a0eac50c48e6c26", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960140, "uuid": "0b93b03c-b388-4039-988f-22e93e504f67", "value": "T1DB052393ABDC8237E9FA5B7049B613831B367C550D78122727A5740B5CB2584EC36B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960140, "uuid": "94e3b0fd-588e-43a4-9eb3-27981d156975", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960140, "uuid": "f76760fb-40fc-4d4d-80f0-67490661879d", "value": "24576:Jy2YC6J1CBIknXA+JLOZVYs5Jp7ejA1WAz:82YJJ1vIA+xOZms5/SjwWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686960140, "uuid": "3cdfdf72-61d5-4281-ae7c-62d749fc7ec6", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686960140, "uuid": "cddd2eda-f218-4977-8af9-49fca919a700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960140, "uuid": "0ac36ac9-e4ff-4a07-aa59-de9c9fed5c73", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6e88bf-0cfb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1686998665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998665, "uuid": "00b9164f-7f67-4b9d-8304-e815ef301a08", "comment": "Malware payload (Tofsee)", "value": "46c94ba976861f38bd05a7327c693c31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998665, "uuid": "c9ced286-ca12-4433-850d-3bc6c3446e89", "comment": "Malware payload (Tofsee)", "value": "bb2ead99d1a552593af12f1a6d161106a77e2671080ac7fd01874e67ccd4346e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998665, "uuid": "8d7863c0-d5ac-4978-977f-6bab166438c2", "comment": "Malware payload (Tofsee)", "value": "e9cf87edfa08862596c7721a8c6acdea80fc46de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686998665, "uuid": "4f75f946-7d13-40dd-bd81-6597f0a23b08", "comment": "Malware payload (Tofsee)", "value": "6e7f58389fbbe141837212adb5d9d211c730214daabe8c9916f75aca6a3ff48749b78a135cf81a4222c7ccfa92646637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998665, "uuid": "fb77d3fc-d2c3-4019-a13e-dcaa527758c9", "value": "T148340743A2B13D94E926CF769E2FC6EC761FB6508F49B76E9118DB1B04B11B3C263610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998665, "uuid": "5a59f22c-5581-4ca1-92c3-f54c809376f2", "value": "a346b9b1867290f612560daf31aace2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998665, "uuid": "73f33247-20a5-40d9-81a0-677a5633134b", "value": "3072:t3i+D002TfvdXEt7npat8kiVYKusNGyormWF8t5HZsMZTh45UyWBGz:Q+D07TIpaOkiVMHy43F8LaMNjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686998665, "uuid": "05de4420-1f9a-443e-9f82-6265a188fdf6", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686998665, "uuid": "b027f10d-7928-4e46-8f1b-e4dc0fdee1e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686998665, "uuid": "544b778d-5b8f-43a5-9f17-f86969888b09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900b7681-0d24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687016118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016118, "uuid": "28c2304c-2b54-4246-8b02-784cdb0d3dfb", "comment": "Malware payload (RedLineStealer)", "value": "4fe897180aa38b701fb8f6f697b40137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016118, "uuid": "0a68ae67-64d7-4cae-a8cd-0e785601ccd1", "comment": "Malware payload (RedLineStealer)", "value": "bb8abafb4d0b1715d55321d2563bda33db7454a85cf8a480d88a0a0e3b3ab7eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016118, "uuid": "2d9657bd-cf64-4ad8-957b-ffc1ab51face", "comment": "Malware payload (RedLineStealer)", "value": "36cec443699c9826b6d3eadac727295d346e5c26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687016118, "uuid": "a875de53-fb6f-4aea-a945-ba7c1bbb9047", "comment": "Malware payload (RedLineStealer)", "value": "69227947e8c1bd26699b0245b9c458f52d58d20ec6c059bcaa6d1c9b7d05e0117e2849947fbc129feb2509e25b95b06c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016118, "uuid": "70a45cc1-ef75-4533-8ded-3ee4367cf8d5", "value": "T195F42346A7D48433DCB52B345EFB06830B37FDA25EB426172391A99B1CB1794AE31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016118, "uuid": "afb0dda0-9d26-421c-9ad7-20c3c9b90f8e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016118, "uuid": "9f744bad-d68d-4c56-83f7-d7bb0cc77ed2", "value": "12288:yMr5y90lRQ+jtss+h/r4prI8e3IhwmXk/wgf274XeuQ5SjsVIfAdX:jysR5toKprI0vmf7hpj34Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687016118, "uuid": "acf1d658-d996-449b-8028-778bb7196d0b", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687016118, "uuid": "2b9a5a34-9746-4ef0-98a1-974ca75777bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687016118, "uuid": "2c1ff8fb-de3a-45e7-9329-0962f219bc3c", "value": "4fe897180aa38b701fb8f6f697b40137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b40aff-0d5d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687040746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040746, "uuid": "a7d33857-3a4b-40ef-8a9d-914c600924ee", "comment": "Malware payload (RedLineStealer)", "value": "323022b7b50843369b9a365537664d17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040746, "uuid": "9e7f82c5-1562-4e82-878f-cc0d936f8a7d", "comment": "Malware payload (RedLineStealer)", "value": "bde084bd369527e5d9cc6e440307abc229bde84472f0f53badf35f6bd6103161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040746, "uuid": "80bc9b18-6905-415a-a123-5f48ff49de49", "comment": "Malware payload (RedLineStealer)", "value": "f3b1c021f215479734a68dbf868d70bc33ab6094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040746, "uuid": "6eab5cb6-6118-47cd-9fa1-b5e25a0d6283", "comment": "Malware payload (RedLineStealer)", "value": "7c8ee2cfb97d9a0f5b6fbec24dd0e26c13800c52feff6cac0f3019e281b832590c57c28bdbf0d0e60dab05579f64a7b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040746, "uuid": "a377547d-8e1a-409e-a386-ded5280d7016", "value": "T129C41226B6D88431CDF62B7059F702830A3ABD646874E36F2259989E1DF30D4F27176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040746, "uuid": "b284eca9-257e-4580-8497-d5a5a3489864", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040746, "uuid": "b858989d-33c6-4766-b471-e5b001333932", "value": "12288:KMrny90aBzvmgMpbjFFFZTm3F8aG2mvkNMwPWDQ2FQA:JyLVvzMNjNZC3F889MxUqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687040746, "uuid": "280ae6f5-a6a2-4ced-9e9b-95402aface1c", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687040746, "uuid": "1d591814-ff30-4ded-a8b6-c78787777361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040746, "uuid": "1bca297e-6d99-4d77-9912-e145ae0ed20a", "value": "323022b7b50843369b9a365537664d17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3da61db-0d5c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687040310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040310, "uuid": "ea99bba6-efb7-4e3c-9604-a9ec9eb4b4b4", "comment": "Malware payload (RedLineStealer)", "value": "1da863b926400b0b80dfbd1ec8de8970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040310, "uuid": "77ceec25-8d0d-423e-8f24-283392819272", "comment": "Malware payload (RedLineStealer)", "value": "c0f37ec58f171167fd20dfbfd8947d069320a6c7453ec4afc28e1ba008203b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040310, "uuid": "7b888a1d-fbc7-440c-9dd1-d82c1be64eac", "comment": "Malware payload (RedLineStealer)", "value": "7498c44def2e6aa685108fbbb6ddc848b458f4a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040310, "uuid": "eb7f24c9-5699-4e19-acd1-c921f63244cd", "comment": "Malware payload (RedLineStealer)", "value": "526fe324d31eaf0ffe069f64191e36c575b0e5695dda42713869c9f97301fa9547dcaf3a97869d4537a84c9f40d29092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040310, "uuid": "714f02d5-218b-4edf-b7d6-e9c29bb1f82d", "value": "T119B49D12359CD031DFA301338E569A749A3DE4B00B6E15EB67E46EED4B245E0A733F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040310, "uuid": "31cac5e6-2d14-4eb6-b59c-bc84f85af72d", "value": "b0855e1e5610030f2a7f9e42211bd448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040310, "uuid": "60754844-64a9-4a87-aecd-2370465a9f62", "value": "12288:++xb4MFqWka28nzqfKwDDd5EFzOz75LVeMIBiI+e:+s4MFCa28nzqncFzWVeMIBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687040310, "uuid": "a4922f8e-56ea-43f6-bffa-282165e4d0fc", "value": 510800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687040310, "uuid": "ab1515bb-8571-4dd4-b0b8-4881e8465a4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040310, "uuid": "29de53e9-4937-4277-a941-721f0a882ddb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e756ad60-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045470, "uuid": "197fce9b-ae49-464c-b6bb-bec2ba988b58", "comment": "Malware payload", "value": "bdcaf6d9b6c51d001d2d353e8d9e937d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045470, "uuid": "0056c7ea-3b9f-4647-8203-7762cfc9066d", "comment": "Malware payload", "value": "c1b52a12ff58d2b5d8a1016da12260ee529b97b7b98464f23b636e2c5c313fb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045470, "uuid": "78e6e500-7cdd-43e5-94ad-ec9f605d7fe3", "comment": "Malware payload", "value": "02ac3d3a05b14cd368841b6a1e9fd938f4ab1d72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045470, "uuid": "ef6e27f2-e534-4103-a265-e6310ccbeb6a", "comment": "Malware payload", "value": "49eda964f0e2bf0b81d1d6b56cd79c8f048bd7e4947e543c049352a21e7a588ddd536c56f287ade8f96ef47e7fa11726", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045470, "uuid": "ce67329d-f7b1-40a4-a11a-da9b99035db4", "value": "T1EE142A45EA414B13C0D327B9FA9F42453323A798D7EB73069928AFB43F8679E4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045470, "uuid": "5d9f1614-dd47-44c3-9967-d078adc9b971", "value": "6144:Y0qGZdVg2apaBChQB9jYKfNIaGrHzJM/RlrbeH:Y0qUVg2apaBChQBdJ+HzS/PrbeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045470, "uuid": "6309d03b-eec3-4309-9c63-3117a8d865f6", "value": 204186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045470, "uuid": "c0fb5d11-02c9-4c3d-b0b4-f30998279b50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045470, "uuid": "1a59b9ba-f479-40a8-84ee-a49bfcb52164", "value": "bdcaf6d9b6c51d001d2d353e8d9e937d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e311467d-0d15-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687009815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009815, "uuid": "fbb994f2-a1e2-466e-83dc-deafa3d6f80f", "comment": "Malware payload (RedLineStealer)", "value": "4e80568219e0b65a924dc23dcb9e1b05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009815, "uuid": "c8528ba2-e93a-44f8-b9a7-eab7efc5df42", "comment": "Malware payload (RedLineStealer)", "value": "c755dfe3e64ad8fb363401365cc6597a53f66293f0aee0f82ac9405b02a674e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009815, "uuid": "387f520a-1484-4197-bcd8-d19be2b3753a", "comment": "Malware payload (RedLineStealer)", "value": "c7b1677f31df2d47c81095a546a65ba0f961e644", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009815, "uuid": "ef1a81dd-80d5-4470-af8b-80b4a0053fb3", "comment": "Malware payload (RedLineStealer)", "value": "6924f6dd4aea739045b3023e7bd42aa59d01f08ae0d8995071009ebb186497a2e5b8739946c4a1adf04de5ccee5a8bfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009815, "uuid": "0796823c-10aa-41d1-a1b1-fd27778e8b92", "value": "T19A051307ABF49072DDB613B054F743430B3A7C519DB49A6A2B8268AE5DB2780AC3535F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009815, "uuid": "cdcd3cc1-b20c-4891-9071-4d15bf9d0538", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009815, "uuid": "42ffd1cd-ebb0-4cc7-ab86-9014f6ca6388", "value": "12288:rMriy90+fZ96t/VpjTIXSU0JihVlByrB3nUFYeKLrfAAlVixoeRr7uSf18C:NyfGuXSRkBylUFbK/fAAT8rCdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687009815, "uuid": "6df50852-bfa0-42a3-90cb-5143bea19944", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687009815, "uuid": "034020c6-7bac-4c02-a2b5-0855d7d65a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009815, "uuid": "69c4ac88-b29e-4a3c-8613-a2ffcdf4680d", "value": "4e80568219e0b65a924dc23dcb9e1b05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9a275a-0cf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686995931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995931, "uuid": "4f2eb911-f78c-4632-867c-f8895c767f18", "comment": "Malware payload (ModiLoader)", "value": "3279688c2428a16220d16aa38311b81a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995931, "uuid": "ae46e795-97d5-4184-8783-c89ced2024b4", "comment": "Malware payload (ModiLoader)", "value": "c820373ad0a0851483c14c4f11a2ca81242d902e20bf4fb272177eb9260a2acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995931, "uuid": "121043c2-2eee-45ef-9e72-b22167f12cbf", "comment": "Malware payload (ModiLoader)", "value": "773698f3b73e5c6bb776469568da760ae5bcfcbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686995931, "uuid": "7448c08b-859c-4bf1-8364-809cb1436bfa", "comment": "Malware payload (ModiLoader)", "value": "b42db8849f9a935c4b2ceb0a25f441d0979a4f96ff3b114a61408bc1e2a4c0ecd24c65ccb43d43737a8c11553b9d1f3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995931, "uuid": "d666c858-8eb2-47d1-bf91-6aae0b7240ca", "value": "T184259FA3B6870837D17217389DDA5F699D29BE113E246C497BE47C8C577C38278382A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995931, "uuid": "95d205c4-8eef-4beb-80e2-87439ed05cf9", "value": "2ebaf47190fd1bbd26fec0b446b1ee09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995931, "uuid": "ae67861e-62de-44c7-a98e-b1cbb64493b3", "value": "24576:Zs/dShaR6+yPvvIYHGrw8R+d7BOQ6nuz0:Zs/uC4JHGU0gBOQ6uz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686995931, "uuid": "a976941c-1e8a-4450-83af-5fd782777366", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686995931, "uuid": "13244db4-733d-44e3-9bd3-86bd9d953431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686995931, "uuid": "5fc62ad1-bd5f-483f-8c82-a48426992221", "value": "v pr\u00edlohe je novy zoznam objednavok.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f09bf2c-0d6a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687046154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687046154, "uuid": "58483247-cbc1-489c-864c-20cd3278a9e3", "comment": "Malware payload (Amadey)", "value": "20b589e8f591fe859f97c5cf075e82b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687046154, "uuid": "1cfd1f27-527b-4d9c-a2c4-6b41c3c1bc1e", "comment": "Malware payload (Amadey)", "value": "c8452dee5f248c46b6b0bfc142a896a49a136d20b99a313a5b5ea83d03e5f25e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687046154, "uuid": "d8ca9e2c-21c7-4c79-b15e-4b5b0ca9c330", "comment": "Malware payload (Amadey)", "value": "a8c35889554741281faf0843c50f87afd69ef489", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687046154, "uuid": "340eff67-c73c-4241-9099-4fe94d9828d1", "comment": "Malware payload (Amadey)", "value": "65c64a80c3c6573da9f24f1450fc2903605e74b4b9fa350d2b93b48d65f55536c3f88f22a11b3b615b1f256592861191", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687046154, "uuid": "492ae9f8-b6b3-4d6f-beb0-b8a8f47fd4f1", "value": "T1D405135337DD8477DDB51F304DF703830B36BCA15E35525A221AAAAE5D72A80B83272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687046154, "uuid": "be4df4d0-77c0-46b3-8f46-dd040d0c472d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687046154, "uuid": "33dec1ec-2db7-40c2-b6e1-5ea0e60326b9", "value": "24576:vycMwLwsTF0IPBbaX8XhcpCzh4FoSiat:6j6wsmIPBmcFt4Pia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687046154, "uuid": "40b1e3db-fba2-4935-a5b2-7e32a4d8b481", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687046154, "uuid": "3714cb4b-f4b2-48fb-9b16-bdaa687170ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687046154, "uuid": "e590b07a-c0fe-47a3-8f70-e32ac9649d05", "value": "20b589e8f591fe859f97c5cf075e82b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f748c638-0d57-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687038195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038195, "uuid": "e753cf0f-ff70-432a-9dd2-e747d42e90d6", "comment": "Malware payload (RedLineStealer)", "value": "dd522fe535dd3df031d7ee887a59431e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038195, "uuid": "21a6d662-b57a-48de-9b31-b2b47ddd818b", "comment": "Malware payload (RedLineStealer)", "value": "cbdeb8735187ad12456992918f44b405c1104c4862e1cec49614dea7929d79ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038195, "uuid": "3ed9eb77-6d6d-47ad-b0b7-4bf4bf637129", "comment": "Malware payload (RedLineStealer)", "value": "fc9ba90e99ed761e3d9b855c65faa5dde9276a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687038195, "uuid": "ee209596-fa4f-4412-a8b6-4694002749fc", "comment": "Malware payload (RedLineStealer)", "value": "00da4d938e3a6fc754dd402ff517e1c2777de69f96f30bb9ccb62d135c6b5fd36d6014dcfda09073c8ca16c523bf8097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038195, "uuid": "dd67c69e-6f13-4799-a4bc-bc2de1a063a7", "value": "T1E8052357BDE89472CCF7673158F103A30B3ABC6299BD83472795A85A0C732C9A635327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038195, "uuid": "bfe63222-25dd-4374-ac46-61f78c1ac8b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038195, "uuid": "1277d1c4-54f0-4cb0-85dc-6c7fc1c8a5ff", "value": "12288:aMrGy900yreQtqfusCFBmGOPDSKFDTHcXeeTCVvrOdvDkK8xkNhjgm6O:gyfyr7tWuHBmGObVFPo1EKvMkHgpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687038195, "uuid": "61cd1b94-2b1e-4a89-9238-fc9233821637", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687038195, "uuid": "2282f854-3b1a-4205-8b60-4e81cb96f507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687038195, "uuid": "68d9709d-0b22-4eb8-800f-5dc203ec99f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315dc962-0d15-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687009516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009516, "uuid": "e61481cf-e1ad-4434-9eea-79649fff47c3", "comment": "Malware payload (Amadey)", "value": "f255de9c32d107b9d2f462186c802f00", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009516, "uuid": "55ee0b97-f1b8-4d81-a3e2-c4734172fd36", "comment": "Malware payload (Amadey)", "value": "cc14dbe2697997752059dbfc69405d3ff360e5437d937d830cbab00830363d61", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009516, "uuid": "a8aa93ce-008f-4732-8292-cb1e7df4f14c", "comment": "Malware payload (Amadey)", "value": "b7419bcc73a4310524c6381f57ee1be7a9195364", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009516, "uuid": "f0e8a502-a613-41d4-939c-6304b7a024af", "comment": "Malware payload (Amadey)", "value": "cb03e1d4c11f02e4cb53680241c869c4dda551b22a2f8f84a4ce0a6a817f65c2ca292e8e10079a37b6d32e4f32c69cbe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009516, "uuid": "fa4cc80b-fb95-4a5e-ac10-fcaa72ad7f40", "value": "T1E1D41202A7D88132D9B537708CF607970B357CA1AD78C3AB2756689B28B37C86931377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009516, "uuid": "42488e26-47cb-4876-b4cf-61929ade2be6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009516, "uuid": "5f8a89ff-4791-4529-af37-35afbb31042f", "value": "12288:pMrdy90kQtqjXFRKxasYn1whnKblCx9wa9ryfB+dRQC/O0Mam:MyDFRKI13v+zJvMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687009516, "uuid": "5888f1cc-9a74-439f-ba35-4ed288f40012", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687009516, "uuid": "c680225d-681c-4dc1-a617-5d7b2944b6dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009516, "uuid": "7f45d828-f57b-43b2-8172-b4b462e977ed", "value": "f255de9c32d107b9d2f462186c802f00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a257b2f-0d10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687007410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007410, "uuid": "3f095d8c-1167-4219-a00a-e2c232680155", "comment": "Malware payload (Amadey)", "value": "a13b25647a3dc9bc4ce6216d8659ae44", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007410, "uuid": "44b9bd20-f04f-47dd-a490-a41d02e5b4c0", "comment": "Malware payload (Amadey)", "value": "cf3230c67aeff72f9430821fac171222d1228921c6b07116d8fc14a976fd7d55", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007410, "uuid": "83b880c2-e226-4449-9db4-e15dc8178bcf", "comment": "Malware payload (Amadey)", "value": "007c26d41d19b98a8776200870a4fb24cd4a70b2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007410, "uuid": "a8fd15f3-3b6e-4bab-b010-66ad69947346", "comment": "Malware payload (Amadey)", "value": "66f3ac532bdb3caa6ce1dc4f3afb380c3229f17845775af57baf86031a788e0efc6d23112f3665723e1dce5c97e05818", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007410, "uuid": "7380e000-43d5-428e-a746-0686c28b4e62", "value": "T1FEC41242A7D85133D8B92B3018FB03930B397DA2AD7543BB27C5A8994C726D591733BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007410, "uuid": "b3a2d748-1de3-4e07-9526-8116b0efe61b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007410, "uuid": "1f802441-c330-43f5-85c6-786252236e57", "value": "12288:MMrBy90w1sfHe48njYY4oeL9W+A6ZONjxI9RjxTLbm+9i0y2bj1Jzex0:NyL1sfHe5kfxL9QqctIP1TXm+jyuh9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687007410, "uuid": "2c478200-d15a-4a5e-8078-e84353997b93", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687007410, "uuid": "faab8e02-e0ca-4854-897d-0469ad01682c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007410, "uuid": "d3359446-9f0b-4b98-848c-e39c1bcfdab1", "value": "a13b25647a3dc9bc4ce6216d8659ae44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d46cd32-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985592, "uuid": "ac06bcdc-f3c2-4690-9e17-b1b715348c6f", "comment": "Malware payload (Mirai)", "value": "0ebfcaf819c72d81325b0213b7de7f55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985592, "uuid": "c82e9b71-a95c-4775-996b-8da6e998310c", "comment": "Malware payload (Mirai)", "value": "cf4e51dcc71f13f95d000b2cd57486cd43c9e43d19a7302aada722e6b27057b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985592, "uuid": "869ce5cd-3fed-43ff-a459-4d74de87f50d", "comment": "Malware payload (Mirai)", "value": "5ccf13c11b545e71265e6fe6a7cc55b16df65e75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985592, "uuid": "c927a320-1aae-4af5-98f5-0841faa19d09", "comment": "Malware payload (Mirai)", "value": "ba937946d13ece151fd4d91dfc3f1137174a15df19aecb2623c1436992f89469892d7b575ccc4974571b0c7b4187a86d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985592, "uuid": "b9123f1b-b618-4a27-baa4-4277539c7d5e", "value": "T1E003F1D074488974CD791E7CD93854067B9B7BB8EADB1168821081F557F248BF7F882B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985592, "uuid": "7db5e0bc-7c38-4b78-b0b5-e2b69b963aa3", "value": "768:x4LznMCdAw4Buc1OVBEOojnT1wW3yOhNKh9FB80gUosStlHzgJmGG1q3UIm3:0oCdAw46VBG7T1zXKhLBFgUoHHTgJmcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985592, "uuid": "8ca16fe5-b699-4918-ab0b-b0ad31f6f147", "value": 37812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985592, "uuid": "3b8e92b2-ddcc-407a-8560-f41cdff8038c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985592, "uuid": "bdfe78a7-3a73-456b-98c4-a22fb480663f", "value": "0ebfcaf819c72d81325b0213b7de7f55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5c57ff-0ccc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686978240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686978240, "uuid": "bca02736-6039-47d2-aeb5-0dd3278b8215", "comment": "Malware payload (AgentTesla)", "value": "de945a96db4675ffad6abad963c94b02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686978240, "uuid": "d68df938-5b81-421b-a171-2d8164629bfb", "comment": "Malware payload (AgentTesla)", "value": "cfc611e16796060c1e801b318b09287414c7a01e3854f8a546aa5b58145e53a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686978240, "uuid": "b727c3b1-abe3-4ad8-b1bb-1c02577fe4cb", "comment": "Malware payload (AgentTesla)", "value": "90784ff2e63f2550c26b72041f26b5f37c942d6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686978240, "uuid": "3a212463-e403-49dd-9e0f-9416394351bb", "comment": "Malware payload (AgentTesla)", "value": "8d3d61f38e881a416ffe5fc4038307660f17ccb393adc5c1a583091857a88e30e9295670cd157232851416d25d9d883c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686978240, "uuid": "74dc3a26-6ecf-4ca0-ac4a-037bd8859a63", "value": "T1F205020497ED4716D8FF1BF4A86441341BB2B49A753AE38E1E4270E6BA63B015F42F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686978240, "uuid": "0009ffc1-dc84-458c-afde-a14c7cd44549", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686978240, "uuid": "923b05f0-b867-4a5b-86b1-d48508a89172", "value": "24576:T8KdhVO2n9OGyDnehVTEt0iCQHoEV4qXdVD:TJhVO2n9OGyD8hEKM/4qX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686978240, "uuid": "7f360809-e7e1-459d-b94d-3d310f2935b7", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686978240, "uuid": "2153fa01-8b39-4481-94e6-312062318211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686978240, "uuid": "79e4877b-d576-41a5-be28-3fdd7dfe456d", "value": "QUOTATION_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c8ad7b-0cc2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686974063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686974063, "uuid": "fdd6be5a-7931-4ed5-8fc8-e6659f4c754c", "comment": "Malware payload (AgentTesla)", "value": "0556da46f62c3da93a0de233dc1d76a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686974063, "uuid": "a2a2ceb8-16be-4ac1-9b2b-22b0146d5c6f", "comment": "Malware payload (AgentTesla)", "value": "d0c6d22eaf4cb18b6e2325da654db47a6149451ee9e0cdf9a7d569a5c5e1ebae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686974063, "uuid": "b9464ae0-2de7-49f4-b030-2b715c804ded", "comment": "Malware payload (AgentTesla)", "value": "5d86abdd5d6fffef88a7babe5a1ee99c8a1fda80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686974063, "uuid": "319f17c2-4809-4821-96f3-2837693676b8", "comment": "Malware payload (AgentTesla)", "value": "b8dd1d319974e9a8747116816b7d0788e1f451fdf72096a7f1a33501170c94b3200dc6586ad7d31523deffe9337437e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686974063, "uuid": "90ec7f97-b326-4753-a99e-be0176a3d807", "value": "T198541290B5F2CCA3F86753326C3327167BE4A52466A82B2B17849E1C7FE5141D94F363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686974063, "uuid": "87125cc0-5b82-4ae8-8b38-bc4b72c52200", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686974063, "uuid": "b1db13c9-f914-4d43-b77f-83d072a17c56", "value": "6144:/Ya6QCYU4m/K8NHWkJaQOikLd4zkNzIYqi/9m3uSYgDYcmqW:/Y2CVxHPPNQqi/cuKD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686974063, "uuid": "8f01dcb4-aeca-42b3-aaae-4e5f43d4319d", "value": 289512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686974063, "uuid": "48c15903-bec5-4569-ab61-069ae75296fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686974063, "uuid": "5c2aa120-642c-4da7-97d6-8959f935555d", "value": "0556da46f62c3da93a0de233dc1d76a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36a58c7-0d60-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687041947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041947, "uuid": "bcd7517a-e0b3-4805-8694-5e9ebb7ffcad", "comment": "Malware payload (Amadey)", "value": "99e4fef5597ce9bc7f0ccd0fac85d635", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041947, "uuid": "6751a1d7-52a4-40eb-ad8c-b193be49f78e", "comment": "Malware payload (Amadey)", "value": "d1960cecd43b18f2bba88cf2d8792a4f2f40ae777317ee704ac2bedf1601a963", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041947, "uuid": "9d4fd0f0-4e5a-469d-adfa-e4cce5fc8bb2", "comment": "Malware payload (Amadey)", "value": "8e5d4bcdd206aef030bbd0bf013e31f7b1bb38f1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687041947, "uuid": "159a4f1c-e768-4196-8330-96560e3dcd2a", "comment": "Malware payload (Amadey)", "value": "b4d87ee33ef416beb3a21707610af0a48e0b06e9b8534077c590044b1bfa4836767d33984a89b03121d897ebad4ecd8d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041947, "uuid": "480b488c-1c32-47f4-aee3-65b9a8cfa62f", "value": "T10E051203E7D848B6EC6017B058F683570B32BD755D78C3AA63462E8F19B2A84A57173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041947, "uuid": "cca262dc-30df-4715-bcd8-5840e69a1cd2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041947, "uuid": "2517e128-d2e2-4570-82dd-3d5876067095", "value": "12288:YMrAy90qG98jGBMTRuTcghP++DHThEVBGyXVfszgdeBU+WAbm3oxd7cRZyy:oy/K8inTca5pyX9LWD/J7crr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687041947, "uuid": "598ee4c2-aa4f-43f5-87a3-6f2caae4e3b0", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687041947, "uuid": "db122ff8-3385-4668-8997-29d58d386d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687041947, "uuid": "90a35fe7-6cb7-447a-9608-55577e9faefd", "value": "99e4fef5597ce9bc7f0ccd0fac85d635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04993db9-0d4b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687032634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032634, "uuid": "2d6700f6-86cd-4b19-b0aa-050efbdd1a57", "comment": "Malware payload (Amadey)", "value": "490450a717fccad3000091905ee5a61c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032634, "uuid": "b2b3299c-466f-4336-ab81-85b2f1f4e09d", "comment": "Malware payload (Amadey)", "value": "d1cae73d636eb4acf51886e5ec60bd08842d769e11c7c3fef6720cb1b373ed5f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032634, "uuid": "c1714f2f-a2a0-4c5b-b2ac-deec0a2ef0fa", "comment": "Malware payload (Amadey)", "value": "a4876f85b090fb96f606819010c450945221d2f0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687032634, "uuid": "da906081-ef4c-4e4a-9a3d-6e158c3a66f1", "comment": "Malware payload (Amadey)", "value": "7f3eccea415d2a6db4c9d643f6e9cb5326c682d54e0c7e7753ffdc9471138100f53db893a0e9c5ed51ea80cbc2f95d47", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032634, "uuid": "e4dc0fad-7002-42e2-a422-d60b1de5c356", "value": "T1FEC40217A7E88033D9A12B7158F617D31A323CE15E34827B3B95A89E1C72AC4793177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032634, "uuid": "2203aa27-4b27-4052-9915-7a8f4236dda1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032634, "uuid": "2797d3f3-6c6d-49c9-8c63-949e9ccd887b", "value": "12288:oMrhy903xmgqdPepzwyT3IaB2SPDfw16KfbeHo2/kcAG4miP:Jy4xEdmpxIaQoDfw11fbeI2/ebm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687032634, "uuid": "e3f88317-baa9-4b47-be4a-45c2f03f44a6", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687032634, "uuid": "d2c4b1de-83d1-481a-8df1-8696122fb07b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687032634, "uuid": "90d7e3fc-fb73-4bd2-a570-ad1b6163680f", "value": "490450a717fccad3000091905ee5a61c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf84701-0d23-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687015817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015817, "uuid": "8ab565d6-80ad-4888-aff7-44723ea9ec5b", "comment": "Malware payload (RedLineStealer)", "value": "785f7d0c97c9dbad94fba8a3c5ac4957", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015817, "uuid": "3fa37d69-c074-4652-afc5-38d1d0f23afb", "comment": "Malware payload (RedLineStealer)", "value": "d348cae1392a501d515bb3795dd2281599ffc3f26981d4e5ac0216501800e112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015817, "uuid": "05b07089-e9e2-47da-8ffa-bf756699cd5a", "comment": "Malware payload (RedLineStealer)", "value": "1bd5cc2927f100f0f4a1b45ec0d493640c4c6d34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015817, "uuid": "c7f72705-2fbe-4994-bf1d-66d89c067345", "comment": "Malware payload (RedLineStealer)", "value": "4fe3851ca8ec616067e82fc773b9ed683ec3146de82aae22692552b5849221399deb9d347d8665887fdcf3e237248621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015817, "uuid": "e6d4aaaf-d5d3-43a1-aaf6-f2922ede087a", "value": "T135F423A2A9DC80B2E9B52B740CFA13871B3ABD615C3446A71795E94D1CB32CDE07077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015817, "uuid": "490ac7c5-e29e-4063-a6f3-d09c7e04f8c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015817, "uuid": "30f2768f-c84c-4f8e-926b-9e963cbefe82", "value": "12288:HMrXy90UO2Oillnomfn5ltgjWX9lxL/Y47AhjsVi3MRZX1CsmJKqfk+oh02:4ydOILnxgjQlx84AO8cR3CTKqfk+o02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687015817, "uuid": "42d0ae34-b840-453a-b062-39c264059ce4", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687015817, "uuid": "abb14874-1c82-4a58-ab8c-b6d5cd72b380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015817, "uuid": "113e8b8f-1076-4378-8b8f-ac0951cdff6e", "value": "785f7d0c97c9dbad94fba8a3c5ac4957.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dae6183-0ca2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686960199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960199, "uuid": "e8ac05e8-78ac-495a-94d7-71a63f3eb2cf", "comment": "Malware payload (RedLineStealer)", "value": "3ce059bd15856b97c2e7ba495973c7b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960199, "uuid": "981a4437-5ad0-481e-a589-8184803ce1a3", "comment": "Malware payload (RedLineStealer)", "value": "d3922575cdc52f9c7b20d189d785398c715be3c236e94ce5ceb24efd4146f787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960199, "uuid": "151a3d1b-50cc-492c-95f5-aa4c59c51c61", "comment": "Malware payload (RedLineStealer)", "value": "ac041f567f637f6d6bad276c95ae046eff5c13f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960199, "uuid": "16174f58-a4ea-475e-a929-fdec6ed31c5b", "comment": "Malware payload (RedLineStealer)", "value": "abce2f2f79570755dccb5347e4db6306627fb22517b86790eb7963f2a848152c801ba7acd681ddd673237599cd2d2b56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960199, "uuid": "321ee4e9-a02a-4578-bb30-89f67bf3da2e", "value": "T137C4121267D88167EDF52B7098FB13930F32BCA26DB0466B2748AC995C73590A83177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960199, "uuid": "74c46440-413a-4d71-adee-f098ff5ca19a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960199, "uuid": "122dd91a-de26-40f7-8126-05e4a7062f82", "value": "12288:jMrey9061Vn9C0v54QVB9LdINR0Sqv05Ax5VzEJ+5PxvGUl:Fy51VRv96Iv05Ax5VzEJAA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686960199, "uuid": "5d7af4dd-7292-488f-9889-9be4890be5b2", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686960199, "uuid": "29e243fc-9917-4729-959e-8a40f380d937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960199, "uuid": "e5ee7f55-ee14-4347-9fda-df04e686d2ee", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed61206-0d3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1687025511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025511, "uuid": "cecbe3a1-9ac8-4cbf-9dfa-be7ae921aed6", "comment": "Malware payload (RustyStealer)", "value": "50ebb1dbea9bf98e789af1431e5bc4a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025511, "uuid": "79c0cf8f-2bd6-44f0-8ded-67b78ee1e721", "comment": "Malware payload (RustyStealer)", "value": "d68b2389f3f67934c732880a96f00c06b9a5fadf1ee6210a01380068d2f08a3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025511, "uuid": "158f22e9-d06d-430b-8650-4db74377b6c8", "comment": "Malware payload (RustyStealer)", "value": "5f5d55121b572840dfbb92ed4150aee58ede827c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025511, "uuid": "b395c490-896a-42f6-8b92-c10d1d222f5b", "comment": "Malware payload (RustyStealer)", "value": "91de9cd75a3fb22958dba8fb261368b4be50a9e42a8ae1679349de0a50993e47b9971f1850591811df6e77b461985571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025511, "uuid": "4c7ff60b-5902-4548-95f8-b59257768bb9", "value": "T1D5E529207F9A8AADC55AC070C2478B61697274CE0F35BBFB459496383E35AF51F3C298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025511, "uuid": "cbd24f38-ba8a-4f82-a844-1f90ec335b2a", "value": "1b52a2a515bd428e760c81468b5e526e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025511, "uuid": "cf2feecd-74e9-48e1-b214-91fc5e03303c", "value": "49152:Z/rKiZUDClPF1yntOKGJ9emZCdfk4ezt7DrA6IQL/k8JXp/nBcq:Iezt735dpXp/yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687025511, "uuid": "35bf015d-520f-4f8f-b748-7370ec6b1724", "value": 3227128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687025511, "uuid": "07ddb9fe-7887-4778-8566-7ba99eefea12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025511, "uuid": "de3d46a2-fa7e-4e3a-81f2-fbe14c04722a", "value": "@Umi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66d197b-0cf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686996103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996103, "uuid": "ce06d37f-2975-45cd-b68b-fd1ee2c4fedc", "comment": "Malware payload (GCleaner)", "value": "2fa99872eed966e343835350175322d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996103, "uuid": "a4366d32-229b-4ed4-9c8d-cf52f76f270b", "comment": "Malware payload (GCleaner)", "value": "d7d0246b912af8d5287d7f6c170bbc135384faed0777308410040e4e64d214d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996103, "uuid": "91e64003-5890-431a-9b68-9106c5989952", "comment": "Malware payload (GCleaner)", "value": "21d68cf41e7c328907644d3890df04442c24df90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996103, "uuid": "47ba82a8-927c-4784-b1c3-b234ba7186d4", "comment": "Malware payload (GCleaner)", "value": "d702457758d7cbb53215f1acf4f29463737f105e3187c17279ec238dd379bc6dbae6a3d48f62700f61568d46cb0a9bb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996103, "uuid": "b021f495-7488-4791-8dba-b0fbed479c4b", "value": "T18C54F11235E08C32D47A2E724CB6C2D1272EBDA19B34569B73786B3F5E702D05AB174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996103, "uuid": "9fdeb8ea-53bd-4230-8905-7723844327cd", "value": "4089a35c9e048a4d2101826d92d4e0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996103, "uuid": "a282bad9-82d7-42f7-9802-74a3a2a48bc8", "value": "6144:p0+ULHbDHh66tunpynsRgNXirU1penHoH:pfULHJ8XRgYAeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996103, "uuid": "02b11066-a592-4c2e-9526-3588e206a93b", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996103, "uuid": "b05b42a9-230e-46f1-afa3-558b9e6bc4b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996103, "uuid": "62921be6-9808-4180-b806-33744858d355", "value": "2fa99872eed966e343835350175322d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35bb3e6-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687045490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045490, "uuid": "72a44ae3-2f08-44be-8788-91d088e5cb94", "comment": "Malware payload (Mirai)", "value": "80b956da0321a1aca65ededde9541d33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045490, "uuid": "7c7d7343-79b7-4326-8bf3-2153a573f326", "comment": "Malware payload (Mirai)", "value": "d8756dbcb2525a8c6db2bca12a1db695f56cea193ed6dfa9c9fc975af5b31478", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045490, "uuid": "5ad7ce0d-3fa5-4167-b08b-8a0fc555a3b2", "comment": "Malware payload (Mirai)", "value": "ccc8a6a717a2c684dc63b686c6774288aab11270", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045490, "uuid": "810c8c4d-98a6-4acd-be74-5bca3c46001a", "comment": "Malware payload (Mirai)", "value": "b056d2350dd8bf08b7cf91d02e15aca2b3cd68cf41606421883324c235e729beba52463cf4ea792648d499fafffcbb7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045490, "uuid": "624bccda-f48e-444b-81eb-500f30333e08", "value": "T18BF2D852F8825627C2E4237AB66E5A8E373073DCD2CBB21BE9614B207B8551F1D23F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045490, "uuid": "2c6453d6-7ff4-4b2a-b2cf-5e45f0f7bf75", "value": "768:wLbd8D5qC4G5yqd9YX/jyKQyPyk2V3Cf9wQMqtG+t+w1bnoXKw/o:ybCqpG5yIi/jyLKMgLMiGMdk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045490, "uuid": "51e90d54-e53a-453a-b385-482734d42847", "value": 34476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045490, "uuid": "428d26bf-1d9b-44ca-a00e-089d9e5cf776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045490, "uuid": "41b6beff-e93f-4db1-8e83-c500a2cd30ae", "value": "80b956da0321a1aca65ededde9541d33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc59464-0d10-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687007710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007710, "uuid": "67af8fca-dcf6-4b2c-96a6-d285f3dc3629", "comment": "Malware payload (RedLineStealer)", "value": "53ee41b73bb206d8db7c56280c1ed514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007710, "uuid": "0e08bbd5-79d8-4035-a4a9-edd5c7341d7a", "comment": "Malware payload (RedLineStealer)", "value": "d8b03d56b59dbd657565f3c0067e4e0d36c27aec41240f74454f3b7ed7fe4c30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007710, "uuid": "f945bf5b-8b85-43c3-b7b7-df47bf0d5949", "comment": "Malware payload (RedLineStealer)", "value": "be94a7485cf78b9a92260ee2ca5ed7ca09431367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007710, "uuid": "e82f6342-468c-45fe-892d-4bc20108ff5a", "comment": "Malware payload (RedLineStealer)", "value": "40a8bb11324717b1dd6d4d5831009435ce00bca7068a4cb7bf6189106be1c6a20550b845156ec51d810099edfe2080ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007710, "uuid": "ff3df691-78b0-4f2d-b790-2bfd05b73b61", "value": "T10DF42246B7C4853AE97967709CF7028317367CE1EC3493633241AAAE1DF26C9A931367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007710, "uuid": "55cd3a09-3999-419a-a308-6b694cca9832", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007710, "uuid": "abdf5fea-3fa2-47af-b3e4-ba6d53ced034", "value": "12288:HMrty904jlxF2Rry1Qwg+MeoFPVtU+FdbQywv6uJeuRofMvamUyV:WyTxFcry1QwzdoDTFdbPTuJRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687007710, "uuid": "7bd64291-0bd8-430f-8170-207dabc0673f", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687007710, "uuid": "d6653c5e-2459-4976-87ff-5bb7e78f8814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007710, "uuid": "95947539-28d5-4572-9473-f0a71c298843", "value": "53ee41b73bb206d8db7c56280c1ed514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32db3785-0d5a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687039154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039154, "uuid": "01d3c947-2cdf-44e5-ad94-bfbf7d690930", "comment": "Malware payload (RedLineStealer)", "value": "d2611e5a6c0f96842ac8b628beaf8483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039154, "uuid": "a6ffb7aa-6897-43e3-ae5c-e027ce071920", "comment": "Malware payload (RedLineStealer)", "value": "d8d158582836cf5591a47ef61a1ccf81a3bbe086420e3bb79813d2e90cf42cae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039154, "uuid": "6e0faf71-e1fa-4a5f-898e-dace1b3fe352", "comment": "Malware payload (RedLineStealer)", "value": "86625691ec5f927c44abdcd0b77757a03210ef4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039154, "uuid": "6a88853f-c25c-44ca-80cf-9629590d11a9", "comment": "Malware payload (RedLineStealer)", "value": "a818426c40d345d28af0b841047f65312ebcc7e049e14e9ed5a4ffc124da95e9e173b5255a5f79dcceaebfd5850519d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039154, "uuid": "73508a3a-6411-4479-9016-70cd44355fb1", "value": "T108B52D61CC0552E3F24F4FF21966C449A46BA73E4E5394300F005EEA73AD9EEAB09DE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039154, "uuid": "91afbfad-da67-4aa9-8eac-c6e7e60166b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039154, "uuid": "214b13b3-cf22-49d7-a80a-8671deb20445", "value": "3072:ISurFVcSIcp28GMoqcxJ/Z6e1yWuyWxEjGbU18Z4JjAoEN/2RIMDfn5n6Dp0EBhH:mX0F86lue1jWWIZ5oEbMDfJG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687039154, "uuid": "040ce7ba-c7b2-484e-b198-1883135fef7d", "value": 2300183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687039154, "uuid": "1fde45c7-3936-4c6c-8464-335c753f6019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039154, "uuid": "4db31141-7653-4282-973b-1c8564dd05e4", "value": "Redline_no_padding.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90f8526-0d11-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687008080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008080, "uuid": "1a480dc8-b8b3-4130-a1bd-cb9f28e78309", "comment": "Malware payload (AgentTesla)", "value": "0be15fc7dd2ce7e4568dc0d20041f97e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008080, "uuid": "90cb0675-5293-4166-bce8-a9723c4ecf48", "comment": "Malware payload (AgentTesla)", "value": "d94624f2966882c4d9e35e0cdfe4e40963f22148c43a946867c63f5fd68ff401", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008080, "uuid": "81a347bc-1f00-4c6b-a5c8-aa1404dabd36", "comment": "Malware payload (AgentTesla)", "value": "74d5769f8a538157e76eeda74e1171e64b11791c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687008080, "uuid": "51f39058-fd6d-44df-a09f-8a527e04e1ad", "comment": "Malware payload (AgentTesla)", "value": "ee9d030f76e65530887f6bd61480fab3ec014e2c61056b0c7da40262ca4f8e307a4df5cce9198ad879d1462a1caae44b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008080, "uuid": "2aed69e3-13dc-40bb-9b0e-e82206897735", "value": "T13435C33D9CBD4237A670C6A6CF94B866F494D3B731121C39A4D35289862BD4B3AC713E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008080, "uuid": "dda9673f-1cc9-461c-8980-8e4d291db718", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008080, "uuid": "3263ac3c-1afc-4290-8d0e-dc134e3e70f0", "value": "12288:zf6c0jpZTsd3fH6w2TvQe64P9z7oM0m6+P5AunPrw6Chu:r6JjpFsxfHyvQt4P94Mg+3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687008080, "uuid": "8f1a907c-267c-492f-b243-26bbd5b374dd", "value": 1148416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687008080, "uuid": "f67b7806-2f97-40a0-b94a-9b9a046fb8ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687008080, "uuid": "0b434ae3-6971-4896-9736-3e9f2828d117", "value": "Invoice To Be Reviewed.GZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcae0f7e-0d3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687025641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025641, "uuid": "049008c2-d58f-4133-aa84-b247cac49391", "comment": "Malware payload", "value": "cb0bc71244c3adca295b62c3a802e350", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025641, "uuid": "34442b63-f6aa-417c-b86f-c1dcfa6fdf19", "comment": "Malware payload", "value": "d950c020a311b29e062f6a2b4d42110caf2b0781b012e43a6b4e89ffa6c494dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025641, "uuid": "7d868424-aeac-4be4-bba0-11532bf3a8a8", "comment": "Malware payload", "value": "858e8d2ad55a7014ad051ec09bb47c55b2bc4606", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687025641, "uuid": "0dc5ebe3-7c47-4941-865b-c4c67f045b3d", "comment": "Malware payload", "value": "4a4d35dd5884334125b5994d14a57bd9e0f936e9690749a741128af05814e2415d7ee843e4a3b4291564cef5c775da6d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025641, "uuid": "a6cb2238-66a8-499a-a170-4e5648b1276a", "value": "T198134D51A6958072E26E293454F4D5621D3F7D427AF0408F3F996ABD1FB13C0DA3836A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025641, "uuid": "9b5c0a0c-82a4-43e0-8e37-ad986ac0d73c", "value": "61770781cf0c1ba58bbbcaee29cdf5bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025641, "uuid": "1386781d-b661-4c4e-8f43-0a08f4d4dc24", "value": "768:FX0naJJFFIslAhOtmnTEDK3vyYhsrp8i9zSb:FppSVoYhip8+zA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687025641, "uuid": "b420127b-2084-4dd8-917e-c6151d16e3f3", "value": 44480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687025641, "uuid": "94ef3e8f-6306-45b9-9707-ee525a3ca639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687025641, "uuid": "834d832e-d412-421a-9edd-66df2969ce76", "value": "awesomium.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf855f8-0d68-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687045426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045426, "uuid": "7e739506-7cb3-495e-af1d-23c0946a928b", "comment": "Malware payload", "value": "567567c2268bedd5578afc2f1a09fb48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045426, "uuid": "3a201ce1-db77-48a6-aaba-eb8300fee66c", "comment": "Malware payload", "value": "d98772e0f6c55edcbd257e967e726f37d39c82097ff3600c1182651f939ebc3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045426, "uuid": "dbe8bef1-8365-41ee-a15e-6eca9a829f68", "comment": "Malware payload", "value": "3f501dc446d92f5701f4939a925b4e3fb037c47e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045426, "uuid": "a1a20eec-a022-47b9-9dca-73f38e7877f8", "comment": "Malware payload", "value": "94d88bfbcf38fd355e641b04ab46017fd7215523846f01be625eab55cbbc58aeb97d5b3d7d240cb043a3f1fe5c0db49e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045426, "uuid": "d7f7ddda-8bdf-4c38-a29e-d3b71e84b5c0", "value": "T1DE338C77E46A5E94C08605B075649F705F23A0C493831EBB29FAC2B56493DACF909FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045426, "uuid": "3a1d3f05-ff55-4bc2-ae01-548d991232f3", "value": "768:Q4aHfAe7YyVfMBNLr/y3S+nMCv6fKcetvqa6ouFMIjCi9Cl4fnrdUw/8I:va/Ai/BMBV2TMfKcetvdduLjCirr7/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045426, "uuid": "0fc1c3e7-4bd5-46d4-a4e8-bd414a42eba3", "value": 50484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045426, "uuid": "a8003b45-ca3a-429f-904f-eb9c72c7edf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045426, "uuid": "3011d7c0-cd62-4a6f-9ce9-d009412b68a9", "value": "567567c2268bedd5578afc2f1a09fb48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c63fcdf-0d2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687018527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018527, "uuid": "df363824-4ae6-45d7-acda-6fda4e4c4aa2", "comment": "Malware payload (RedLineStealer)", "value": "5e3fdab61a0f8a7b1bebc5607a8d4bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018527, "uuid": "88d80b8b-b743-40f7-8fc6-f6a291b98764", "comment": "Malware payload (RedLineStealer)", "value": "d9e279d1691b3e893392143aa4ef65acc37d473e1fc84d7fdbdcabe887405782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018527, "uuid": "7a2e64bf-0f84-4f94-be98-d2aa1580f6cb", "comment": "Malware payload (RedLineStealer)", "value": "5f8d35846cc080ab67a1f98e8741128281c83d57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018527, "uuid": "583ae033-ef5c-44a2-92be-192cb3eb8623", "comment": "Malware payload (RedLineStealer)", "value": "b864963d502965d518352c589cf810b304c882e12eab621d8235087e292a23ebb9ffd2316189cac00e4a7eac36f99019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018527, "uuid": "a527822f-75a8-487d-8ea7-8a48f08b16ee", "value": "T19F443A1231E0BD24D805097F7479469BB6AE68DFF7D8C4FA152421EB2A172892F3D336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018527, "uuid": "3e6c8f28-094f-47b5-8e8d-83351939cb02", "value": "8b20c0aa1a6b70c064e1b0a2222ddac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018527, "uuid": "f53dcdab-d3ee-43b6-92fc-bd53a379500c", "value": "3072:3VcL1ckbCA/ADypR0Hgm6SeqsRoAmgzmkm0GxpSHyQrpbRutnlz1clt0x:OSkeAdSeqs7mgzmkm0G+pr3uZlzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687018527, "uuid": "8f581663-2dea-41cc-83d7-5f19b6137e60", "value": 270618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687018527, "uuid": "bcc537ba-abf5-4b99-a753-60d35685d640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018527, "uuid": "10d0cf30-0330-4aad-bef4-783359479417", "value": "5e3fdab61a0f8a7b1bebc5607a8d4bf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e903af8-0d41-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687028436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028436, "uuid": "889fb53c-1019-427b-b838-71e8d8aebee1", "comment": "Malware payload (RedLineStealer)", "value": "d156203504e3792bec1090743e068c2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028436, "uuid": "109f9386-45b6-4986-89d5-5b2c4ff37118", "comment": "Malware payload (RedLineStealer)", "value": "daf305429bfd84a4045b84662d72c33917f47fcb610c2dc5094d4254581d420e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028436, "uuid": "3c43d34f-9bf8-47b6-870e-84ce12b14077", "comment": "Malware payload (RedLineStealer)", "value": "013ec8be4cc074597b583052847098cbf8c49f1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028436, "uuid": "3a40837a-e75d-4da7-b1d5-9b92e52697a7", "comment": "Malware payload (RedLineStealer)", "value": "faaf243b9fd2b7646c612883bee51a63fd3ea5aec678b7cb140d53718456447f343280f9f6547934eb7e6c3b2912c6f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028436, "uuid": "b47cca22-e4bf-4305-b9c4-3b0dd65e3365", "value": "T1BCF412016AEC4472DCF65B7058FB1AC3063EBCD2A8B4536B2749D85A0EF36C4683576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028436, "uuid": "25f04793-8fef-4d8d-84cf-b912a95d51d2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028436, "uuid": "25cef763-4627-42a4-a4bc-b42475d01327", "value": "12288:eMrRy90i9+3bMqkPi0ONwnnX5LnbQJmW/au3bBOmgXyjT/0aKrOJUOdn:Pyx9iMqxenhbbMFtuyjTRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687028436, "uuid": "5a7194af-21fb-4c08-b8ee-fea86c53347b", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687028436, "uuid": "09f211b5-0eb1-4935-887d-f38bbf41d327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028436, "uuid": "665bba60-b9a8-4804-b8cd-9aff0a2d4283", "value": "d156203504e3792bec1090743e068c2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b60da08-0d0f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687007117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007117, "uuid": "9c00ebb4-a9ba-47fe-b55d-6cd5dac99226", "comment": "Malware payload (AgentTesla)", "value": "89fbe4360df2e6eee7852ac68658ac33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007117, "uuid": "fe67d4d6-5d2e-466d-9231-366d7171e384", "comment": "Malware payload (AgentTesla)", "value": "db446783db86540d8f04bb5d242b6d4acccd4c426b9f5086773a492db341f55a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007117, "uuid": "e0f15294-e14e-4249-b2a7-da288a2434ea", "comment": "Malware payload (AgentTesla)", "value": "ff2b56700582fd75caf8e4ca7c570e2598b686bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007117, "uuid": "195cad18-048b-4d39-9cd5-053e0bd203ad", "comment": "Malware payload (AgentTesla)", "value": "752e35ba9fbf83ad859f5695ca65c07e29ba1288f49c0b91361ba5f283de2758284920351372f92e3b86699c96930908", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007117, "uuid": "4677b0b8-9cb5-4255-b1a9-cc154c7f8bfb", "value": "T18E340119FABB91EEC80AC673C4D4596C0BB0E3826653D707264A4274CB47BCB1F89DB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007117, "uuid": "aa60592b-2652-4bcd-9159-d8f92108db85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007117, "uuid": "0e66c05e-64d4-4e63-96ab-166cddf0cd8a", "value": "6144:Mbr9CULcc5C03V5Xsm7XVL7EkhRUNwPy2LRI8w7Nvj5:cr9df5tjXsm7Fswq6c8w7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687007117, "uuid": "ae9ad0e8-3dc7-4158-8983-0f1ca2e5d7e0", "value": 238144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687007117, "uuid": "686add64-8518-4039-8fe6-bc202f041504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007117, "uuid": "fb775c2d-2a9c-40d9-b78d-723be7e2430f", "value": "99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2008e6-0cfe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686999742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999742, "uuid": "2450d79b-427d-48e7-98af-dc9743776576", "comment": "Malware payload (Loki)", "value": "29a820139c373e8afa09b88815e8ba5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999742, "uuid": "eb9cff44-0a0c-4b4b-9118-75d88420d5e5", "comment": "Malware payload (Loki)", "value": "db69f02facff699199d7517b288c97fc995f823492312c34a63b001d742ac1e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999742, "uuid": "92e2186f-186e-4265-a6a9-81fb63ec3d80", "comment": "Malware payload (Loki)", "value": "393f46cbc3ff9912875a6c4a2dd788229c208004", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686999742, "uuid": "ffefad33-c48d-4654-9749-2fb578fbcf68", "comment": "Malware payload (Loki)", "value": "e00f0411be4dc38aa663038ab283e2e3da9e6eb853ffe9e957b808fa1b2797740d65bef94f90a4e5004696a812998186", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999742, "uuid": "942c8f01-9a91-458c-8a5f-48ee6c195626", "value": "T1DBC412A95BA70A13C0679BF04E207B30437BD6A7386AD72B0DCBB2E9F550B511B05F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999742, "uuid": "5747adb0-8550-4419-9da4-1e773255ace3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999742, "uuid": "28707ce3-44ec-421d-88b5-120f699033f7", "value": "12288:45LbzIu9+r9GUHkAaSmWDBQeBcr2azLYJ+DWkmlCsYdIE1vTUH:45LA9GUHkAa4kSuEJ+DnmlDZE1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686999742, "uuid": "26166d7f-0546-499e-9758-1d4acd8af347", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686999742, "uuid": "9d41aec7-d2e7-4277-8c4e-2c8a180ab64e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686999742, "uuid": "f2674731-69be-4596-85c9-38fa48c157ac", "value": "29a820139c373e8afa09b88815e8ba5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0435c7-0cd9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686983684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686983684, "uuid": "563b2c5e-a51a-411a-803a-1b99637c6a77", "comment": "Malware payload (Mirai)", "value": "79ad44e5b41dfc1cfc370fa2e8b0888d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686983684, "uuid": "03c65e9d-8b8e-400c-a52e-8bf054b562e3", "comment": "Malware payload (Mirai)", "value": "dbbdf52354451795bd0c6e8273213ee2a18de59b5941abacf6363e2753ae97f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686983684, "uuid": "b6265171-69b3-48ac-b1bc-6bc6b7727aeb", "comment": "Malware payload (Mirai)", "value": "74053b721df2d97c8149054f4fd54020ec143e3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686983684, "uuid": "82351356-0722-4cbd-a4a9-cacf65d256e2", "comment": "Malware payload (Mirai)", "value": "672dd32956f524696221d0fbd13809ab6b048ae02d4819db228224c3dafcd9c62ee9ccfcd0687f11ac550b648d095396", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686983684, "uuid": "6e27b254-4c90-4221-9a19-40dac359d1b3", "value": "T113E2E15F516453A0D32E98B9AD7F254B03200D3DE3BD1162DD6C783B9D00BA4B94C3BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686983684, "uuid": "5f4e6164-e102-4c85-964b-9c92ed563d7a", "value": "768:mt3T1MkfSwwCSs9MrSz/Mq+GrN/Q2zU3RT4Ws8nbcuyD7Ufyq1:mt3Z1KLTs9Mej+GG2zU3RH3nouy8qq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686983684, "uuid": "719756f7-de1d-4b56-9171-814cbb9e4265", "value": 33044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686983684, "uuid": "10897dd1-7fdc-4761-9162-8b0f6d234f2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686983684, "uuid": "1807ca4f-b725-407d-b978-c65d112e6a85", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7ac41a-0cf7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686996781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996781, "uuid": "56ec1d25-8a3d-42e2-8645-47c251d82601", "comment": "Malware payload (GCleaner)", "value": "5bd33070cfc060b1c9af598bd8595e04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996781, "uuid": "6c2237af-ec8c-4b83-957c-d4f2aa60969a", "comment": "Malware payload (GCleaner)", "value": "dd21adf6e401a4592a4edc7e929ba123c96354b024efd2cc6dce391ae3394147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996781, "uuid": "c6708d77-7117-4c2e-888d-f6cb7806cb5e", "comment": "Malware payload (GCleaner)", "value": "65ae5049f5b363acdaecbbcf8390d7b099a4b670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996781, "uuid": "74a7e5cf-961b-45b5-93f2-031bac8f2ddf", "comment": "Malware payload (GCleaner)", "value": "fa8cecd54ad47386029fefd6e0b46ad2d0b916e8aa4ce1da6d848d998db9589a54d2ec1faa3d379a72222f8bf0b428d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996781, "uuid": "2978fde7-343f-4db3-b99e-57d8dd60f32b", "value": "T186C533C3D724D8F0DD6257B0292B9E368FA67E32A87910FC754A355E4AB37D2442720B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996781, "uuid": "bc1aac9b-20dd-4b6d-990d-97b7deb2f761", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996781, "uuid": "cef91dcb-9be6-407a-a398-5d3bda30b3d6", "value": "49152:s6dnmrBVs1g8oBGo0Ea42/qzx71maSBwepSiSG4nnW66rMFKnwDOZ:LdnmrnCEa3yR1mVWe4wQWcBDOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996781, "uuid": "b4a459c6-74c1-45e8-b4b2-2fc013a393d4", "value": 2653496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996781, "uuid": "f55a70e8-2098-4d66-b1d5-8b429196ad1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996781, "uuid": "28c1b881-cc17-4cf9-9386-5c238c3721bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d68dfb5-0d32-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687022126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022126, "uuid": "0a685803-54ea-4570-bd04-96f580a33847", "comment": "Malware payload (RedLineStealer)", "value": "af7dcb49dc09d1296a58767ad4bf0668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022126, "uuid": "d92f5a12-827f-459e-a0e0-b4cbd5bc1c0b", "comment": "Malware payload (RedLineStealer)", "value": "de2f4cf128b90a83b3e44bd5fad4aeb8d5068b564dfe7d90e6a5db950f6b3c36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022126, "uuid": "681e8a4a-7af6-49c0-a6d0-0f72399d541b", "comment": "Malware payload (RedLineStealer)", "value": "56fea3e5daa92ed45cbe9c41dcd04ab6a6edbbe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687022126, "uuid": "9c19c25c-f536-49b4-be43-9f73106ecf6f", "comment": "Malware payload (RedLineStealer)", "value": "b9c2bc5396e7edd64188905eab30d641909f47e6819fecb45cbf2f78ec0595acef57ef160c8ef279e9f6a6286e209348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022126, "uuid": "47697d14-8378-4da1-ac28-4e2cda4784c2", "value": "T191443A0231E0BD24D801497F747A469BB6AE68DFF7D8C4FA112421D72A272992F7D336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022126, "uuid": "3766156f-a94b-4f89-8fa5-8e23b0029087", "value": "8b20c0aa1a6b70c064e1b0a2222ddac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022126, "uuid": "c6140bec-bbf8-4892-8c40-ef2e15f4c1f7", "value": "3072:wiNmvEC1VFIypR0Hgm6SeqsRoAmgzmkm0GxpSHyQrpbRutnlz1Dpt0xe:w1v71ZSeqs7mgzmkm0G+pr3uZlzZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687022126, "uuid": "aca1a41d-8089-4df8-bd7a-a8c41f993edf", "value": 269586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687022126, "uuid": "13202303-aa36-4d50-883e-5f4cfcd1ed33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687022126, "uuid": "3e364c77-bf7f-45e1-82d8-8d77af62161e", "value": "af7dcb49dc09d1296a58767ad4bf0668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fe9825-0cf9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686997736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686997736, "uuid": "96dfe898-6e0f-404e-98e0-4a8a07c408ab", "comment": "Malware payload (Smoke Loader)", "value": "73a8b9e16496f799f8a6edd84bc7e5c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686997736, "uuid": "4f951cdf-c4cc-4775-962f-bf4657dc4c06", "comment": "Malware payload (Smoke Loader)", "value": "de8385440c23789f44c418bdf2e30578559b1c6b142c820f081f81280d1c0888", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686997736, "uuid": "65ff98cc-9480-4bee-8990-ef4155289fd3", "comment": "Malware payload (Smoke Loader)", "value": "d0604613c3708f84f15ea0d2520b530f0c78fcd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686997736, "uuid": "95018c08-3de0-43d5-9b09-4607b54114df", "comment": "Malware payload (Smoke Loader)", "value": "370e55090247dc8292d0716ad88d30846215a8b07f3f8f2240297f364de161cbfd529a626aa91fa217a60089f232958c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686997736, "uuid": "ee28137a-d18f-4e9d-8d22-602bd652d2e5", "value": "T10A341A63A2B13C64E936CF729E1EC6E8761FB6508F49B76D9118DF2F04B1172C2A3650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686997736, "uuid": "660f58d5-dade-47c1-a7e6-af4cf67a8ab5", "value": "a346b9b1867290f612560daf31aace2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686997736, "uuid": "9a875b69-f1e5-4078-baf5-16b76e4c84c2", "value": "3072:o3A+nwA20a/Tq858NV9rr/aHxqgtVVMxOvvv+Duovh45U6Wgz:J+nwvRTgrreVaDuku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686997736, "uuid": "d467b554-74cb-405f-bdaa-ac6c2a764c57", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686997736, "uuid": "11c68717-03b1-4eaa-861c-37a0940f0889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686997736, "uuid": "cdb36f53-72c7-4733-b0ef-2ec041ccd09a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef2440f-0cb6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686968871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968871, "uuid": "7c907832-0975-490c-97ee-ee0f3520f4b2", "comment": "Malware payload", "value": "2e2af82984993170c6a8cf4759d0a6f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968871, "uuid": "cbc7fa93-3d03-4c99-83fa-fba3b0acb9b7", "comment": "Malware payload", "value": "deb0281202356a61d5b42fc6ed4e1bffac94a30d463b95b40f0902233cc7f8df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968871, "uuid": "14e81f5f-f6d2-4d89-8273-ee5aa907b2f8", "comment": "Malware payload", "value": "d6c434f3d2947ebc5db52570fd0323aae577eb87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968871, "uuid": "1d1a9405-851f-45b0-828f-dd64f47b15ff", "comment": "Malware payload", "value": "1b469ff1a65d6502130d4dbf24aa7e70283a391c49eac665f6e50c4c50d20a80e42e62f0689a99642fa871954efbd7a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686968871, "uuid": "beef7749-de23-409f-9a1f-147161f03bbd", "value": "T1AA86E85774E25252C4F23BB678BD40E432271BBAA7521B6A6C05EF387A3B4C90E3D714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686968871, "uuid": "8389dc5f-c461-4b4b-b1a2-cef4d95376d8", "value": "49152:NJb1BacgEgtV+VtfV82O1n+FBFH6xfaEpGqi3RG1QfC1Vr2D7Lr1R1:Nt1BacgEO+VtNdO1n+FH6xfjpp1Vi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686968871, "uuid": "eb19f4d7-6974-4252-8856-9293de539567", "value": 8060928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686968871, "uuid": "fb0dee91-990e-4117-b1b4-d4e2d2e6ad66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686968871, "uuid": "a4405008-78cc-417b-9024-81f31cc91c97", "value": "SecuriteInfo.com.Trojan.Linux.Generic.298038.30876.23635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b15d9b-0d56-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687037578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037578, "uuid": "fcc1d97a-6008-41ea-9e20-fc963428dae2", "comment": "Malware payload", "value": "2ca6290bf2b0beb14f8c8f6b4f84cb6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037578, "uuid": "db862192-b60c-40d8-8baa-1c829dc607ea", "comment": "Malware payload", "value": "defa200ab34c79bafdab4300726314b9d890dcd25ceef7aabdea60dea8f95de9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037578, "uuid": "f7a9f96b-ca67-416a-985b-40c493ac1743", "comment": "Malware payload", "value": "2b8aab80447b4cf6f83e7ee95bcf03edc755b082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687037578, "uuid": "d3f9e0e5-8f37-4769-ba99-eda97b6e7bf6", "comment": "Malware payload", "value": "b06950d8b110887e512b336ad251c93a01836c0c391ef26040cefae4f515b195d5b5ff71f43c2ec1204c718c1318e915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037578, "uuid": "439f04ec-ab96-4823-8a90-a3783cda20f4", "value": "T1B83623A357211D89D8D4CC36B527FEE5F1B60B9BCB42F87829CB79C722724A4A312543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037578, "uuid": "312c8f5a-d324-4df8-afc2-31eee9e46d4a", "value": "d71de3b2ca92f53f96645b738fdf8017", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037578, "uuid": "c0a4bb62-662d-423f-b253-288df6b6f715", "value": "98304:52yX8L67b9Ebw+BwZhdnKNFZvazuoNh+Ht4LSA+pXyT5XWfWpT2Swg0:52C8+7ywFZDuFIzuoPhWCT5mtSwg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687037578, "uuid": "30297d0c-e81d-46ad-a6f3-5e88d7e8ba0d", "value": 5330616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687037578, "uuid": "9f3a7aef-8cab-4dbf-803d-5ee3451ea7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687037578, "uuid": "24479a0e-2b5b-4f8d-88fc-477031b741ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3dfa1c-0d62-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687042852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687042852, "uuid": "f5782160-da4b-4ef6-9f56-9dc7f2221278", "comment": "Malware payload", "value": "373764a21bae5cb0fff2e03b3053aa17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687042852, "uuid": "9c665364-384a-4569-ab9c-04c41902221c", "comment": "Malware payload", "value": "e1889da0e5512beb477897471a70d1597f9670c1d507ab0cffde6acf5c1348c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687042852, "uuid": "8d6859e7-4273-43f0-957e-55480488f87d", "comment": "Malware payload", "value": "bd9027acea90d81ce6f803782f632b3e3a7e75de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687042852, "uuid": "19260a1d-6505-4d24-b0df-74c7465bff6b", "comment": "Malware payload", "value": "a745077b31920db695a5d5da0a4f32530f5fec057b9abf6d5e9b16b777c4d54faa18eceb937ac0ba2db85ba2372b4924", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687042852, "uuid": "dd69f16f-aae9-454e-9488-8a8d42d26610", "value": "T1E5334AC8F543D4F9EC5705B01137FB379A36F5E91229E743D3A8DA32AC52A01A906ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687042852, "uuid": "af250e9a-d1c1-4239-bccc-68f3d26a8aea", "value": "1536:XNBX9Z/DtwiLaiAl46CiZuh7NWb0PyBSLvA:XNBX9ZbtEVNCq2xccyQvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687042852, "uuid": "67ce6d30-50ed-43ae-912f-8a34596d9ec7", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687042852, "uuid": "4922053b-d2fd-45c2-863b-68e55253b53e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687042852, "uuid": "7c59dffa-b360-4f4f-8e11-f6a37dd7cb4f", "value": "v.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c856b1-0ccf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686979727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686979727, "uuid": "458e67db-a98d-4d52-b02d-6aaa2383714d", "comment": "Malware payload (AgentTesla)", "value": "622db6be2018e48a527cd178ae2f94b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686979727, "uuid": "3d75276e-3b73-42dc-b810-7f47f77091fe", "comment": "Malware payload (AgentTesla)", "value": "e2df18a7595cad59c110be522202de72f4f398b3c72a27fbea3d580aa1b02642", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686979727, "uuid": "f885215d-8ec2-47e4-a5bc-6aec7854627d", "comment": "Malware payload (AgentTesla)", "value": "6c8d58f3f35616656bfd977235a94262dc51d993", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686979727, "uuid": "f5bc7e57-c8be-4ac7-9519-ae884c51b63f", "comment": "Malware payload (AgentTesla)", "value": "0a706a073b0114b59b8b746440e70af5bedf16f9d4c3751252c434b6211e05ce7fbe3b51527bb93bc09cf9cd1c0833bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686979727, "uuid": "d78a4dd3-83af-49b9-b004-384c5aab2557", "value": "T10A541208B9F4C4B3C0231BB00F7E12655EB6B82D3872C75B2790625E7D236C5D96EB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686979727, "uuid": "6fe12dff-eaef-43d9-a6a0-20ae8d7b6d69", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686979727, "uuid": "810a0cad-88e6-4f7c-9e14-edc8ca9e5736", "value": "6144:/Ya6TSJFIbxG/an937OvPvGN1a0tSSprt9jngfEQx8UHJ:/YJ+F+8/897OvPuba3iQx3HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686979727, "uuid": "8c349b16-ae29-4306-943e-6d3d9b1f40d4", "value": 290143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686979727, "uuid": "7da8b998-2506-43de-a45f-caa4f37daacb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686979727, "uuid": "2e70c36b-bf78-4aee-8c91-7349dee27006", "value": "622db6be2018e48a527cd178ae2f94b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca73cfcf-0d69-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687045851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045851, "uuid": "994e2a51-d93a-4466-bba1-10a13c409662", "comment": "Malware payload (Amadey)", "value": "dae7d58ed261862c8bb4b4da96c5c91d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045851, "uuid": "76545720-4296-461a-a5c4-36e1c5a5c487", "comment": "Malware payload (Amadey)", "value": "e37dbb3d64fdf61fde9bab13b831bb5299c59227a9d8074ef0701a856f5dab70", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045851, "uuid": "7e2117dd-be50-4110-ac33-d81233231dbd", "comment": "Malware payload (Amadey)", "value": "0ebf5fd03a4da4b726f04388795fd2e3ce7a335c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687045851, "uuid": "a2d6c5be-4ce7-44c8-b861-e0cf4f1c41d3", "comment": "Malware payload (Amadey)", "value": "0c2293465be69426c2724ab4d57d0fb0338fd54be8a457ecee31693e46a2d04e15ee67124d2234c5ad6c458265691b55", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045851, "uuid": "02a5501e-9e96-40a0-99f4-b1223b7cd24c", "value": "T116F41203BBC991B2D9712B7018F722D30F3ABDA55D7883AF2694495E48732E1A07536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045851, "uuid": "06537cc8-a634-4df8-83cf-d89172d92e2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045851, "uuid": "56b24319-6e25-41a8-bd11-bbffa71e4714", "value": "12288:6Mrky90uV71Fy3ZGMl5kFsip1OLfWGzSz64+XjjktNiO0+o:uyjV7K3Z3N64fWOml+TjkPcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687045851, "uuid": "8a25f280-aa5e-433f-b4d0-e9b6a624e003", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687045851, "uuid": "069a6f21-cfac-42b9-82a3-5a8a485c8225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687045851, "uuid": "38024d29-34dc-496a-9132-9d9a5f35dfb7", "value": "dae7d58ed261862c8bb4b4da96c5c91d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a347197-0d5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687039542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039542, "uuid": "0a6c4bbf-a24b-4fdc-b350-947a7d4e3867", "comment": "Malware payload (RedLineStealer)", "value": "a8b62db352ee9884027376f15788ca97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039542, "uuid": "c6b7b03b-293b-4941-a041-10428c55b20e", "comment": "Malware payload (RedLineStealer)", "value": "e3a666a1e70b62d4acd36f81abb22a8d522cc33a5b9e476bd6c1d7ae75c3c096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039542, "uuid": "c5bbe7ee-2169-4298-b4ba-b7bd5f6a09c8", "comment": "Malware payload (RedLineStealer)", "value": "fad8ceade02564799ddbd5bae363701e7cc75a96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039542, "uuid": "eb583469-754c-486d-a745-c0468e9af57d", "comment": "Malware payload (RedLineStealer)", "value": "2fd27136338bdacef119903ff16d54705d02f73faf0390249443b9b16fd92027eed9bfc3f4c35728c88603b6cbc72a2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039542, "uuid": "56a8c7c6-2906-4bff-ad0b-4e0f9d36b2a5", "value": "T111443A0235E0FD24D406087F747A469BB5AE68DFF7D8C4FA122420D72A572992F7933A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039542, "uuid": "c2a20378-0c1d-47bf-9761-3bcc420d63a2", "value": "8b20c0aa1a6b70c064e1b0a2222ddac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039542, "uuid": "781f6c6a-d32e-4dd2-9b57-25d403ebaeb0", "value": "3072:3ydW51u+yTCgAYJyieubmC1oPj7cmaRp7INH1Kr5w/Exlz1Y+t0xO:r51byGg1evC1oPsmaRp7INMrgExlz6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687039542, "uuid": "031627a9-1027-42a4-8df8-14046e5b53b1", "value": 269076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687039542, "uuid": "fa9d1357-91ed-428a-845f-59a48b78235e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039542, "uuid": "d10d68e7-8214-4cd2-b227-15cde110952e", "value": "a8b62db352ee9884027376f15788ca97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22028ef0-0d5a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687039126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039126, "uuid": "a368276d-fa68-4c44-84ca-f994843ef4ce", "comment": "Malware payload (Rhadamanthys)", "value": "6f30ce2977255c6ea441762f55a5503d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039126, "uuid": "8d6cf9fe-a00c-4464-9aae-8d44a96da230", "comment": "Malware payload (Rhadamanthys)", "value": "e3c530a8f37ef3b74788e33c2483ef02b54009a89f981959b0619fab7462afc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039126, "uuid": "3195ef55-5bba-41f4-8c87-ac3ed39ab919", "comment": "Malware payload (Rhadamanthys)", "value": "dd74130e250d168ff2c0503d49dda1e1a1ed4a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687039126, "uuid": "1ae9c94e-ad49-498c-9c73-847bf5ab9349", "comment": "Malware payload (Rhadamanthys)", "value": "522f812aff851e778411174352163d0114d75c1665ac0bb9d9a14ed84ce353a78c7e427323254e8cec6194a3fcb5e5f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039126, "uuid": "0fdf61de-f391-4e49-b279-89e4d7b75366", "value": "T103A4CF03E3E17C90E927CB729E1FD6E8770DF5508F49776A2A189A6F14B12B2C163E44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039126, "uuid": "4676cc86-4947-4842-adef-a22b78cd9ff9", "value": "04b17228a03b1d4a739b2c7487c1a1b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039126, "uuid": "06715a6f-45d8-420e-977c-48c4ed4aa181", "value": "12288:nM1cATkHAn/yIjI5H7iOrKx3qDM+ndf8pMdW6Rh:/ATVdmH7VrOq3Nm6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687039126, "uuid": "b4836a0f-58fb-4cff-8556-0cd7362fbf73", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687039126, "uuid": "5b0b06e4-5667-4787-a277-39aad60091e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687039126, "uuid": "335733bf-5d6c-40d5-8d9f-c69957ece8e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564d4a86-0d3c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687026329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026329, "uuid": "12a9c218-12c5-484d-b839-5ab72d756299", "comment": "Malware payload (Amadey)", "value": "7c9ce2ea51e50da0bb2d939d318a6f95", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026329, "uuid": "1a3d5d5b-d97d-4553-8e1c-c67ac71e1f14", "comment": "Malware payload (Amadey)", "value": "e4cf75febafb8cb7f71cfa31c4c1f2fea7c44faa0a3160079b297d9b6d305025", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026329, "uuid": "65cee4ac-4b04-465a-80b4-d8f95cdf4748", "comment": "Malware payload (Amadey)", "value": "7e085b093033735854ef1c6341cee800754adbe0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687026329, "uuid": "77bae23f-8691-4795-a56a-faf5cbe3590e", "comment": "Malware payload (Amadey)", "value": "1218c3189ec1816a524c0a0354f70390269676b1ad6f13bfe180bdb376d67fc0f90b7a18d0a315407428d6253cd6414b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026329, "uuid": "37192031-ee09-4ba2-93c9-46a07c061b0c", "value": "T106F41213FBC88562E9B22B7098F253530A36BD60DD3157272B55BC4F4972AC8A131B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026329, "uuid": "30d89fef-472c-473c-87a3-eb0b5dd1866b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026329, "uuid": "0dc642b7-e0ea-417d-9543-7f90141c58ae", "value": "12288:7Mrly90grFw5ODBQOAH78pf9osHghrUeH0wuCB5AswiffSYJ:eytS4MK1bHghrJ0wuw5AswMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687026329, "uuid": "3285869e-702c-4909-ad90-1985b0b428fe", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687026329, "uuid": "6c37639a-4232-448c-bf52-fd616c6f4701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687026329, "uuid": "39180cd5-75bd-4ce7-aeb6-6a34cea0d277", "value": "7c9ce2ea51e50da0bb2d939d318a6f95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc374fe-0d2f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687020624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687020624, "uuid": "0947a028-a808-4c4f-a9ca-8fd6f2d7c8ec", "comment": "Malware payload (Amadey)", "value": "962aa080ed016db3c8c45fea4a80474d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687020624, "uuid": "3256d15a-febf-48bc-89ff-cbeb9f3fdbdc", "comment": "Malware payload (Amadey)", "value": "e6a5624bb5964b70ee9002d345b7eda62293e460df3b5bf3939a3bca99cc556c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687020624, "uuid": "f0d6e7f9-fb65-4724-810a-77a53816bc89", "comment": "Malware payload (Amadey)", "value": "6badf9b26837c75201862a3e05963b18e76a6e81", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687020624, "uuid": "21d4b38f-dd36-4f7b-b0d4-bd80bb1b4958", "comment": "Malware payload (Amadey)", "value": "d85612c67bbeb30eac841921699f4d5673816610fcb2fd8187dd792f43b07e7c725b7974329c7dee6b6539eeab140667", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687020624, "uuid": "af75ef31-b25f-4ae0-88fd-a44494010817", "value": "T1AAC41213A3D48032E9B52BB41DFB06C30B39BCA26CB487AB23995D5F08725D4A17577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687020624, "uuid": "5826a0b7-9b94-446c-92d0-ffdad5061b1f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687020624, "uuid": "00129e18-a2e3-4815-8d06-0276358a2868", "value": "12288:gMrEy905i+DWZPv04eOyf/MEDpQOEPD8ILql5v:0yGiqWRvfdyHv0Ov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687020624, "uuid": "47f2b17a-2479-49c2-8746-860ef5219637", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687020624, "uuid": "ff066a29-e898-493a-9cb8-167e59447b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687020624, "uuid": "48ee9c60-99a7-4e19-ba0d-c0d736c9ea0f", "value": "962aa080ed016db3c8c45fea4a80474d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c0e2ea-0d1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687012215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012215, "uuid": "23176d92-8f0e-4955-812d-9d52fab42377", "comment": "Malware payload (RedLineStealer)", "value": "fbdec222a60cbe2f3be78be1eba132a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012215, "uuid": "e4945fd1-b29c-4eb5-962f-4f86caa18b9d", "comment": "Malware payload (RedLineStealer)", "value": "e7ce3b356144852f7bfa900c18822e3585fab5a1994456eb4a3a49c7d02ee0b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012215, "uuid": "6b04f956-af3f-40ab-8e3e-8a4fccbd0ab8", "comment": "Malware payload (RedLineStealer)", "value": "cbfab4a7a21d5d97cc1d663ddba0cfdd29da8472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012215, "uuid": "8c5c2187-4c58-4192-bd33-9345b2685cb0", "comment": "Malware payload (RedLineStealer)", "value": "f495307e75fa330dbedd8a8fe94996be5d7d354910a0a1a3be073e8899a12f7467490c1be80dc7aad51680ef2be8918e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012215, "uuid": "17d5643c-c913-4d22-b163-9bc9c67e81a7", "value": "T1A6F42213ABEC8471D9F86BB05CF742A30B317DB19D74972B2395985A08B3B94687133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012215, "uuid": "a2a6a5c1-f035-4a16-9319-547a9f443b55", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012215, "uuid": "20111399-f492-40be-980f-0a06d49e8615", "value": "12288:0Mr3y90r6IJHMcDDrMDzuZv7Ohspxa/zVoKjyDIWpOMiLyc2ZzJVJgNiWnQyzYIr:zyW6TMEzSvyggRBcImDiedgNRiEKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687012215, "uuid": "613193bf-06e3-45a4-8865-497deb99e8f1", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687012215, "uuid": "58c95efb-d5dd-4f56-a1f4-b928fa93e086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012215, "uuid": "ae9594ef-0a81-4977-a49a-a3519e3d4d18", "value": "fbdec222a60cbe2f3be78be1eba132a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8790398b-0cdd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686985609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985609, "uuid": "990624c2-df58-4f89-a237-6ef588b15d65", "comment": "Malware payload (Mirai)", "value": "719bb92c740201fcadf3e5c486dfce96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985609, "uuid": "74f8cb9e-9ef4-49b4-9807-76a97e86e6d0", "comment": "Malware payload (Mirai)", "value": "e81f12a0eaa116e0ca3e548aa02cd4bd42ec360444b5e6a78dca655f11584cef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985609, "uuid": "2afc3b97-f83b-4daf-aa5e-fd6c79dbaab1", "comment": "Malware payload (Mirai)", "value": "58d7ae1f3acb32fba0f936c719b4bde5808fa808", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686985609, "uuid": "9318eb35-02e6-4b8c-a752-fdd1f365d34b", "comment": "Malware payload (Mirai)", "value": "022fd5ce90ce864c271adf08f887f03215b0bd4e053d360f36fd7e2d8137858c67c968e3c361bd141820a22408cab32d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985609, "uuid": "cad8eefb-55b6-49ef-bd38-2b13f960326d", "value": "T173D2F161B60062B6CBB05C73DDFE8942635A9574B58015F6F2758938A8D32864CF1EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985609, "uuid": "3f346665-0c09-4ca7-8bd5-e215460e20a3", "value": "768:pRFPx5pMsZXhFuqEbs9v0LOmOY56cYY6JorXHrwir92J3UbU:tx5pB7FuEpmgXY6ib2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686985609, "uuid": "e83682e7-cf91-44e5-963f-cd7df3e0e651", "value": 29428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686985609, "uuid": "27050135-f26c-4eee-b96a-1c0958db6d38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686985609, "uuid": "4a44337f-9cc7-4638-bf23-f03f894fbee3", "value": "719bb92c740201fcadf3e5c486dfce96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16435bdf-0cf1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686994009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994009, "uuid": "606d169c-9444-4486-826a-8396102a7036", "comment": "Malware payload", "value": "6316d6cbb865715433fabb26ef40475c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994009, "uuid": "93c2ed1c-421e-4162-a55a-8f95ddb5a75c", "comment": "Malware payload", "value": "e85fcae499aa5adb7655fb969faeeddfd29d533848c2bb024d3cd5cbdabb1800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994009, "uuid": "9c8bc37b-f8f3-4ddb-8fed-3390f944e57a", "comment": "Malware payload", "value": "26fe47aa5a8cba00724437f48ff2a945f6438388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994009, "uuid": "475f5d81-8b7e-4d7d-9879-a5532561f065", "comment": "Malware payload", "value": "f47a2cfb6d961ea7f8b69fc02e4640683f156b46441a108853de08f1a93dac7d3974516123ac4777e0f68b7f7dde0173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994009, "uuid": "8b32df7e-29a2-42b9-99f9-5f2afc645119", "value": "T1F4257C213546D136E97280729E7DAE7E402CA3290B5B4ACB67C8077E5D709D33E32B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994009, "uuid": "82bfda7d-d8d3-407e-86c2-86e9d6d6e2ff", "value": "14cbaa71d7be0dbcd552d5470a19517e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994009, "uuid": "ec8dbf82-a509-4fb6-9539-e48966e9fac5", "value": "12288:8GMJPzFmrIyaAn+FJqbtMGapym5mWaaj6jIRnA3CKvFmdY8/riVjcP55CI7kqhpf:8Tx3Ak6KUm5gSRorX4bCI7kG4J7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686994009, "uuid": "94de97ba-ef1b-423d-a50a-78d78a5e2b22", "value": 991864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686994009, "uuid": "f0a3be29-909e-4954-bd80-76c5666aeb0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994009, "uuid": "7e97ddaf-d6c7-49d5-8c83-7af5d826ec96", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.29872.31140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb45b4f0-0d16-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687010177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010177, "uuid": "94ce7306-24f9-4bf8-b442-a9c3973e1847", "comment": "Malware payload", "value": "623cd7b48f9b5f0bfd233ebb930cff82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010177, "uuid": "ae17afe1-eb84-4a56-9047-bcd25707e46a", "comment": "Malware payload", "value": "e87df0e979ba5facdc9f7893bddb968ec0e1ae44c709a887982d31687e2389d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010177, "uuid": "0f9df066-2f31-42fc-9b09-eb09d65390be", "comment": "Malware payload", "value": "ec32d6a43eac16209aafae6cb3912c398e9b80c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687010177, "uuid": "86e4941a-a026-4d02-b630-350e0ccd42ed", "comment": "Malware payload", "value": "194e0c0eb833f7e72c95c180fb41c4662b1202b67fae5a7a5e57770b45b648c4cf475bf15ffea3bb4812627b54ac7278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010177, "uuid": "7de78d32-54aa-4082-9e0f-32467fa86589", "value": "T1F8A5AD11BA44C035E1A111B295BDBFA585ACAD349B7148CB77C84F2D96B02D37A32F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010177, "uuid": "fecf18e5-36a5-4e1c-a75b-ee7175d86ef5", "value": "e0e8431e29f4e5539df14be8a4a93a7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010177, "uuid": "47adb6af-32d2-4ff1-94fa-57d42dfe75b6", "value": "49152:RGcqCmTtjjPH456mJT9JaSH37fOTTmMsPMQ3dS29TEb6NGeB:RGcqCctjbH456yObgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687010177, "uuid": "645ac37a-1f58-454e-80c7-682da3ab4599", "value": 2135680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687010177, "uuid": "055ab19b-87f4-422e-88bb-ef4318e1165c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687010177, "uuid": "e4a96ed8-75f8-48cb-8dae-22297bdac93e", "value": "RobloxPlayerLauncher (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07a4ffe-0cf5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1686996066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996066, "uuid": "c2b59687-772e-480d-a695-733092c2228b", "comment": "Malware payload (Fabookie)", "value": "3062ffc11e8c8dfea0e4caf673606e5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996066, "uuid": "e6fc4e38-108c-4428-8366-f5ba434a94bd", "comment": "Malware payload (Fabookie)", "value": "e8ffa78781e144d30d88e20f2c09cbcfe8699a3a9a0c5b64764eb32fcb70d596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996066, "uuid": "b3f81ef1-c81b-42f2-9d88-be613af19983", "comment": "Malware payload (Fabookie)", "value": "0c5ff9c2496a193af091c59dcf18d5a40c04d367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686996066, "uuid": "a4aede1b-ef4a-4e55-b1cd-1e1894c907c7", "comment": "Malware payload (Fabookie)", "value": "2fdc4a6d120ff80e859f5c92a999f8fdd7fb133a7279745b859a48c17d182c7643c9c9ed0c105e43738738cc9e20f249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996066, "uuid": "48368b1a-5e6e-48d0-8cdc-96d87c201676", "value": "T19A15CF15B7A9E942E0EA5235ACF3D30AA377BDA0A30317C7745C691B3F317911C3962A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996066, "uuid": "ffbb29a8-e569-436d-931d-ab2449e61dcd", "value": "4d04b88c21f8346f0a20751957b8a59c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996066, "uuid": "c2d7e685-8ff6-4116-864d-cf16da59b43a", "value": "12288:jPGexS/ITJqrraq/t2qny6xdRhMAK4vcmPEl0Io:K2S/UEn/tUIMGPEl0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686996066, "uuid": "d6b273d9-a039-47b4-a46b-0aa1f830d910", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686996066, "uuid": "af0f32d6-7ea2-4aa2-beba-543ef2c36794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686996066, "uuid": "60bbb674-7331-4adc-bb37-bd1e6421c833", "value": "3062ffc11e8c8dfea0e4caf673606e5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965f2201-0d0f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687007109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007109, "uuid": "6ead7fc3-9eaf-4dee-b21d-b5869b82bab4", "comment": "Malware payload (RedLineStealer)", "value": "4ff18b33738ab9f74bdfd71f96f5d5a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007109, "uuid": "9d86d53c-24e9-4440-9d23-fba7bc86ee0b", "comment": "Malware payload (RedLineStealer)", "value": "eb774744c6fbc52c39115016723e5ecfaf70365a59a176b5e0bf905c218e2f5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007109, "uuid": "7eaf5b49-0ec4-4042-8add-058df7bcec64", "comment": "Malware payload (RedLineStealer)", "value": "a02c9268b2a6085ee56eebdb0b576dcc1b887989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687007109, "uuid": "a9004eb9-9760-4cba-808b-b6ba276282b4", "comment": "Malware payload (RedLineStealer)", "value": "cada3bf3c68679589407c151ce9daa56c56df93491391ebe3214333301ddd0d708e8f0e9b3abfa914d187cc717a42178", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007109, "uuid": "a7c4249b-6d77-4ec5-b16e-04afe3815f43", "value": "T172C4126266E84172D8B43B7068F7038B1735BCB199B8836F379198674C7378869353AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007109, "uuid": "dbce62bb-bd56-4403-8d7b-31fe35af4bef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007109, "uuid": "86dd6f88-1fb9-45e6-8319-b19417b049d1", "value": "12288:rMrWy904WYEobV4Fk1c1nFh0D7Tv4Ym1ZG3SFOYrzN8x:hyP3Eki1X0D7cYyZtFOYfux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687007109, "uuid": "52ccfdc4-2da5-4172-b809-b856cc414beb", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687007109, "uuid": "c8673959-c71e-40e3-9433-19a50d984bb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687007109, "uuid": "ac6db23c-2cb2-4675-82a3-8be535b2e296", "value": "4ff18b33738ab9f74bdfd71f96f5d5a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd7b0a9-0d09-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687004709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004709, "uuid": "5ca063a7-5afc-4245-bf96-18a9b6cb8b73", "comment": "Malware payload (RedLineStealer)", "value": "2b9f7d74789339ab97a279e9347f50f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004709, "uuid": "4f020d29-f561-48c7-b326-c47823d19eef", "comment": "Malware payload (RedLineStealer)", "value": "eb82cfa7ad6ffe0d75239bc8b13441932a7e671adbf620d1b64785ddfd1261a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004709, "uuid": "311de8d4-4271-434e-af6b-abc01889edbe", "comment": "Malware payload (RedLineStealer)", "value": "f5fc789acdaae21b7e31d742d9c3b4dde1a1eaa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004709, "uuid": "45a5ef0e-3dfc-4b9b-b017-d812ab645bbb", "comment": "Malware payload (RedLineStealer)", "value": "f3b482b0962dc4539049dd2a5fa8f9528721a48f646fcceb9d78d2df7e9b79b4813bd6ae57c03ff71ec4959f10913889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004709, "uuid": "208475d6-7a8b-4abb-b5de-4800279111d4", "value": "T1CB052303EBD99067D9F1237148F717871F317D62D978932B2B8A781A08B3690763136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004709, "uuid": "426763a0-2feb-4366-8c1d-75946e49fd2d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004709, "uuid": "83b240d0-40b1-47c1-b4e8-70ce37d11b05", "value": "12288:2MrHy90CddyM1a2ojbNDXSkWjpICAECEZpjJJXIPUM5o1fQb4avznXXUM7:NylzjEj1DXSxICAECoRJlTM5ombn0M7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687004709, "uuid": "cb8c3117-a482-4b8a-b085-84f4483090dc", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687004709, "uuid": "499406db-1a9b-4156-b67a-6ac8a47c46ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004709, "uuid": "843ebd9d-f78e-4087-bee2-201e6ed8d1c6", "value": "2b9f7d74789339ab97a279e9347f50f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914ba3d6-0cb6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686968875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968875, "uuid": "608f2c12-2f01-434e-9716-a66bdf1990e6", "comment": "Malware payload", "value": "5790434340f0fa4d10c40a1cf160154e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968875, "uuid": "42881bc0-8adf-4d17-af44-dcc835a1a641", "comment": "Malware payload", "value": "eed97d5b29667c11f6406a174f77ca08841db3954fbba28c4d89f3595f65be3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968875, "uuid": "188fcf4d-b9f5-4ff7-8412-cd5b239482e8", "comment": "Malware payload", "value": "cedf7e5db855997667998ceae510b2bd16245a1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968875, "uuid": "268868c1-eca1-4065-87b8-f42c71aff7ba", "comment": "Malware payload", "value": "cfa416e90aef850a9f989474fcd35b26a9b48ca20751eb5ba4aae8c2c9ff0cc3773b5b9b87da8b9c424db6bb4f8359b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686968875, "uuid": "e450a83d-b15e-4bb9-bf35-c1d6073b138a", "value": "T18586E85774E25252C0F63BB6B8BD80E431271BBA67521B6A7C05EE383A7B4C90E3D714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686968875, "uuid": "b6feea37-20bb-44c8-9120-ad57cc6cd2db", "value": "49152:MuITyDlN4ZYWO/q1Wa9iRIHIYxL2eid/hABfWTgbPj0XmpB3ljBdpwUB1:MuIIlNQiaWqNHIYUeid/hABfYmpB17p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686968875, "uuid": "4ca0a364-9321-4fcf-8dfd-2041bea0153f", "value": 8060928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686968875, "uuid": "d27ed228-ef1b-4eee-8267-76cea498109f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686968875, "uuid": "df98dc31-c0a7-460e-86a0-7e87c41a2e00", "value": "SecuriteInfo.com.Trojan.Linux.Generic.298044.7139.18692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6cf4216-0d5c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687040208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040208, "uuid": "5acadb25-e265-46ed-9ab2-0b11e9d21f0c", "comment": "Malware payload", "value": "c514804af911269193da0de45020400f", "object_relation": "md5", "Tag": [ { "name": ".NET assembly", "colour": "#B10957", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040208, "uuid": "1e042688-b04b-4299-b940-1e89cc1cd0a3", "comment": "Malware payload", "value": "efa64339d4354cf70e9f5f30f211974379129fd18faa4a4bf89f2db9eab0076b", "object_relation": "sha256", "Tag": [ { "name": ".NET assembly", "colour": "#B10957", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040208, "uuid": "f546d98c-f1b9-4d76-a2a3-2c3b29977b98", "comment": "Malware payload", "value": "98730b11f5937e70a3d849b4c404846a5974fc2e", "object_relation": "sha1", "Tag": [ { "name": ".NET assembly", "colour": "#B10957", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040208, "uuid": "26f3d87b-7e5f-443a-9290-0fbf50e59737", "comment": "Malware payload", "value": "ecda288324c3f7707ca81e8d97549e0f4ca57ef160c4ccbb9e498a7cdbd5003d218182b6bd2e33fe77dd66b0b5474a78", "object_relation": "sha3-384", "Tag": [ { "name": ".NET assembly", "colour": "#B10957", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040208, "uuid": "63e74196-0b2c-4f6a-af38-bbe68846f782", "value": "T10C249E19FF848D23C7668F7AC5103312E6BCF506568BF34B648026EBDE4F39969169B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040208, "uuid": "75643434-2c2f-4133-beb5-e5628734ce04", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040208, "uuid": "5ee09e58-5d60-4492-8c8b-8c37888784b3", "value": "6144:4znGtR6yZ6oJ4bOLTvWccfy5ipTOsZHTNqTRcgRn7jp:4zGtR6a7+bmebKwlodcg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687040208, "uuid": "74ca429c-b13f-47ab-856e-09ccb8a62e0b", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687040208, "uuid": "fa3d629a-4426-4f6f-9a7d-bef40c157c7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040208, "uuid": "c80de369-57a1-4674-b8cc-d6acd41ef298", "value": "ARSNL.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159809b8-0cf1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686994008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994008, "uuid": "3fd3f4fa-6cd7-4d45-9588-1bb9342b3fce", "comment": "Malware payload", "value": "69c04facdf1345f9d9e5d9d0a83ec0d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994008, "uuid": "662cfb91-560c-4058-8e5a-b72e2713489c", "comment": "Malware payload", "value": "efe7a6b0bb347a3dc843ce324981675ca4cb902c031f4e83e6fa137944116554", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994008, "uuid": "88782c48-2a58-417d-a232-d59d0802f809", "comment": "Malware payload", "value": "59933d90cba94aade30aa6b57bfc520af3410c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994008, "uuid": "33e05471-e38c-40f0-918d-a32dead05817", "comment": "Malware payload", "value": "720967fd377267eedd82f21ae331078954caa89f0dcf9015a499c34abe82b38f6f532dad3c985e2ced9cf54328032858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994008, "uuid": "2a77d2a6-21c1-456b-972f-acacb1301c8d", "value": "T180159E217542C037D9B101B28A7DDB6E047CA7780B6659EBB7D82B7E0D704C22E36B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994008, "uuid": "e56b5551-6159-45ac-86ff-194d4286c543", "value": "c1463f822d37a788e4ef3aa62b6260a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994008, "uuid": "2c095d32-e875-4cbd-ad87-23b71897b090", "value": "12288:wLiZJIxFPIUj8fxMbfmQF9GnWRCR4ryaYmFCZ2sNeXw+HYsHC3fve86TslI0XhJO:WoJ+FPp8fxD5Rv33fv56TMI0NxGxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686994008, "uuid": "7ab7519a-2774-429c-b203-e5560c38ab88", "value": 929912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686994008, "uuid": "20c5964c-d25b-4569-b16c-04060611daa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994008, "uuid": "f991b58f-9534-4f9a-bd26-a341ac6c8276", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.31172.5455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809d1b07-0d5c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687040144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040144, "uuid": "b6011096-7d3d-42a3-8dc3-43bca22c706d", "comment": "Malware payload (RedLineStealer)", "value": "fd32ec9d0dc0fc70d69d918d01488356", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040144, "uuid": "b9b5f6a7-d244-48b9-b08a-5d62d39245ac", "comment": "Malware payload (RedLineStealer)", "value": "f13f02aa849c05f3fe6138f313a724a5ceab956da51534cb758659d1eea65b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040144, "uuid": "a8227f0a-1d4b-4b00-95f1-f0b9959a86c3", "comment": "Malware payload (RedLineStealer)", "value": "0f87eaf3ad0cdbc76dd1ffcc358c9797fac58726", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687040144, "uuid": "62d5fd26-dd93-4160-abab-f6a3ae37a0e8", "comment": "Malware payload (RedLineStealer)", "value": "d4fba3efae1795e2706f6f3809f2cf072724f006b15f50c68553d2e5db853daaa8ed5f2425b62d300bd786bef309968d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040144, "uuid": "4a996c4d-2ae1-4e75-9828-49a9546f90de", "value": "T1DBC41212AFD58073ECF527B069FA13930E35BC916D79436F179AA49A0CB2684A43137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040144, "uuid": "ce635667-04cc-4bae-aadb-d796d0c7050e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040144, "uuid": "9074ae4f-5472-4868-a29c-1c4abf750cf0", "value": "12288:rMrEy90/hsvrtIa7M0klZbOXKsIRovSrfpBFDf5+yM:Dyvvrds5OXtarfyyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687040144, "uuid": "cd078139-0e59-4929-b8bb-c319eddd5901", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687040144, "uuid": "912592f5-d3c1-4915-8842-fbfadef038ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687040144, "uuid": "1d00e684-dd07-4526-b1ec-6b9b994dd182", "value": "fd32ec9d0dc0fc70d69d918d01488356.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6343ff66-0d15-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687009600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009600, "uuid": "6cdeb461-0d37-4a2f-883e-b216e33da6ba", "comment": "Malware payload", "value": "27dfae42f3ebdfaaa297df72a4f8aebc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009600, "uuid": "ce20748f-5d3e-4ee1-8168-fc881a39a680", "comment": "Malware payload", "value": "f285a3f8bc508afb8e2be314510e07a50d9447a3c4756dbfc627f6be3bec0932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009600, "uuid": "0d1e5132-b773-4d94-aeb8-a08b982084b0", "comment": "Malware payload", "value": "e496a4a258e075beba311caa1e159df50d5a81b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687009600, "uuid": "b14b323e-db63-4295-aa86-8f7f94865d4d", "comment": "Malware payload", "value": "cf526cdb991c9041db344bad78a24dd3ac3218ac1e0f0a536d7a8f34b2d5d6e06a50d18daaf57ad76a13a26d558ba892", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009600, "uuid": "0e5a2351-1810-426a-a9df-b237bbabd41a", "value": "T1B835F1440EF6BA8DE894727F7230E57546F2CC9E9C31CAA429E2B9E74B9C08560D607D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009600, "uuid": "61021a41-b76f-4363-a0ca-522a5b143c71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009600, "uuid": "67ffc957-9d59-4339-81b9-4f3098738eb3", "value": "12288:GXTCge+nHZLNKGe411cRkpaOO3elralpnF:JwZaHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687009600, "uuid": "2db018ae-c773-4cc9-a42d-19945434abe4", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687009600, "uuid": "9b8423db-8a9c-4060-96cb-746b26233fe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687009600, "uuid": "7980ac1f-b116-43d6-bab2-9f8ba2abeded", "value": "New Quote Equipment dated June 15, 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c5e832-0cf1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686994012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994012, "uuid": "2c601d54-0794-4ad0-9667-c275d3a18a86", "comment": "Malware payload", "value": "542de70f38f3e92bf65efc67ddf63a68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994012, "uuid": "7a327acf-d586-4c76-aa4d-363db0b99711", "comment": "Malware payload", "value": "f291d1df9b40349c8130dadfadd62cc5d40e93459f2efcc432595597f56c1c8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994012, "uuid": "e8291876-a11b-4e22-a99f-847220ab8f02", "comment": "Malware payload", "value": "5974fd9f81f1a59cd6e7154231cc6563c0129763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994012, "uuid": "73255995-53f5-4de8-a635-3b1c70123343", "comment": "Malware payload", "value": "65aaec6f7e8c5f86925d7e937a34081909d681ee099949c3143b6180fdca61d7a2a54337ff0df0884f03d9a83181d025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994012, "uuid": "b5983937-9612-4b36-929d-023c456fe524", "value": "T17B157D217686C133DD5140B18EBDAB7E402DF7150F6AA2CB63D80B6E1EB45D22F31A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994012, "uuid": "80501daf-d849-4767-b5b0-20aef49e44bc", "value": "0d0d97d2f85b771c58a70fa008247956", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994012, "uuid": "624765e2-2ceb-4db1-b0cc-43fe78161800", "value": "12288:fWO6jM8KVZ6RvliY0GAtUHXkKpKGMSYQFaJCJyly0o6em5pr81RqDb94JkgHQ:fSlKVURL0EIaB6eV124nHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686994012, "uuid": "6e9badd2-f391-40a7-9d6e-73ba8c7e8c77", "value": 908920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686994012, "uuid": "5fc272cf-24c5-44b5-be00-6de6f5968fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994012, "uuid": "56627a50-31cd-4196-8038-b0117f172083", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.8850.11340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d62054-0d29-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687018223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018223, "uuid": "9c33bb25-5eae-4ee3-8284-d51d3c0eba27", "comment": "Malware payload (RedLineStealer)", "value": "ded22afc27a535514d65c089f82b1f20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018223, "uuid": "1d97d04e-8abc-4399-9ec4-92acc0dc8bc9", "comment": "Malware payload (RedLineStealer)", "value": "f29e873e023d296d9e662b14509c9ce67e52f398168a948326ecac151678736b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018223, "uuid": "9ff9362e-949a-42ca-ba76-9255840789fe", "comment": "Malware payload (RedLineStealer)", "value": "62fcf76d4a7007403170022c7eaf98072da9dd4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018223, "uuid": "71626ff6-5827-46b8-bca6-a164e4d926ea", "comment": "Malware payload (RedLineStealer)", "value": "83948a5f2b7654b4cfb542c22d73cc11db29511d2176727e4c3a7e91fb91829fa3cd0777e44d6d4c401fdddafdf5d83d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018223, "uuid": "51c3901e-ed1c-4d32-90ce-f33a0b7f9f19", "value": "T11EF41203A5E852B6DCBA177108F706830B367C31687D861777826A1E4DB3AC8E5753BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018223, "uuid": "708cbe99-927c-4385-b91d-e9609b33d454", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018223, "uuid": "f2485ff8-1222-4133-a4d6-56e5f5c0f6d3", "value": "12288:yMrny9097JGw5XTtg9KECJDsmvgOIL5sX0LVxUE8wA7kE9X//c0wy55R/s0pg:Ny+JGw5XTtc4RgcYVqJT/8OLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687018223, "uuid": "9c9d5746-3bf5-4d7b-a9c6-87c13ed6ae45", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687018223, "uuid": "8dc715b2-a289-48b1-af50-491e0d753999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018223, "uuid": "d3751c09-d8d4-4e21-9fe7-c54d119de7da", "value": "ded22afc27a535514d65c089f82b1f20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00df4068-0d0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687004711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004711, "uuid": "518bc0f6-5072-4837-adf0-395f78cd3a82", "comment": "Malware payload (Amadey)", "value": "07eaa3a1e9b320f0d0e8b3e6acdc65c7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004711, "uuid": "dcbe9541-e00f-4d1e-ac7e-091edb95f4bb", "comment": "Malware payload (Amadey)", "value": "f487338b278c7bdadc69358fd533c3b3604ebfc59cf237131b6fbe061c50199e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004711, "uuid": "0e75b22f-0e6d-42ba-b724-70e606122ac7", "comment": "Malware payload (Amadey)", "value": "9a84ba0618ade817f74ec84696f978e835f9d866", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687004711, "uuid": "26afa21e-e32f-4272-b4f0-3653c56e30fb", "comment": "Malware payload (Amadey)", "value": "6fd9b57b8ec9adbf40d6a62d99b18ac02c63c96538a09bd133ff330743be225ae6af1537e0ee05dbb329b2e389dcabf0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004711, "uuid": "76aa72e8-9471-4ec2-8558-13984f96fad0", "value": "T154052353DAD84473DCB93770A8F606830B367C529D74876B7786DC0A5CB2990A930BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004711, "uuid": "bc6dd562-ca4d-4201-a453-edf784df0e31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004711, "uuid": "02649a20-d78c-4ad0-9a38-a7b4795cb819", "value": "24576:8ytZZrQOEJ6Y5V684wM+7hmAH+5fCskYubMPOFCqx:rrZrQOQhj68hMymL5fA5JC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687004711, "uuid": "fdb093e5-eff0-4e67-ac53-e53d8741186e", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687004711, "uuid": "7ca1489d-ee9b-4f05-805e-7354da63305b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687004711, "uuid": "242425e6-d4dd-4aea-8f0a-62859cc6b622", "value": "07eaa3a1e9b320f0d0e8b3e6acdc65c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da13754-0d42-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1687028784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028784, "uuid": "364f754a-494a-4808-a529-394d6cec585b", "comment": "Malware payload (RecordBreaker)", "value": "e94ec358349808b167fe25704bbb1c43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028784, "uuid": "a329d58a-a47c-4f36-ad35-43ed68b240fe", "comment": "Malware payload (RecordBreaker)", "value": "f63154fccd7521dbe450f56aefff2a73d199489f8b68be7bd03befc5a98ddc36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028784, "uuid": "65db6992-f98d-472d-93fc-6a0e0699e695", "comment": "Malware payload (RecordBreaker)", "value": "6c48cab4905b96605d64de1718c6fe07b17392c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687028784, "uuid": "4349740a-8d01-427f-b36e-5b60b550a494", "comment": "Malware payload (RecordBreaker)", "value": "04e36d6a9422c53a1071cd0858b133fd8d73e2a2cdfcae5358081f28e234623e1c76be15c673d28513a7a2c441cd59c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028784, "uuid": "7476d226-9e5c-4a7f-b8b8-d1527e4a913f", "value": "T12E747A256E5ACE0EC37B303F449E08F603E7D99517A2DAD929875A78378227378471CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028784, "uuid": "6b4d7f64-3a31-462e-9a82-740914d59a5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028784, "uuid": "520e578c-6805-4118-9111-3346b6a815cc", "value": "6144:b46HZImXdPNhShn6XpLaJba4XcwfkBYuOVx6rfWd+V9nJ2/FnRy5pg:b46HZlXXhOnY9a9PswfkBYuo0DLnJ2dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687028784, "uuid": "e59afc50-0f7d-47e5-80fa-81ac3454a98e", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687028784, "uuid": "e9be7580-f6e8-438e-b136-606026419be8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687028784, "uuid": "4457f5f4-464b-4147-8589-4fb5ea887330", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ba9c76-0d48-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1687031623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687031623, "uuid": "91e90a8f-df4b-4259-979b-b506fb04ddc4", "comment": "Malware payload (Spambot.Kelihos)", "value": "dace17f865a1d8fe64b527125e7b9694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687031623, "uuid": "85f19222-330a-4cdc-b05c-3506b04c4381", "comment": "Malware payload (Spambot.Kelihos)", "value": "f65152edceb657dc8745194f2b3f0c02ec64b82e4131fe6859afadaf4e39a87f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687031623, "uuid": "b0275b0e-053d-47cc-883f-58e769b61999", "comment": "Malware payload (Spambot.Kelihos)", "value": "f8dce1d0cb66947b49021fbd4c26282d95fdd11b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687031623, "uuid": "e1ec21ce-733e-480b-8621-667bcc50ab8a", "comment": "Malware payload (Spambot.Kelihos)", "value": "346bf67a54db829bbae4336eaa2e9ad9ccf26ae35d38366311b39bdd50c0fff7994ea2ebbed34607f806c2204a381488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687031623, "uuid": "da51d9c7-e2cd-48d3-b0af-7785eaf3e9aa", "value": "T1C544291235E0FD24D445087F7479429BB6AE68DFF7E8C4F6122420DB6A172892F7A336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687031623, "uuid": "a3a5065a-9de1-4e94-8f12-d0f9d7e36bc9", "value": "8b20c0aa1a6b70c064e1b0a2222ddac4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687031623, "uuid": "71cf8097-df5c-481c-aeb2-560b5cfafeca", "value": "3072:vs2/e4Uyd4SnJtByeWOWhmkIPmVtxsKRIH3Crpq1brlz1Zpt0xu:E2m4UyOSzNWhmzmVtxsByrMbrlzr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687031623, "uuid": "20f7a676-6b8e-49c0-aa1d-00f2ff02329e", "value": 270608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687031623, "uuid": "d3d9b1da-a077-49ce-a2e5-bf22e7583f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687031623, "uuid": "375d2d1b-4590-4208-9bef-890993bfa130", "value": "f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2945c7d2-0ca2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686960111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960111, "uuid": "64b29954-6d26-4126-b9f0-3f7db169f81d", "comment": "Malware payload", "value": "15aab611795bcbf2758052944013be1a", "object_relation": "md5", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960111, "uuid": "f4c53f28-c642-4148-9f62-447aca5b5db1", "comment": "Malware payload", "value": "f8dbc6077f6b01c6eec334061d687ff1b291a2aa5513cf1e0b5bde4a8dbc5588", "object_relation": "sha256", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960111, "uuid": "d1ef5ebe-08f7-4b51-b03f-0b83efd140f6", "comment": "Malware payload", "value": "772a1002b111e117cf3b1e9f0cabda4894777399", "object_relation": "sha1", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686960111, "uuid": "f697b1ae-f82e-44e8-9def-361a10c3095f", "comment": "Malware payload", "value": "7fab607de3600c25709c2882838d3cd5b8c4379f8ed7e7a83d9055e69ddd5c3ca1e7cea8ec4a77d9b29c960dbf8ca9f0", "object_relation": "sha3-384", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960111, "uuid": "989127f8-5a11-4d03-9b2e-ba6fda6566b2", "value": "T1EE23BF25AF87C63ACD2C6F7D882905021375F348B523EB8F295A348CDB32B564712797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960111, "uuid": "85ebd8a1-5b69-493d-aa99-c9649df46280", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960111, "uuid": "19032c38-3c0f-4c83-91da-49cf9a230889", "value": "768:EJucvUiY7u2Of2G9WH6qCzxZkgd7+99mb1doJsmNGAdCauHdF3G:EJuWUdOt+6qCzxZkg1+99y3ow32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686960111, "uuid": "f10abf0e-b8c8-485d-bb45-23fa095501bc", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686960111, "uuid": "532d4ca2-3a36-4dbc-b339-9b637335bde8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686960111, "uuid": "eed213d9-40a8-4e91-801c-023823a088a3", "value": "sc0pe_hidden_pe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed23defb-0d22-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687015415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015415, "uuid": "e9aa58c4-99a9-456f-a6c6-59b930e49e5d", "comment": "Malware payload (SnakeKeylogger)", "value": "cab0c43f0cd78002cb9358ce8da09d50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015415, "uuid": "a5b2de2b-1ff4-4b23-a927-9d7564a9904c", "comment": "Malware payload (SnakeKeylogger)", "value": "fb6e4afd484b76beb9d9d0949a28f534a005535b7cf7e2295ad7093e0dfa1202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015415, "uuid": "a961324c-0afa-4047-8dd9-841f9d11e884", "comment": "Malware payload (SnakeKeylogger)", "value": "0baec8bcfc17df3f8e828c82c2ed47f108f0f79c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687015415, "uuid": "00e5772a-b7ce-4e29-8a58-52dd88ea7aed", "comment": "Malware payload (SnakeKeylogger)", "value": "315b0afac04f6eb32a346a67cf3cb70c9713a3c19f5d02ca5e2c2122745c2a2f285fb8f46ce0dd408db5852dd58371ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015415, "uuid": "2978e063-4679-44e5-9b5e-75790b08e932", "value": "T1F41583B9294036ABD775EEB241E2195BF23B736772235CA826D213C2462150F37ED90F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015415, "uuid": "956d5d13-3a2d-47f1-9dec-6727eec6b5c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015415, "uuid": "120e88b6-1a37-4626-ac0e-8a17a3777470", "value": "12288:23KsQeOaU0T0twaH+s1Y/nbbl6yxz9lFksEuXPabMUQe2ld:xerTawts1Y/nPl6yxz1QuXb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687015415, "uuid": "bcea0019-2114-4f86-936a-70b14c17851a", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687015415, "uuid": "01b45d0d-40d9-4746-b3d6-a5a0e5710080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687015415, "uuid": "b3655379-9888-4212-adbe-a58fe3a324b2", "value": "BOI PAYMENT KGA INV. GE210228C ADVANCE YATANDZA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170d2618-0cf1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686994010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994010, "uuid": "c3691af8-db62-4eb0-bbc1-bcb55873de0e", "comment": "Malware payload", "value": "7cada09f584b144683e6608ce2a6b6ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994010, "uuid": "c955dee1-2000-483b-9723-815a52c9ed2e", "comment": "Malware payload", "value": "fe01e629e25da5b03294dc0dfa6c3ba1a11321268715d7fa4d108eb31db06aa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994010, "uuid": "6e5ccaba-76fa-4206-8ce7-e869d564291d", "comment": "Malware payload", "value": "1f5de69c90d1344482dd4fd2f8e32da480eed783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686994010, "uuid": "04dc7241-4beb-46b2-b9a4-1e2471dd8f64", "comment": "Malware payload", "value": "c15d8722742fcb3bd1269b8fd71ba651bb48b9ebfec756a4bbc5ace8e9106682cd634112c4b27b1e39c20d609f05ab08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994010, "uuid": "2311ca26-bd66-4bc5-bb5a-38262c185c95", "value": "T1B8C59C227752C037D5624271492DBB7E457EBF600B7282DB73C81B6E2DB05C36A36A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994010, "uuid": "50a6701f-d89b-4db4-8edc-22ad5cda5bea", "value": "179dbc09b90d2519daa2dbe790f25102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994010, "uuid": "64a21949-3dac-43eb-b52f-8d1f5cfe53be", "value": "49152:vSWBLrXko7z2Qc7fcWOg+FYty/8trbI+qqQHTrFYvSHjHHl3:vS6LzkWz2QYV+FYAkXz8cujH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686994010, "uuid": "ed33f919-817a-48ef-90b6-0ceb83427be7", "value": 2529400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686994010, "uuid": "e62b894a-d762-4632-8da5-d2d581f78e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686994010, "uuid": "0b8bfd8b-953c-40ff-914c-75407a03c75e", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.18742.5990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c90d53-0d1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687012817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012817, "uuid": "8dc68782-32fe-4e26-900c-16ee216c54e9", "comment": "Malware payload (Amadey)", "value": "94ca4775d90c8a3d5e2f130a0d36c428", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012817, "uuid": "f52d2f7a-2b32-4c42-a567-59f7ae9782c3", "comment": "Malware payload (Amadey)", "value": "fe07da6735b39c3c27f0f3b6d79dcc252ed160fb15bb408df1d85543e041c1c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012817, "uuid": "d2815123-e65e-4b11-94e2-66ba8761a679", "comment": "Malware payload (Amadey)", "value": "f9fa8afbcf3a1f816cf871e65bca5d57c1f37e6a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687012817, "uuid": "89178fa1-813d-45c8-b56e-d7c49a5506a8", "comment": "Malware payload (Amadey)", "value": "b13b3dee920c13c58d84d26ca060cd8036c6ed51c13e44a88af01320cb79933b22ea3a70bdab792fac62665a67f17c52", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012817, "uuid": "9417744a-ca0a-47a5-b126-69917df0faf1", "value": "T13B051203BBD98573EAB40BB058F603870A31BC619D7486AB3795994E0C727D5A83277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012817, "uuid": "db55e94a-c0c5-4d67-9c44-242279809c95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012817, "uuid": "2a3352a2-238f-4645-86e8-79f20b20d3b0", "value": "12288:fMrCy90N4AwVhN5JnwVzhWXXQzA3SRcH+UgR3jy+UlFOHPjaK7J6JPO0Q:JyfAwVYbot3S+eUgR3e+UlFgaeJ6J2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687012817, "uuid": "0ff94c9f-7e05-44c2-adec-3de7994668ba", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687012817, "uuid": "08c3526b-fb6e-44b7-9e43-470c4093ab64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687012817, "uuid": "b9ca3447-215f-4a78-8846-33f10cfde49c", "value": "94ca4775d90c8a3d5e2f130a0d36c428.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b80ff5-0d29-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687018221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018221, "uuid": "b3b740ea-8209-444b-8a89-9dfc20540b90", "comment": "Malware payload (RedLineStealer)", "value": "a2ab0a1d7004779e34c7516f59cd6fdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018221, "uuid": "5b44860a-2e79-473e-9a88-99b3d31d16ef", "comment": "Malware payload (RedLineStealer)", "value": "ff334dc8e2d590d41d79dc0e75f12b5a9c818ffc8191c392046bf2bcc2da7e44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018221, "uuid": "dd93f8a9-2db0-4a11-94b5-d24b80d03b00", "comment": "Malware payload (RedLineStealer)", "value": "b59a10adc72027e46e286d36a8799e50ffce0823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687018221, "uuid": "e02abbc8-33ac-4498-b5d9-284c37a56708", "comment": "Malware payload (RedLineStealer)", "value": "9c842830fbf8befbe3455b339c4d4d1334dff321369affb3a8a6335d58843dd68de0c7f4a375749c4f81d914288f39da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018221, "uuid": "0d39859c-6a20-45e0-b4d3-f3a8b3ddd516", "value": "T1250522069BD98531DEBB237119F70B830A3ABCB16C25566727059C9A1CB3ED4B83133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018221, "uuid": "d297afb1-746c-4266-9823-00ca76e05d1d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018221, "uuid": "9ef59c0d-a695-4fa5-883f-e199fb199108", "value": "12288:PMrKy90g3GJy14D052/+DxKuTn4sUJMAanwqPWaR7CI+UUo6w0KtzShLb066JRye:Fyr3GY4DP+DPGFan5R7C7jw9N2h6JRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687018221, "uuid": "9dd80f5d-41b3-400a-916c-bbb860051856", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687018221, "uuid": "b676a805-7547-4939-ad25-e17c8a153f49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687018221, "uuid": "dd4b7d0c-d6df-4099-8b3d-7e0b4fcfadb1", "value": "a2ab0a1d7004779e34c7516f59cd6fdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90279e27-0cb6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686968873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968873, "uuid": "fab7f835-a9ab-48b3-b891-1ca260546c18", "comment": "Malware payload", "value": "928db59752a6e8a56dd35f1498bac085", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968873, "uuid": "0c530d8e-fff7-47e8-b0d1-011619077e05", "comment": "Malware payload", "value": "ffa6bbc7b601dd97ff4c831169b58768ff9b31be9f61979f81d7a0f81fa513e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968873, "uuid": "e7963a37-da18-4666-9236-8ec0cc19c63f", "comment": "Malware payload", "value": "9cde8d7b1e991667775a1c8ff883913a991c091d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686968873, "uuid": "60df2b28-8486-46eb-b28e-c52f428959bb", "comment": "Malware payload", "value": "fa26bc31b54105f7e2888314ea62ae5cd1f29dcf056debf7e0db30e420bfa18c213dd747780a68014e2474ec343aac14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686968873, "uuid": "8420ce92-47cc-43e2-b370-c7045ad66303", "value": "T17A96A404ACC42EBFC05C5B7464EB897926745D085FE21B2A1665FAC87CA62357F8BCCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686968873, "uuid": "7bab505f-44d7-4c26-9878-d06cd159e6a2", "value": "49152:KEuGNpM76cBY7oTXgvLmhuiOHiCNiL46igyTjG1PzgY1R1:K0Npfq4mhXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686968873, "uuid": "6ccff5a1-af7c-4ba1-b115-924c8078f326", "value": 9437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686968873, "uuid": "2f7f1b43-7645-4fcf-af58-e7bf4587fc29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686968873, "uuid": "e26d2020-9545-49e2-b387-e9027e845520", "value": "SecuriteInfo.com.Trojan.Linux.Generic.298101.1470.26247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }