{ "Event": { "published": true, "date": "2022-01-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-01-16", "timestamp": 1642377781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "38e122cd-fb5d-43ed-899c-8e9437397437", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c562b140-76f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1642354560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354560, "uuid": "e85fad3e-df31-4306-bd8b-3acc339431f0", "comment": "Malware payload (Amadey)", "value": "6cab16e43f8e50ade94c350ea29a3ff5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354560, "uuid": "b7e8136a-795d-408e-b773-171554fc59dc", "comment": "Malware payload (Amadey)", "value": "0020d4df86d5fc878cdf9f071d1fd10821335649eaf1f39a1f891b6c0769b6fe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354560, "uuid": "9426d3e8-2da7-4e0d-93ae-ef6134144ddc", "comment": "Malware payload (Amadey)", "value": "00885d315a2719948b575ceb6700b86b2b7419d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354560, "uuid": "a4d153f1-63e6-4985-a3ad-9c7fab5cee76", "comment": "Malware payload (Amadey)", "value": "fd7236fa6f6f00022c2597e400ac8f68c3a40731f46fca5b82678938d0f853c0b475ac0c1342b47c6bfaac2bea1e1dfd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354560, "uuid": "7d4aab2d-5e37-4823-92a8-c906abb903d5", "value": "T1A2549D10BBA0D035E5B712F84A7A97AC752E7BB15B3490CF62D12AEE16396E0DC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354560, "uuid": "755002af-7457-4e2a-a83d-d784bfb077da", "value": "80720d283b0420bbcbb388cde3e0df65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354560, "uuid": "b94d47d0-45e2-46ae-a191-9a05d2d89c11", "value": "6144:Z9h+IP2paCHVJPqt2W7cMVB2hLqiJDIel8hxoB+ZRnjjmEiA9gu:ZL32prbit2W7cMahLLNIel842RnmEhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642354560, "uuid": "b3ee2774-f39e-4882-82ba-dc288a134616", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642354560, "uuid": "e1b6907e-bf81-42f8-89f5-6853efad2bfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354560, "uuid": "200c53ad-da79-4679-9b65-7b53c050a99a", "value": "6cab16e43f8e50ade94c350ea29a3ff5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c274ae3-76f3-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1642354840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354840, "uuid": "b2e43f36-0b15-4be8-b84b-f0722cd2d88b", "comment": "Malware payload (CoinMiner.XMRig)", "value": "b38741d11200bb9c6355c9aa38c14021", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354840, "uuid": "137ce1be-815c-40e3-83ac-bd2b60106a19", "comment": "Malware payload (CoinMiner.XMRig)", "value": "003a673f0f61eced958f28f97b647d5e574a698285e602f197486d0e272a0ec0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354840, "uuid": "37f0e8f1-5290-458e-a6aa-bfbdc420f0c8", "comment": "Malware payload (CoinMiner.XMRig)", "value": "9ee9aa21473361e65ffbf98c52aa32ebb1502832", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354840, "uuid": "988a998c-3398-4b88-b6aa-2adf0ca84a23", "comment": "Malware payload (CoinMiner.XMRig)", "value": "4b9fa4d74cfa2cb5832398f5da49ba486baa7f30590c11870011c4177e5aec05d3c959f3787f583d6d966563e46a0f9c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354840, "uuid": "61527b8f-f689-4d5d-b4a1-4df0364459bd", "value": "T1E5649E10ABA0D036F4B712F84A7A93ACB52E7AA1573490CF52D526EE56746F0EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354840, "uuid": "6746b286-0b86-4166-810f-b1cac3057ddf", "value": "50ed4f508f1ae415f83955c4c39766f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354840, "uuid": "45873157-9633-42f7-816f-8248ad761da0", "value": "6144:AkRgFfao6JpShQOrvE5PzuNKHsv1dH/bH5W6/akJ:AkUfU8br85aNK81ljHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642354840, "uuid": "3f5c9a27-f416-4852-980c-a6ced94b2807", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642354840, "uuid": "c775b8a7-5252-4fa9-83b3-0273acf09a9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354840, "uuid": "1fd8a1a8-8374-4462-833b-e3a3d5f074f7", "value": "b38741d11200bb9c6355c9aa38c14021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f7aa6c-76fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642358371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358371, "uuid": "cf9fbabe-d0e8-447f-adc0-c593d06bde8f", "comment": "Malware payload (Mirai)", "value": "ca9dfff9af7fb8b3c415ebbef0d312ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358371, "uuid": "f3ef67c6-c26a-4564-8783-fa9d03beae45", "comment": "Malware payload (Mirai)", "value": "011886d4e5f7774f3d576f6de2605ceef27298f7a4db7166da30834578673c29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358371, "uuid": "664d979c-ffb9-46cf-bdbd-6f4e1a16864e", "comment": "Malware payload (Mirai)", "value": "8f73d1527cf8474d1e4a9258b5c95bd1700bfbc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358371, "uuid": "6a92e2c8-176e-4e31-979e-c8bfc45d69dd", "comment": "Malware payload (Mirai)", "value": "4a3b9beb6863f430fd300fae077dac401f47bb1f0339d34d20fe5cac648b2ec82cd06ec1495e3a0c320d2e31eb484fd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358371, "uuid": "a60659da-60a4-48fd-911e-931f7b033688", "value": "T1D4936B21B43E2B13C4E1B07F11B7875AB6E067CD26A8C61E7D760E8EFF2254025539B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358371, "uuid": "696a0f07-4d82-4ecf-9222-50bf9c9add83", "value": "1536:rOJ4SOlvhCqbCsSIVvkxg4WgiBnQ8wZCPm2TUHe:EmQIgP98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642358371, "uuid": "e676e6ed-ac27-4f61-b53b-af5c921e76a0", "value": 92816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642358371, "uuid": "b5296cee-0ebd-439d-a185-53a01b7daaa8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358371, "uuid": "f8c21d7c-12fc-424f-a739-802c42962b30", "value": "ca9dfff9af7fb8b3c415ebbef0d312ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e05c82-76f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1642354246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354246, "uuid": "0a9dee03-d2e1-4563-b710-e14bb37193cb", "comment": "Malware payload (Amadey)", "value": "1c61cd1a7ab4d2a34a0bea3377a533cc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354246, "uuid": "0ea91f56-04ce-4748-a9a7-f1ca33e0a09b", "comment": "Malware payload (Amadey)", "value": "056c064ef385bcc1cd430cb7b88e82f0566d1182c80503fe26f1fc9732fc42f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354246, "uuid": "509f00a6-9de8-4035-8c9d-7fe291da0545", "comment": "Malware payload (Amadey)", "value": "9b0eb0d270163edb9a59625cb4c6fc4aa395d85e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354246, "uuid": "edc7783e-2e19-4dad-929f-a0bcb4323558", "comment": "Malware payload (Amadey)", "value": "fc9162066c5b9779a0e4b0b5904f677fca9bfc79411da0b07f82ed9173d24b21750b0e7d8d35a632f216cde5ac68010e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354246, "uuid": "ed4d28e3-8ea7-41eb-aefe-d1d07da120db", "value": "T17864AE10AB90D035F5F756F84ABA93ACB52E3AA1573491CB13D52AEE4734AE1EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354246, "uuid": "e7b0bdbc-be37-4a00-b95e-a80020d718db", "value": "ece6f983f2f5d858525c32a5672c95ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354246, "uuid": "af28f78b-63ad-4306-af07-ca997bdf0fc2", "value": "6144:yD/z8Pg1iaTdGa5j/t4BxK5hZrVThIkKhRoIQ9f3s:yD4Y1izQ7tWKFrJGBHohs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642354246, "uuid": "8e0aeabf-a194-4624-b477-e4a7ed239227", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642354246, "uuid": "731d55b1-11e5-4a0d-8c63-c820be2005b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354246, "uuid": "d02e6989-68f2-42d7-a330-c65d2f7c67a9", "value": "1c61cd1a7ab4d2a34a0bea3377a533cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a2c42e-76a0-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642319159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319159, "uuid": "88555da6-a3aa-4daa-91d2-6ad2661fe252", "comment": "Malware payload (RaccoonStealer)", "value": "eec7b28e8cf1ae57605db6f776ed3cc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319159, "uuid": "16a61248-2b9c-4bbe-871e-6407935eeb36", "comment": "Malware payload (RaccoonStealer)", "value": "05924fcfe05184156437867b14dd30ad1724efe49dd8e5a8a65e97104f9b2c2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319159, "uuid": "1e2ae7b1-6eb5-423c-afd1-7ebe1a65d056", "comment": "Malware payload (RaccoonStealer)", "value": "db32f2f425ddb29752156f226a9eaf29c4c9cde5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319159, "uuid": "ccb8099e-5cde-438c-90ae-b6b671b032bf", "comment": "Malware payload (RaccoonStealer)", "value": "11c295a2988655687e816dd4418a7a11afe7baf7e85c917c415c9015a47de75a51dc1c974ef1b8f201f160c49c8b01eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319159, "uuid": "b0317278-cb2a-4bfa-afe1-ba6b9f3e7e72", "value": "T15364AF00ABA0C035F5B762F84AB6976DB93E3EA1572454CF52D52AEE57346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319159, "uuid": "0494ff6b-e4ff-46b9-a740-4f587eab361d", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319159, "uuid": "f9868410-dbc5-4b45-b833-728814baae12", "value": "6144:9jDSGba0SnbVERa8FtrWTJ51DO6/GvcO660VNKJxWuP:Vrba062RHp+J5NO6/GvcQ0VATn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642319159, "uuid": "cad08c9b-e627-406d-b648-7549e5cecce7", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642319159, "uuid": "8e9a286c-0a66-4e1d-b52a-5bce823652be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319159, "uuid": "152e3d03-592c-46ff-ae39-951a7ee427ef", "value": "eec7b28e8cf1ae57605db6f776ed3cc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79eaf238-76a8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642322651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642322651, "uuid": "0713da69-b68d-464e-8869-e609b36d51fd", "comment": "Malware payload (Heodo)", "value": "f016184f73d73a5a2d4f0faa4422edd3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642322651, "uuid": "32c7fdd6-b032-4991-b51a-9119f9470d2a", "comment": "Malware payload (Heodo)", "value": "06572b9631c3109f4ada0dcc6487b276a6d08959412a30c1adcea358a9fd778f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642322651, "uuid": "d4bb58d2-d46b-4f25-8b16-871b4e44f4b2", "comment": "Malware payload (Heodo)", "value": "375109710e352ed69e9406d5719cc17a8ac56878", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642322651, "uuid": "a7f5af25-ee8c-406b-af67-ced92c6975f4", "comment": "Malware payload (Heodo)", "value": "808504f4647941f85702bc636eac22f4bc09b5cc10c3aa6c4bb663f6251aeaef1eb574a5a6e6b447818e3fbc4b47e711", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642322651, "uuid": "36927c57-ac9e-4bf4-9341-92308a0e5d5b", "value": "T1F965BF01758188B3F91725390178B7664FDDA5200BE0DACBCF8CE9BA5F22EC25A3655B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642322651, "uuid": "d020baa4-a20a-4f02-a53e-bbc84fa67d2e", "value": "802d3531cf29669282ebab37f1b13cc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642322651, "uuid": "feaa4072-f222-48a8-b976-032b0fad5d19", "value": "24576:sJLHyhGvu4kNsYS8MSDdY5G8q3nSlSBXa1IAYyTCwk+qIgvozb8U3G/cGFqtz+V0:s8hGvrIvSlDTCrLwzcqtzJQ8k/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642322651, "uuid": "18049bcb-58e5-4b0f-a7a7-14ef9e169400", "value": 1419264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642322651, "uuid": "06a9dd52-558b-44a9-93eb-e5827002ed91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642322651, "uuid": "1ef2645f-1f62-4c4d-aa50-ab34d1dedc39", "value": "emotet_exe_e5_40e4e3fa4f0909c68907ddab0b2f15f2df1549dad389b934e39ab303f4f7cc2d_2022-01-16__084405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b07c15f-76a2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642320076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320076, "uuid": "557582f9-d5f5-430f-ae49-7556cd1095e1", "comment": "Malware payload (RedLineStealer)", "value": "6d0aa5a46d42aeb89ae021022dd4ed52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320076, "uuid": "c268d162-572a-4c85-834d-2b575bf5b399", "comment": "Malware payload (RedLineStealer)", "value": "06a191ee9ed99173ccc34c5ae7adde8722455703e398b98791d543a3736b4e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320076, "uuid": "4b709105-b904-4a72-bb50-7d69725d5c56", "comment": "Malware payload (RedLineStealer)", "value": "fefdd50a29d84feadc9d586ab23dd7762b587489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320076, "uuid": "5bbe216a-cb54-4e0c-a765-7c67d6207f6d", "comment": "Malware payload (RedLineStealer)", "value": "201e29490390911a276477f75025f807c021a8990eace89f23230e19ca09fef049de4ff812f641a1df6e4dd9c4b8209b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320076, "uuid": "9efdf537-8b13-4da8-a677-042e438fae1f", "value": "T1BB649E10EB50C035F5B612FC4ABA977CB92D3EA1572490CB62D529EE5A786E0ED3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320076, "uuid": "5b9c41b4-882b-421a-8052-61fe6cf7f9c5", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320076, "uuid": "8e6021ee-9e2e-410c-88db-3a7c161bdda4", "value": "6144:nW9kD073XPZbuSagE/4070Vh5p1/cOPAHjFKjqr:WiD073XPISGAK0VhL1/cVHjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642320076, "uuid": "f4dc5e35-6d00-4548-88c6-fa3b179127f8", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642320076, "uuid": "524f2ccc-0d68-4464-94e5-159b1e7ec126", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320076, "uuid": "2173a376-cc49-44cb-86d2-c5848c2aca3a", "value": "6d0aa5a46d42aeb89ae021022dd4ed52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52bb2cf3-7706-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642362958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362958, "uuid": "b9bc7e24-a477-431b-b933-c477f162060c", "comment": "Malware payload (RedLineStealer)", "value": "7b3af22cae6ca4526b829aaad0c989d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362958, "uuid": "dab03010-4df4-43fe-ad08-1ded663f0b8f", "comment": "Malware payload (RedLineStealer)", "value": "06de7a6020311d1148c053a1b4d620a556e4ec46c670b44f1f280b4fbd68dfd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362958, "uuid": "6a5741bc-9710-4408-8fe5-e487866e9150", "comment": "Malware payload (RedLineStealer)", "value": "a0140082905c7285c3ef56a8b5970a0c20f2898d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362958, "uuid": "bafdc4d1-69cc-4b85-bdf7-a04c3013b32f", "comment": "Malware payload (RedLineStealer)", "value": "bbb3041e61c61358b6295dc4bec8b6173ead6aa5035c8bcc770a99aef7e473f1ccbe29e1cfc6091e4a286fedaa6dd01b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362958, "uuid": "6f246ae7-c233-492d-9ece-5137f291de33", "value": "T1FC54AF10BBA0D035E0B712F84579A7AC793EBAB15B21D0CF61D526EE26396E0DC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362958, "uuid": "01cb947f-9d49-40c6-8323-54b45db4cba4", "value": "80720d283b0420bbcbb388cde3e0df65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362958, "uuid": "a6be797a-1426-4b83-a709-b3f3bf4102fe", "value": "6144:39AzzU3+a3VhJin3yrfH+F8WXfqWqJ7+UFgoaiaURu:3C03+Kfw3yrfH+ZXfuRaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642362958, "uuid": "4ca3cedb-ce86-468e-95d4-f26be0cad746", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642362958, "uuid": "ef0a64ff-9c62-41c3-8ab8-97980aa3a7e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362958, "uuid": "ff5ae496-70e1-42fb-b16a-2c3320becc0a", "value": "7b3af22cae6ca4526b829aaad0c989d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115ba786-76e1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642346957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346957, "uuid": "27311a04-82f5-42ca-92c6-6c1851491928", "comment": "Malware payload", "value": "a84efcfb8d7aa6e3704236349311e21a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346957, "uuid": "a41c03d1-6495-443c-9e53-fdcad8e8ef02", "comment": "Malware payload", "value": "09dd8836bf86c86ef2a931a9c5f1f75e2f870c9ef8f5ceda6020eb6f56227b2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346957, "uuid": "c918c028-9c5d-4482-a6f2-1ebb3ac5f9c9", "comment": "Malware payload", "value": "6a5913b2d49daea499695c3aa2e2d26423a99575", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346957, "uuid": "09d8cc37-c4cb-4371-b9a2-ceb8df126bc8", "comment": "Malware payload", "value": "7dc4e74aec97ccf57bfa8b5a0c98f56f45813b3891270d44bae9cae5f24825a410b630ebb8de4f1e4b541a818859ea6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346957, "uuid": "23aca514-dc26-4401-a329-7d1254af7419", "value": "T18AE2F15D1C00B5ADD833597923B713B048352FE63B229C09AB73E227AE417627993ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346957, "uuid": "409ca542-69f7-41a3-9223-31484636c014", "value": "768:nmQSRhK6y2j3CX+V9H2Ig88S7W40+bJgGlzDpxYsi:mQSRhK6y2OuLH2w0+RVrYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642346957, "uuid": "700ba093-78f6-4677-aba5-9c61a0e586b9", "value": 33344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642346957, "uuid": "707fdff7-a06f-43f6-a059-dbb5d39f4556", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346957, "uuid": "8512869c-d58d-491b-abeb-b50475ffda29", "value": "a84efcfb8d7aa6e3704236349311e21a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd96ff2-76fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642358222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358222, "uuid": "07634a50-806f-4641-92a0-1ea510cf90aa", "comment": "Malware payload (Smoke Loader)", "value": "61240741c4ef2161ab5824135ed92e3f", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358222, "uuid": "7b47ea68-3774-48d3-a4ec-40fc8446790b", "comment": "Malware payload (Smoke Loader)", "value": "0d8b03ccf47db19028069b9a0eab33121138fda2d66d8fb89db6aa28f4071c35", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358222, "uuid": "8db30cd4-ecec-4272-95d8-754246960f82", "comment": "Malware payload (Smoke Loader)", "value": "47bb2a076fbadf5e4c561c4247168af0d81cc5f7", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358222, "uuid": "ac80e471-c53d-48f1-ad8c-d4af428b2269", "comment": "Malware payload (Smoke Loader)", "value": "acd4d45f9f07c28549961d9ce7f7f0494f0cddbe433697306f5bdd52d6d2b2e4266b4d9181c7231b462c2753535c906d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358222, "uuid": "65064fad-c51e-427f-80eb-7e4e285bbfed", "value": "T1EB64AE10BB60C039F4B712F84AB6A36DB92D7EA1572594CB63D529EE17346E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358222, "uuid": "0770ff2f-c3d4-4417-b610-4ab33dd2b6c2", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358222, "uuid": "aef172b9-0a1e-4e09-ade8-fd23a837986b", "value": "6144:iGMymNsCPj5SYczcyagF+kYUnkxpGMucO2WatRmcdi:VCQAycDOkxpGMucQatY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642358222, "uuid": "9e29208b-c714-4f21-bcbf-609e0b457f7d", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642358222, "uuid": "834f2779-a25a-4004-90b3-7a271c38ba22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358222, "uuid": "ca3ba870-acc3-4f00-a35e-1d9d5161fc9e", "value": "61240741c4ef2161ab5824135ed92e3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da27830e-7692-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642313363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642313363, "uuid": "6d21fa68-95bf-4016-87fd-166985513c2b", "comment": "Malware payload (Heodo)", "value": "24a0bac97a6dbe4712d3f074bb9fc720", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642313363, "uuid": "e158760e-015d-4801-9fe7-45deb4652b72", "comment": "Malware payload (Heodo)", "value": "0f91cf2df2b5508e8c521a9036e05f00dff7be1a6a897b95108d4a5b1bc961a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642313363, "uuid": "bee83d73-44e0-4f65-8e12-6741d6a2dc9f", "comment": "Malware payload (Heodo)", "value": "ffc03e8d92054b6df79a5a67551fda4060c4898c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642313363, "uuid": "8432df16-863c-44cf-ad39-68026109e28f", "comment": "Malware payload (Heodo)", "value": "839fd701e71d7dc6760ab36889b802264807b2d022e793688d9300b8e2d9537f8080c095347fdc13aea22656a26bb408", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642313363, "uuid": "d8ff6857-cb66-4f50-a263-c2ea7802fae0", "value": "T1EEF4BE127A82C072C16E31B4459BE7B966FDAE704F3496C7BBD02F3E1E741D15A3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642313363, "uuid": "de3b6591-f883-4dd8-9536-27b965f9912a", "value": "d986dd84d593c1266f1531c47644f308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642313363, "uuid": "b39fac92-ca8b-4196-83f0-c848980fe740", "value": "12288:agvTeqrCeX329Soy/O+TCJJU2QyDqXkkpldzR6TqKCKDeSJ:tviEdX3Y7GTCRhukkpwqUxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642313363, "uuid": "e1ae7b7e-86bf-4c26-b812-793d506ea7f6", "value": 730645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642313363, "uuid": "f692afa7-45ee-4f53-ab70-1003288eed02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642313363, "uuid": "954a4c8c-d4bd-47fa-aafa-0db0a2feb187", "value": "emotet_exe_e4_0f91cf2df2b5508e8c521a9036e05f00dff7be1a6a897b95108d4a5b1bc961a9_2022-01-16__060919.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a2497f-76a2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642320005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320005, "uuid": "3e7d644f-cfd3-478f-a8ee-e8e0edf7637f", "comment": "Malware payload", "value": "e8f6fbc4b00bb067b3edff1084f7f801", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320005, "uuid": "9502b1c6-3065-4fce-b8b7-79c20e3782d6", "comment": "Malware payload", "value": "0f9a4d7995696f6f32babd63f2dda4bde768ba5a2378e4c3f2a7c215d428dbd5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320005, "uuid": "ec07865f-6a27-4224-9c1a-5e1b0ffc2ee8", "comment": "Malware payload", "value": "7d997a9d8f7358e81ddadd0758c5e69addaf6df2", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320005, "uuid": "82b56745-ff69-4d98-8dd4-84fb2d19b48f", "comment": "Malware payload", "value": "790f7d8f7855f8124a7097636f279a5cffc670eca678542d9646b1cfacfc5e46e0e0c22c67a761c9beb1b07a0b64a2e5", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320005, "uuid": "cdacdf54-9a02-4f3f-be38-a6e1786fe78d", "value": "T1A2E5330C43BAB8FCF89D0929376389D1C5E921F0A58295F3D6781598083F5BE1BDFA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320005, "uuid": "64e34444-0b02-4d3f-a0cb-0c01dcd03ca1", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4b:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642320005, "uuid": "bbd73f58-477f-4b6a-aadc-511173c8da8f", "value": 3039232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642320005, "uuid": "f4c13b78-883d-463b-954c-890efde578f1", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320005, "uuid": "c095ea32-8bbf-4b84-9960-d30557cc2a70", "value": "0f9a4d7995696f6f32babd63f2dda4bde768ba5a2378e4c3f2a7c215d428dbd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791ea978-76a2-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642320073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320073, "uuid": "a5f819c5-44c5-405d-ab3c-088310fa39dc", "comment": "Malware payload (RaccoonStealer)", "value": "e97b965dccce3d099754e4cc68dbf695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320073, "uuid": "9321d72a-5c7f-4927-99c3-95994bfbc7c6", "comment": "Malware payload (RaccoonStealer)", "value": "10f6ffc3c7aecdab5c16ce70c432aca7c19224163a1a17a5c4a95bb38743dcd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320073, "uuid": "938eaf66-7f2d-4c37-b309-0281e1defcef", "comment": "Malware payload (RaccoonStealer)", "value": "c5f1adb36121576e373d22af9642df907955c0b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320073, "uuid": "f845486d-cc5b-417b-995b-e515b196c0d1", "comment": "Malware payload (RaccoonStealer)", "value": "d9b1e1331492bc84a57b90622ab6349b57a8dc1c9f8eaf573d02f2ac92f1b489ec45ff57f87f1bf0f56726da7770d1ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320073, "uuid": "30f06182-9dc2-42bb-96ff-a8a9312fb20e", "value": "T1AB649E10AB90C039F5B712F84BB6936DB52D3EA1572891CB62D56AEE57346E0FC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320073, "uuid": "e3d7ed17-6e89-476b-888b-5b4c7650edb9", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320073, "uuid": "d1cc1462-0407-443b-8099-15427f18fefa", "value": "6144:dT/7JBkcrEBc1CmaGyNoWfpiaxGfcOKsUr6uF:lDkLmS+QpiaxGfcKUrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642320073, "uuid": "54528340-f12e-43af-a5ae-31b788aa6423", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642320073, "uuid": "18936029-918a-474a-8b44-b8ee45e3ed0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320073, "uuid": "9dfd2e39-af7a-40c7-8017-039e279d2225", "value": "e97b965dccce3d099754e4cc68dbf695.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb195e0-7702-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642361501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642361501, "uuid": "34272b91-1457-48d3-9989-92bdc7d42eda", "comment": "Malware payload (RedLineStealer)", "value": "28efe09f50608b4fd62b4cfe7c95f2e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642361501, "uuid": "ec89e379-1f79-4243-85f9-13adb6a805dc", "comment": "Malware payload (RedLineStealer)", "value": "162a370d13beddcabc22b041e488b05a53e6eb44cb571fda3b5e276b330d28d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642361501, "uuid": "f9d48ea2-2703-40ac-b7c8-e8d872407320", "comment": "Malware payload (RedLineStealer)", "value": "aaf33b7a1b9df07339e50d1fb34120dbcf2e1010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642361501, "uuid": "792d7b6b-a7a5-4b5d-ab20-f6c358a27514", "comment": "Malware payload (RedLineStealer)", "value": "4a04c53d1335dbb46d435b9fc04613783fbfcf94ec8e181d6e7bd3c3a13a6f61622eae64684a2f81bf7f1dd3e1f2bcd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642361501, "uuid": "6806310f-5c90-4f20-b157-c09245059eb8", "value": "T130E423A9FBDC0EABDD003232549BBB0237B5F29287B39793B065436A7C33741AE44595", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642361501, "uuid": "26789417-350e-4abc-a0d7-cae009d0e56e", "value": "d123a69e1a76a1d4c228975990208112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642361501, "uuid": "3b458955-930a-494c-9f94-20ba327f17fb", "value": "12288:XfqiW7cjltqSt/QL9I2+zlJfK3MlDiRTzvBX9/oat6fnyabuQy7S68Xerm:Pn2Kpt/MExped5X9/qJbdMb8Xerm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642361501, "uuid": "f8269f3c-a8f7-444b-a8a8-0f995253f1d4", "value": 683984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642361501, "uuid": "5f36a7af-aea2-48ad-b498-e4b925278c9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642361501, "uuid": "1e6d14f4-0c5c-49b0-8305-fde9a45d0a05", "value": "28efe09f50608b4fd62b4cfe7c95f2e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923ea13c-771d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642372943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372943, "uuid": "85580eec-4dd1-44ef-8596-939dcdb16b7f", "comment": "Malware payload (Mirai)", "value": "7ba3c26252ea4d91e0d4ac4b18bd930e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372943, "uuid": "af991ab4-cb2a-4559-b31b-94322070e85c", "comment": "Malware payload (Mirai)", "value": "16526a9c0aaf66fe48c97a44f91f8fe34d9b818a248ade728f3288642e89882d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372943, "uuid": "d6119e4e-7265-40ae-9ae5-50017f0e1285", "comment": "Malware payload (Mirai)", "value": "a7f59d85486a58151eec93d454878217da4d763a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372943, "uuid": "f3fcab01-64e4-4bac-a024-2537c4149a27", "comment": "Malware payload (Mirai)", "value": "69836feae4695eb3cb203f80607bd07d74227b9c4fcea40347f686e0c7f86877b208a70d2826bf32573f6b91685778f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372943, "uuid": "863b8c00-1bf1-4963-8eba-e7ac119a276e", "value": "T173337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372943, "uuid": "a11c3f19-5e4b-4acd-b04f-f7aa026d0838", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvO:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642372943, "uuid": "e73e36ce-e1a5-4f82-9398-559ff1f51d0d", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642372943, "uuid": "b526388e-aa45-4569-83ca-f9809b5b9772", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372943, "uuid": "1eaf5e1a-e7c1-4ea7-ab15-88081117f6f4", "value": "7ba3c26252ea4d91e0d4ac4b18bd930e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571c7417-76a0-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642319156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319156, "uuid": "e8162ac2-ef9b-4c69-9af7-85880952640e", "comment": "Malware payload (RaccoonStealer)", "value": "9090b8098bd6a656e9fc7d4038c29fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319156, "uuid": "001ed990-fc64-41f9-a2a3-1afa7eb18e9f", "comment": "Malware payload (RaccoonStealer)", "value": "1aa35f72b7dbf5b8bdfe282c76e7d38250e9925c4045d70e005d00d5a59acad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319156, "uuid": "90246344-97ce-4f1b-9c58-c286e59bf7d1", "comment": "Malware payload (RaccoonStealer)", "value": "8fcbee119e61e4c833dab4bcda5d209e26de4034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319156, "uuid": "1ff3d52f-a0f3-455f-a0cc-91d119482a53", "comment": "Malware payload (RaccoonStealer)", "value": "c6a8dfa6efc7f78e21f1563943f93c41eb7d6e48f01904122b3ab7eb3f0aa44b7fb0472f30cdcefdd01af9a89e172c3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319156, "uuid": "556a2e91-669e-4e9a-b828-6651b6fa799b", "value": "T16664AF10BB50C039F5B722F84AB697BDB52D3EA1572494CF62D52AEE56346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319156, "uuid": "a02d9754-8dcb-4986-82ee-d5b95155c596", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319156, "uuid": "c7200b32-c8aa-456f-934a-2fba35b8bb95", "value": "6144:tTBfpf34ZhrgugMYuyRPhab1YTWnpCXDUscO0NrTjagD:1lpf34ZdgugishC8opCXDUscVrTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642319156, "uuid": "b1c859ab-ddb7-4ca6-834c-48617709a284", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642319156, "uuid": "e33eee48-385c-42cb-9561-8f25fd937c65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319156, "uuid": "71500caa-4a2a-4e8a-961d-772eff6560cc", "value": "9090b8098bd6a656e9fc7d4038c29fe3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c654200-76cb-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1642337526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337526, "uuid": "b753a060-5dd9-483c-97f8-05c4191b6928", "comment": "Malware payload (CoinMiner)", "value": "59e3874277acecd7a9f528e8625fc8f6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337526, "uuid": "d7408cec-bcde-4e8b-8cdf-b289d3b24727", "comment": "Malware payload (CoinMiner)", "value": "1ee7a34093cd73eba01926aaaae10260731e369e1afd4bd27c98c5b150bf9c9a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337526, "uuid": "b1ea6365-c9a0-434f-8ca7-284dc0ae4ab1", "comment": "Malware payload (CoinMiner)", "value": "ae9aa4db8c15ff7c322b5879bec7426419f52065", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337526, "uuid": "1a6feaeb-2aa6-4427-bf38-e87b19f6869d", "comment": "Malware payload (CoinMiner)", "value": "6b6d18ce8c1768af6cc17e2c5b73fffe0e2f0b8503193c60e9a7f550711bbe588b8955e58673455dc54d303ca1a01151", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337526, "uuid": "da1cb4a7-3070-40d7-b595-1c927051ee73", "value": "T1466623FE224C331CC45ACD309533BD58B2B6510E47BA95AABAC7BEC07B6B914D905F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337526, "uuid": "280a2d59-9faa-4662-9564-85a9a27b8b76", "value": "889336afd01a952ba79d1e90fb751739", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337526, "uuid": "f90001e8-f67a-4887-8622-567ba1df9b1c", "value": "196608:zX4CQF4oZ0x8+qCDsBrBVMMM79MwGP+DbDzOfbQY:zHQWoZ0HqCDSBVMMM7GwbDS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642337526, "uuid": "f2bc3e1a-74b2-48f5-8d02-ae618e2f9491", "value": 7010816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642337526, "uuid": "a6af9cbc-a5dc-4923-b784-55d2c68abf87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337526, "uuid": "5e1fbbe3-2b8e-4a37-bf94-4529aac9605e", "value": "59e3874277acecd7a9f528e8625fc8f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a900c990-76fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642358378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358378, "uuid": "2e2682e3-9ae2-44f2-8e85-f2ed526ea3b3", "comment": "Malware payload (Mirai)", "value": "b8c3856b2f67e829d17d4555b24e38c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358378, "uuid": "973cbba9-58b2-4413-b094-f41193dec390", "comment": "Malware payload (Mirai)", "value": "1f523135834f10921ba46664af37bfd48d9e9f86ca064f6a065e1a5cc76c3e02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358378, "uuid": "d330d962-d5b2-4c26-b79c-e87d04d83128", "comment": "Malware payload (Mirai)", "value": "574f6b75680b9ced35deb793a76b1bf328bf46a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358378, "uuid": "3a843af8-81aa-49f6-a31a-f04a8aef7334", "comment": "Malware payload (Mirai)", "value": "2e0a4d5a8736380c7a9a5106e09ec01ffc18eb14b2d64c92a0220376960aa90aed29a57c437d219f7630049ecae4f40e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358378, "uuid": "30b2a2a0-0119-4399-9c8a-9fd9dc130f13", "value": "T1BF93734D3E219F7DFFAC823887B75A21A64823DA66E1C585D05CFA021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358378, "uuid": "341128e6-1f47-4914-8ccb-d3abf269c308", "value": "1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiOp3J:CHsnD8/gb/zyDv9f0HD9FC+KBtyR6/DG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642358378, "uuid": "36baca36-c41b-4b8b-9802-b924be71c366", "value": 89332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642358378, "uuid": "a030ddbc-74ad-4cc7-9fca-98308405be14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358378, "uuid": "a2ee9f17-329b-4025-8d9f-ebb81ba1da14", "value": "b8c3856b2f67e829d17d4555b24e38c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89778ddb-770a-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1642364768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364768, "uuid": "6fbe57ab-ad2f-423a-bb0c-668439bd13d1", "comment": "Malware payload (DCRat)", "value": "644ba574ccf34cab7c0cf6efbe56d3f5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364768, "uuid": "525df0e9-fa8d-454d-af6a-8d066c98535f", "comment": "Malware payload (DCRat)", "value": "1fab157d0875965581784c280d4b74c0adef81be4c002563732dd004207ff8ae", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364768, "uuid": "86c41a0a-c632-4d72-9af2-76e36db1e51e", "comment": "Malware payload (DCRat)", "value": "c045f3749a73752c766e315d52964c1c7482736e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364768, "uuid": "e510c60b-07fc-4542-a31f-d633427a7e68", "comment": "Malware payload (DCRat)", "value": "69d2f2d0c9c3fa3f4d772dccfce0dc8486a0d1c3cd94b74727cfe8f1282f6d1fc52cf9029bdd1bf6f9287e69c32a929b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364768, "uuid": "0faa8750-8e22-4bc3-864a-9f84421a7ded", "value": "T1976523DE4785666ACE01DFF05D5A4F1B81B106E9AA48296FBD3807863772053FB3089F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364768, "uuid": "55289254-a4e8-459a-ac67-e5d970d8878b", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364768, "uuid": "57fdbc8a-fd08-42d0-beb1-938fb62c4bfd", "value": "24576:qTPz9MZKWep6nXDlTtNbWeO9OzqZhnxLjcnCux8ibVTTxkEaHNYK3O1ZOeQqW:GOYWep6XDdzbUCq/nxsnCa3xNaWPQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642364768, "uuid": "6bbf53d3-1fe5-4497-8ffc-33bc6b6ac22b", "value": 1439180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642364768, "uuid": "504a649b-19f1-4294-8d6e-fa60d8f4bc45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364768, "uuid": "6f92c40b-9ee6-40ef-8689-99651b926e45", "value": "644ba574ccf34cab7c0cf6efbe56d3f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adb3656-76a1-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1642319485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319485, "uuid": "c5cea0cc-b415-40a5-b403-55a57cc2af82", "comment": "Malware payload (CoinMiner.XMRig)", "value": "d06876841be93b11e2b18a35e558c9ff", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319485, "uuid": "e6d15e95-fa95-4bd5-9b90-a3e36a9e517d", "comment": "Malware payload (CoinMiner.XMRig)", "value": "226ecf245848adb9031f75de222e65a573b1cb390af79a8abe065d6197fbbb65", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319485, "uuid": "a6d9b793-6048-4cf1-8084-c7e64bc06829", "comment": "Malware payload (CoinMiner.XMRig)", "value": "30652878cff7e3bd08387efb5151a97d06a2c1f6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319485, "uuid": "5c70590f-73ea-4745-9b43-53241974aadf", "comment": "Malware payload (CoinMiner.XMRig)", "value": "448094ff8a14a3ccfb9a9e0cab6a200fa8f4330b7af13798ade59a5af621459fc97a9ba2cfb74c296c137c10b6b6e024", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319485, "uuid": "3fd5aa91-0939-4a8e-a230-beaa90d80ba6", "value": "T15964AF10BB60C039F5B712F84AB6977DB92D7EA1572490CB62D52AEE17346E0ED3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319485, "uuid": "ead4854f-777c-412a-929f-f29b1621cf9f", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319485, "uuid": "4740b784-6795-43c5-8b21-ffbeeb4c5fb6", "value": "6144:RlBUfE5SCgyodnouda/chuKbfpWTu1cO9rAEn5NcJ2r:fBcE5SCgyojdzsIfpWTu1cEAE5Nwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642319485, "uuid": "864fe77f-641f-4824-999f-19acd3ceea84", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642319485, "uuid": "437c37dd-d3f3-4a74-9537-5fda3caf3d4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319485, "uuid": "bf18283e-cf4f-4780-9aca-cbf1da84b4f9", "value": "d06876841be93b11e2b18a35e558c9ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c92ded9-76f1-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642353955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642353955, "uuid": "1aac4184-be02-41f0-865f-509601891b86", "comment": "Malware payload (SnakeKeylogger)", "value": "acbe6c6cc9fc0d85c1056a8dfefc9d9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642353955, "uuid": "258bb8ba-f67f-465a-8343-ead693b03360", "comment": "Malware payload (SnakeKeylogger)", "value": "2522dbc39b2a9bcbe3ec359e52124682672963664f4b44f50a18585ed5523ca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642353955, "uuid": "13c551d2-48b3-4570-804e-60389d2825cd", "comment": "Malware payload (SnakeKeylogger)", "value": "e88b9be6fbe57882fdc99358b40797b0f0a9ea87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642353955, "uuid": "fa758a79-c45a-4a42-aa49-296ae98b14de", "comment": "Malware payload (SnakeKeylogger)", "value": "43cb71683124c9436339468726d2df7676349142cfce12897e9379c097055b2303eedfffd1b82d56ae5f6555b4f5d566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642353955, "uuid": "ae1400b1-f916-4853-98be-635a37fa20c2", "value": "T1215412C927DA62FAD21018BB2B35DF7AA3BBE61430124A57A3B51F731B11183D127B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642353955, "uuid": "da7adf67-03ad-4f3b-bde4-db5d696ac952", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642353955, "uuid": "99ba2110-0e82-40c2-a46b-a464c7185306", "value": "6144:Sw/XUzYY8nVGEtodAyxBkAosSH2gKBRgEtNhp3MWk70aLZYa:BUzptEtolVy/KYOhp3NE0aLSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642353955, "uuid": "efa638a3-1ce4-49a9-9c61-1a183931b451", "value": 292505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642353955, "uuid": "df7578a3-8433-4129-b6c0-ad106d5f8ba3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642353955, "uuid": "d364915e-6d33-428d-8053-cd9490a52d6f", "value": "Payment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1855b2ad-76e1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642346968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346968, "uuid": "7d880af9-fd5b-4ca3-9767-2339e3b5e8e1", "comment": "Malware payload", "value": "1cd12b4222419b2f60e3a1f940e19604", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346968, "uuid": "e3e2fca3-e19a-4760-95f5-fe4062343f9c", "comment": "Malware payload", "value": "27766e2465004d4807508ada3ed777979a888e21e3d9bc1d586cce44bd4dffd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346968, "uuid": "d7c0312d-ccb8-4f34-bd00-6b58bff5ea3c", "comment": "Malware payload", "value": "699c0affc39ca317750f3fa250133c1651675f02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346968, "uuid": "a50ee078-6f1c-48d7-8f79-4939e3cb8304", "comment": "Malware payload", "value": "11ae793dc5a1bf3c97ab66c72fe964a490f43e073cd6c3ee563320fae26685fc6b14effd8bf36f8f6192d053c10eab53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346968, "uuid": "a3c96112-e18c-4186-8cf8-d5a3dd660fd0", "value": "T133F2F130555B3A32D8F32C719D7F8602735D4FF4D6E933B06648AABE2B0D848AA91842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346968, "uuid": "8ce22ed9-6603-47a9-a777-f38cb320572c", "value": "768:SlEeVg38ifFZN4kSO3wEmGZLSp3QP3crVq3U7ry:SBUN4kSOABMgQPc1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642346968, "uuid": "3f5bbeb0-3f6b-4b0a-bc9e-3834865c7828", "value": 37072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642346968, "uuid": "f1001764-ce4e-4c2a-85f6-0c9c369cf3ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346968, "uuid": "d0c9190d-1148-499e-9d00-c8cdaa76889a", "value": "1cd12b4222419b2f60e3a1f940e19604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab979612-769f-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1642318869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318869, "uuid": "8a834965-89cd-48fa-8a05-889111ac0dfa", "comment": "Malware payload (CoinMiner.XMRig)", "value": "511aeeb7b29face6bf5fa128eaa6e265", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318869, "uuid": "a5ad6f52-808d-479d-98b3-3daac8902313", "comment": "Malware payload (CoinMiner.XMRig)", "value": "285694b67aa69d6319ccbb02b597f078040394acd449bdabd36c33b09ec81a7c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318869, "uuid": "d840718f-b652-42e1-8ed3-550d195fbd25", "comment": "Malware payload (CoinMiner.XMRig)", "value": "2b942630ef6cc68955819795cd22391d671363a4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318869, "uuid": "141b5189-9c28-4c25-8479-d48fcf947ccd", "comment": "Malware payload (CoinMiner.XMRig)", "value": "aee78f9c053f68c6472acecb473373e4b817cbc01e0a55a252c67670a0d61f132db0cb0f9d5680994c7de84e9a9576bd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318869, "uuid": "f5206802-af95-4a1d-9dd2-1590d6fb78ac", "value": "T14864AF10AB50C039F5F712F84AB6976DB92E7EA1572490CB53D52AEE67386E0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318869, "uuid": "cbec65f3-0051-43fe-89d2-25e85919c763", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318869, "uuid": "2fa3ae69-bec2-4223-850b-0979449649c2", "value": "6144:FDCnlX4jaLSMcwraryHw231n8J4TcOzJjuuV1GKS:Val6krhQ41n8J4TcEjuSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642318869, "uuid": "a53d43df-5539-4eaa-ad08-d1a77819fb06", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642318869, "uuid": "9db8a4b5-45af-4b25-99b8-d47337212636", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318869, "uuid": "8c52892f-8467-4291-b060-d44b60175b65", "value": "511aeeb7b29face6bf5fa128eaa6e265.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e99ccfc-76cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Matiex)", "timestamp": 1642337530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337530, "uuid": "b39585e8-54fa-4e11-83c4-17f2b3e76384", "comment": "Malware payload (Matiex)", "value": "04b390af484095276bcb7dade5cba01c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337530, "uuid": "9e0646e1-8e31-4c95-bed8-4cb9a248bfb7", "comment": "Malware payload (Matiex)", "value": "294b39b41c7e5ee3d4cbab54bcc8c49b8233902f1adfddd70a5e7b6291ed68d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337530, "uuid": "5db28847-b0d7-4d75-ac87-a3b48ebf1fd1", "comment": "Malware payload (Matiex)", "value": "266e539dd3c38ecea6082da852970c98b2dfddbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337530, "uuid": "4615a76f-2060-43d8-9539-2e5eb32dd54b", "comment": "Malware payload (Matiex)", "value": "8deffe75f8a5c735e95822db5014306de92b588699472fbb07dfbf66c37a9bcad4d9b83c05008f2f6307dd81e95f1ef0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337530, "uuid": "cfadd3d9-eea4-4484-8a5b-3801f8381840", "value": "T173F45A9C766071DFC767DE32CEA82C64EA207577432BC247902311AD9A1DAB7DF109B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337530, "uuid": "4bb82374-b888-4331-a43a-da0656065b1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337530, "uuid": "df0d15a0-82fe-40ff-bc3b-5a9f5670f604", "value": "12288:0XexU/yEoVR+TY0zhaz7WF+taQtDBGul2I7+Emf9ZnFNosoNfE8r/obtq423UD0W:0XEMyE0R+T1zyqAgusIHgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642337530, "uuid": "1c3d8b84-f033-4fed-a252-a92da3bdb03b", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642337530, "uuid": "6b8d9882-e10e-4c5b-b817-f36e7d23898e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337530, "uuid": "d0a57671-668b-486d-aadb-3995a152b4a0", "value": "04b390af484095276bcb7dade5cba01c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9de0d7-7705-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642362604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362604, "uuid": "bdb6cb6b-892a-4007-a301-9f8100b37c65", "comment": "Malware payload (Mirai)", "value": "d70df5d273f774833210172520d844cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362604, "uuid": "dd34ccac-c75a-40e0-a914-1864e1d8e297", "comment": "Malware payload (Mirai)", "value": "2955351c2c778bbf4b9583c358f00be2e176f92f4a030a4c3cf5a52ae879f70c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362604, "uuid": "edda9d48-0c45-4d3a-b3f4-a04ed0a0f160", "comment": "Malware payload (Mirai)", "value": "245c39d280e7bea09b53ccd1592de9e292a7e33d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362604, "uuid": "f0b34cc0-b8a5-46a0-ad49-0bc7da14109e", "comment": "Malware payload (Mirai)", "value": "81b8bc8e9d7643d758614bf03b7e24c671a4ec0029e734e221b72abfe5c17a92e680824a1a7459ff99bf2dbfd6700c2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362604, "uuid": "73036f96-5648-41bc-ab51-7b1f4157e374", "value": "T14FE34C46EB808F03C0D61776BAAF424A33239B55E3DB73069D18ABB43F87A5D4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362604, "uuid": "9460d003-1127-43ad-8423-e12f8091beb1", "value": "3072:j1sdmBGuNV4f2avNRaO0YqHHHh1I3232/JTM/9e3SuHcBCSf:BrBf+f2avNRaONqHvg232/xM/9+mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642362604, "uuid": "cae55c14-b63e-4708-94db-fe28d91a63e8", "value": 152427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642362604, "uuid": "272c74d5-e5b1-4eeb-a4cd-8ad5df45a866", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362604, "uuid": "f90b12de-9638-4524-b9f6-de930858fda2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834fee7f-7710-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642367334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642367334, "uuid": "0721dd0a-b7d4-4219-9ac6-ce35cbaeb7b7", "comment": "Malware payload (RedLineStealer)", "value": "e62d268e1ef2484cd108be1dffb08c1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642367334, "uuid": "c297518b-336f-4bd4-afb5-d58ff18b873f", "comment": "Malware payload (RedLineStealer)", "value": "2b6c86b37ccc098e90833be8c72cc616f677b247b82d57a0af7be119db27648a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642367334, "uuid": "9afa6c0f-96b4-4437-8645-80ab819e2476", "comment": "Malware payload (RedLineStealer)", "value": "3e9bd71662b956c116c08e31ecb3c68d0638c469", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642367334, "uuid": "2ca39fa8-8d99-4aa6-8c14-3bd1dd81c368", "comment": "Malware payload (RedLineStealer)", "value": "41f71ab61344c175a04e4af07c24c8244b5bda492fe4b50c03873665e756bf57563a841b228c2078f6b0fc3cb2f9efd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642367334, "uuid": "d4a06221-67e3-448f-8d15-abca734cf3e6", "value": "T1AFF533B051A6E4D9DA9F0A749C2B3F09FD30A5F06BE1A483316CFA79D44B4017B95E38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642367334, "uuid": "266ddcb4-c09b-46bf-9822-df67c35b5424", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642367334, "uuid": "64ac5d1a-b5c7-457f-adf6-f810e134befe", "value": "49152:5dztOV1YqnMZICFPs4E2xbYOGLpo1JYIl0hB7wTA/iunGnJiOQ1vzsPNaVFY2jG:5dztwtrYM2xb9GkJYR7wOlGnJitMw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642367334, "uuid": "355e246c-f98f-4180-b2c7-29e429b8d905", "value": 3581232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642367334, "uuid": "85d6e3d8-a926-4fdd-a36a-42e9c058867a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642367334, "uuid": "f5c0565c-1eae-4ec2-ae70-50998b548c5e", "value": "e62d268e1ef2484cd108be1dffb08c1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea24df8-7668-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642295225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295225, "uuid": "7e7e45c5-d28d-4a76-9928-e7ac8ffc0829", "comment": "Malware payload (Mirai)", "value": "b40848e3df5aa085b13b4a4523ba0e9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295225, "uuid": "eda896a5-cb79-42c1-8a7b-cf7993f8e785", "comment": "Malware payload (Mirai)", "value": "2cf70cfbdab7ad215c55ac90dd9d322085e3c8d0176ef7881ea4110d933edb95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295225, "uuid": "ad1e7e6b-1358-4d90-8362-ac4baad76552", "comment": "Malware payload (Mirai)", "value": "02b4e714a14f9bdc3a5c9e41ee73b8efb6a483d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295225, "uuid": "f27c19bb-7674-4178-9fee-412849fcdec9", "comment": "Malware payload (Mirai)", "value": "26f4f9f50a2a2972177df2f66d0200164460b7999e418a22d08ad6d9f8278d658f96f5fb569f0de43fc7c0b6caff7e79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295225, "uuid": "72749e99-ed7e-49a5-bcf9-52b55b85fcfc", "value": "T1736382197F650FF7ECAFDD374AE9274621CC641A21987B397A34D818B20B64B04E3879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295225, "uuid": "619314fa-b6ee-4ae4-aea7-36101ec61f4e", "value": "1536:QIumpyCZBdKoNPAuDJPUBgQtcm7jteEZ7ih88:FxpyCZBdBAuktH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642295225, "uuid": "7bfd9cff-6710-4fc6-9c81-926d64d60cf0", "value": 69020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642295225, "uuid": "167a91f2-1501-4799-afae-216408852bf6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295225, "uuid": "1bb490a0-b429-487c-8bf6-a649fef0614c", "value": "b40848e3df5aa085b13b4a4523ba0e9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b865da35-7715-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642369571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369571, "uuid": "91677cbd-3c2e-41ed-b984-57cd39508442", "comment": "Malware payload (AgentTesla)", "value": "a3fc56eaecd94ead61da08be870d3035", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369571, "uuid": "9b22eac4-f54f-43da-974a-00a1b5133812", "comment": "Malware payload (AgentTesla)", "value": "2e281da6d3e037f963dc8cb4122c99cc20f213693d59589deaf107d7fc7d7071", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369571, "uuid": "8304d288-0fc2-4290-b0d9-ccf7ea0147b1", "comment": "Malware payload (AgentTesla)", "value": "e7efdb37f9d41674b146bad5a252bfcd7de39211", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369571, "uuid": "b35dbf23-cdb7-4c8e-95ec-8efb3b2db230", "comment": "Malware payload (AgentTesla)", "value": "20d009c79a0b0b084a5667ea74e880bc57ae1471cced158a63bd0f7e5760ca96bc827a556206689dd07bd35a41034bc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369571, "uuid": "7b2f40f0-461f-4d3c-bb6c-a0bb35cfca72", "value": "T12C5419BD6B88B902FA3D193289D2167013F1D4874E12DB4F6FC45EEC6E537CA294A385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369571, "uuid": "17a4a0c3-da76-4871-8a7f-1b3c209d2e31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369571, "uuid": "80824ad1-2615-41ea-9852-8534d280ab3c", "value": "6144:3tuwPnhleaZXs1MsC0MUEpmxIF8Nx+2sEFG:9hPnfZZ8i0MR4Iw8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642369571, "uuid": "35eaa3ac-c11e-4433-982d-ced8f7c62423", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642369571, "uuid": "c4b578f2-aaf4-4d21-8b82-9a1827213f37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369571, "uuid": "ec295f4d-9008-486b-a271-fd78b6f9875c", "value": "2E281DA6D3E037F963DC8CB4122C99CC20F213693D595.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39716f07-76f4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642355184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642355184, "uuid": "35496235-9d35-4380-8e6c-c2e562710b80", "comment": "Malware payload", "value": "c7e14d431a09cb6b85bff8e8cd8f709f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642355184, "uuid": "a52b5401-aec3-4229-8e0d-78cb062b190a", "comment": "Malware payload", "value": "312bbd2041ddd599f1588d2a49da581e518500e21b41c57857dcd12565de247c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642355184, "uuid": "eb61dc68-f0db-4e33-bc39-71aba17f7374", "comment": "Malware payload", "value": "e74f0f6be5df7f533478c1cba3b97485f3ce5637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642355184, "uuid": "a510c050-5b0b-4877-b89c-a85ced41715a", "comment": "Malware payload", "value": "92cbfdbf4e5562437f9a761fb70838591ce2ad805a4c0449ae690d9362b0f8288a0e6d272a1082c673104a01ba0d8cb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642355184, "uuid": "966d07bf-7bec-4356-a982-d3de4ef13d10", "value": "T168E312157AACA76AC3F502341C51E8661833FB246598CF9BB0F0FB276FB52D86C11B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642355184, "uuid": "3809f4d7-0eea-4f64-a721-ec55b17e68d5", "value": "a286c0355023fedae1f655dff7dc3897", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642355184, "uuid": "da933316-8ae2-409f-89e4-e283ffbc0245", "value": "3072:WkvCvlyDRDn23TEToutvSvylSS8nc0/0JAhd+kE8EOvJfwQ0z:0vlyNDhoSqvNJnSqPvJfb0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642355184, "uuid": "881abdb8-e46c-4f1b-a7d8-531450adf9b0", "value": 157056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642355184, "uuid": "66fd0b24-d1ad-4794-83b6-be2c501b434a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642355184, "uuid": "a7e56727-b710-4cc4-ae0d-452e85d9d4a0", "value": "312bbd2041ddd599f1588d2a49da581e518500e21b41c57857dcd12565de247c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b9e27f-76df-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642346295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346295, "uuid": "ddac6e90-16db-4e63-b8c7-f996e96d8f80", "comment": "Malware payload (RaccoonStealer)", "value": "e2fd2972d4a6928b21beacb58fa02c88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346295, "uuid": "b119e3c6-1501-41c3-8c1b-53a62f0cf2e0", "comment": "Malware payload (RaccoonStealer)", "value": "31ad805cd3b0420e4780a14a04ead82456043d344453405c091caafb0462d129", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346295, "uuid": "4d244160-0b73-4a5a-bd47-3e132f940df9", "comment": "Malware payload (RaccoonStealer)", "value": "8d51e45dc3b8c5f0a38fd7c40d27ee91809e13b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346295, "uuid": "7342962d-0cfd-4330-8450-69aa85316c86", "comment": "Malware payload (RaccoonStealer)", "value": "bc648ac8a330fe2de3013e1a8170afd7e5c0c11074bfbc3b470da880dc0f5a21b85f49a180ac4e5e4108328839199794", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346295, "uuid": "cc5bafb4-123f-4fcc-9ce4-fcf2e8c00ea9", "value": "T1438408C5A4289081CEFCB5F2B866E92220F93CAD8DC3454D76F972361472A57DE0B91F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346295, "uuid": "5e2d4a13-9612-4145-a3e6-f0b2f1f5b26d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346295, "uuid": "7ee35420-5823-473c-9419-352a61c4d3e8", "value": "3072:TFCJ2oRNyHXIQenAKo7MMye9zurKCy5bl0EBUUffNtWEivOOOJZoeVzYN2+0cIWa:TclfAb7nC0WEG05iTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642346295, "uuid": "ab493cd6-bc94-4793-a006-75da2db5337a", "value": 386016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642346295, "uuid": "a785d36b-20ba-4824-974d-24b91c08bccf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346295, "uuid": "a5cefe08-fc0a-447f-a598-122775c2397c", "value": "e2fd2972d4a6928b21beacb58fa02c88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a1d38e-7727-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1642377079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642377079, "uuid": "a05bc873-bc05-41b8-ba2b-aed56af724cc", "comment": "Malware payload (AZORult)", "value": "5000895d3f1b9199d8a9953cb550d4dc", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642377079, "uuid": "c1ac834d-a0af-43c1-b62f-045a14efde5f", "comment": "Malware payload (AZORult)", "value": "31c5ddd1fbe36e68985803eda63bfeaaccce58774389be0c0fc339d214ea1353", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642377079, "uuid": "9051eb69-c5a9-4ff0-adf1-3d9cad85111b", "comment": "Malware payload (AZORult)", "value": "620af79e614340e4f342a16db753475da5cd4c28", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642377079, "uuid": "55d9107f-822e-4777-babe-464479c73a99", "comment": "Malware payload (AZORult)", "value": "f7d04e11ad6db0e7ef22fa8594ac302bc10d9939d59c2f9716b6d8739947313c68efa7bfcc7d2850850930ca7bc2f3ce", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642377079, "uuid": "af53b87a-c879-4b45-ad17-4c4f83659c6e", "value": "T1D854125739E98FE1D1DF5EB28F8B0D27CB7ABD2216111117C3BCB97A1AB12918153342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642377079, "uuid": "7926822d-618a-4748-9187-63fe1cf57c3f", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642377079, "uuid": "c24fa418-1001-4b43-8fa0-680137826809", "value": "3072:TNyah0mJbCxm+wnwmU6Ny97CVjbsIhd2iTeOgjuSTaqVQub8cYPyJkYz8UyGlSo3:TwDELRvVjbJQiaOLSOgaTd8dlSorWmyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642377079, "uuid": "ca54beed-a78e-4f94-8a0d-9ea35bdd2cda", "value": 297089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642377079, "uuid": "72c2ad90-a1d3-47a8-85d8-98d173eb3460", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642377079, "uuid": "b2b616e2-8ff3-475f-8491-39b016dd7391", "value": "RFQ 4027200 #21-11462-YJLINK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60af71b5-76a3-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642320461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320461, "uuid": "793b3fbc-ac3c-45e4-bf05-43596b9eebf8", "comment": "Malware payload (Formbook)", "value": "b0b77a417db9e331e0f1c6cfb5a7aef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320461, "uuid": "60499d31-5608-41b7-91c0-c75abdb7c507", "comment": "Malware payload (Formbook)", "value": "31fcaa22e49398fe59bfdbd11e8b341c700c8dab0165b67caf3982f7e7164643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320461, "uuid": "4417b05d-1c9b-4150-9158-75d8ea8011b2", "comment": "Malware payload (Formbook)", "value": "a1456ef94da9a65199d601a94244f75283a5a604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320461, "uuid": "a00f186e-35d8-4c9f-9631-2da8148d9745", "comment": "Malware payload (Formbook)", "value": "de638057c3769eb67293476a6da65b30042f010857cb4baca1bd001a917dbf5637077378ea17203b8e650c7faaf83a77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320461, "uuid": "4422e9f7-e126-4fba-bc70-24ac92540aad", "value": "T1568402217BF58349DDAE43B15563400023B67A5B3632E38DAC8D21CD3AB2B59C752F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320461, "uuid": "77fa1d9d-1644-4dec-a0d3-67a27366d21c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320461, "uuid": "9a33a7e7-c73c-4a15-b2bf-c729b53f2ece", "value": "6144:DmL6h6vVrDbx+0eRsK/6Z1mFX846zKRpx4NfgnJ/NsW1Wk+JgbVbXOspy13fReQ:APY0YF/6Z1J4sKDxc6QlG5b+spUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642320461, "uuid": "09c1dff3-7f95-4101-bd9e-b00cdd3e8797", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642320461, "uuid": "057f3caf-81e5-49ba-89dd-25fcd3d653d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320461, "uuid": "b57b701a-e7b0-4982-8308-7cc9e8158378", "value": "IMG_9785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11b03d4-7707-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642363653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363653, "uuid": "95f32525-0497-4c94-89f7-22165819bbf6", "comment": "Malware payload (Mirai)", "value": "9040b31be3fa806f0eea6b9ceee180f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363653, "uuid": "21c32914-d43d-4576-991f-0f4e058db0af", "comment": "Malware payload (Mirai)", "value": "33737c752ada10556c3b0787e34f5ff8635e4c84be28c3446fa6b9f5c2e11ad4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363653, "uuid": "18029d0f-1cc3-4882-aecf-39af91b7cd26", "comment": "Malware payload (Mirai)", "value": "645f24e78c37ad27a0fe80082f226474e4c4ed24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363653, "uuid": "88f4438b-6f68-44e0-88c9-922999ea92b3", "comment": "Malware payload (Mirai)", "value": "273d47a20eee81ec505f511614b9e5963b16ae74f24439ed4e025c0680d2fb9fd36dfeeea79bd6c093feceb52d8e1aaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363653, "uuid": "a7d593c3-c5f0-46bf-9462-f53394ef43c6", "value": "T114330782BCA1AF4AC6D023B6BE5F65AE331163D9C1DE3213DC145F247ACAA0F4DA7541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363653, "uuid": "29b6636c-093c-4ecd-8a9a-797ce3ebeb4b", "value": "768:umr7NdngMpehKv6SS6oMV4d6uqsr2pErnqP8JcjuZ1j02osk1YQq8D+ncXZO5UqG:9NgWeA6SSVdWsFrnthrosk2QJGuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642363653, "uuid": "44866fd3-7d3b-4c0d-9f1c-545a5e01dff4", "value": 50400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642363653, "uuid": "dad17c1f-aa91-439a-9f35-7e02a22d1a45", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363653, "uuid": "a13a234c-f5c6-4bed-a22d-42fe9ae5ce12", "value": "9040b31be3fa806f0eea6b9ceee180f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c211ed9a-7707-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1642363574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363574, "uuid": "6c4743b9-2629-4f57-adcc-3d43fba2ea12", "comment": "Malware payload (CoinMiner.XMRig)", "value": "439df354aa1e330cd9cc560e33a1f489", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363574, "uuid": "55ffde6a-05cf-467c-82ea-9fd5dff97fe4", "comment": "Malware payload (CoinMiner.XMRig)", "value": "33bd48cf4b43ba112ab70369feb0a9eb3b06e317efe95dcee6ffbe0027fef566", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363574, "uuid": "7bb185fe-cee3-4d91-b3a2-fc5c2a2d07ec", "comment": "Malware payload (CoinMiner.XMRig)", "value": "7676c6f2a2ab75c77d059516558aaa74bbe2b063", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363574, "uuid": "3e161a4e-a3b8-41ee-95a2-5c748e6e5124", "comment": "Malware payload (CoinMiner.XMRig)", "value": "4f3e5dea07dd03a37cd391db6d4ef805960a9c5721dbcae3a76c0624ae733e93c9cacea0c79764725d2b33d31fe371ba", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363574, "uuid": "82034a31-e38d-4640-bbf2-8e8776c377b5", "value": "T18D549F10BBB0D035F1B752F8497A97AC7A2E7AB1572490CB52D56AEE17396E0DC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363574, "uuid": "03454219-60ab-49a5-8071-e7c0e3f23fd3", "value": "80720d283b0420bbcbb388cde3e0df65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363574, "uuid": "cc774633-b238-4c73-ae00-eb45d3db5b6a", "value": "6144:49o3KJIxcaA9PJxYhq/rJeQ/ww8EQMoKZb8v+Fjb6cgu:4COoc7xGhq/rJePw8pMoKZfFj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642363574, "uuid": "a803485c-67f2-4bb3-98bb-fd55904f7ad3", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642363574, "uuid": "40751d4f-39bc-473b-8510-5ab435f2950e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363574, "uuid": "41d91184-e6ab-4459-b84c-5dc32e2dc23f", "value": "439df354aa1e330cd9cc560e33a1f489.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf425a33-76f9-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642357583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642357583, "uuid": "0e1a65f2-f311-483b-a6c5-ac1a198f7025", "comment": "Malware payload (Loki)", "value": "04b0dabb9297a9a88feec4af0805aa22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642357583, "uuid": "c97434fc-f1b9-460a-92bd-f70bcef20e59", "comment": "Malware payload (Loki)", "value": "361cecb9d60feae375d3ba996ba5e68c233723cb5b98332f9dd30c032833b7b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642357583, "uuid": "efee5616-237d-44b1-8b63-b4770e278ae3", "comment": "Malware payload (Loki)", "value": "95725ba63b97192efdfe4751086b68ca3ab5fd2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642357583, "uuid": "4bdee204-3ec6-425c-a6a8-2c95bda8c5a7", "comment": "Malware payload (Loki)", "value": "0f4a228da120c0de553abc0a7ee918e7663e239a076ca6ccdb679c24f13a0ab7b7b845ac14b719d54dc4052341f47146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642357583, "uuid": "40c1350a-1f59-4a02-93d1-e95da6c7a0f4", "value": "T1AC34120B19C17CF7C95642B34A62D36EE3F68709206A058F87796F6679710431B2A3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642357583, "uuid": "8e374579-9b9b-4a1c-9519-b677c68dada9", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642357583, "uuid": "36e03696-1223-4323-90cc-a03d26bbf852", "value": "6144:owDB5GhNyG2rs4BWxUgpFhpr0oW//+xeVSZm4:pDzos0Xhpr3E+CSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642357583, "uuid": "d7106ae0-6fa7-40b2-b1a2-7c25d15d2e55", "value": 238016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642357583, "uuid": "663f4a6f-2feb-4ba9-8ae6-9ab2002b015c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642357583, "uuid": "d5561a57-bc9b-447d-9b09-4f1045f329ab", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e593f0b7-76bd-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642331851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642331851, "uuid": "4def1f24-7f56-4d99-8d62-8bbf7e3fbce8", "comment": "Malware payload (RaccoonStealer)", "value": "e3ed9dadf89ab9d1cfd468ac0aff67a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642331851, "uuid": "1e29e633-9f28-421e-8050-e8b0233b27ba", "comment": "Malware payload (RaccoonStealer)", "value": "36227451bca557ea1488a46b8642d1eebceeeaed14c34e96f216a56321bff60c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642331851, "uuid": "3aa63d9c-260b-4a26-92a4-e1077efbe2a8", "comment": "Malware payload (RaccoonStealer)", "value": "e9bed57ce527549f5b3b4e2f54f8ba903acfd3e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642331851, "uuid": "d7369811-0d28-4a7b-ab39-0ac0918c672f", "comment": "Malware payload (RaccoonStealer)", "value": "a3d88988fe07d687ec812d31a7f7c9d00ee5c3c5517b5a99c7f9b2e3c558deda96c6628ef0337d4ac1b116876f2a98a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642331851, "uuid": "b7f63903-4c7c-490f-8b41-350b5ccc00b0", "value": "T1B576330063F808EEF8BBC638C5668621A072B46B9759D4DF17BC439A9F975D32D73A00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642331851, "uuid": "510d7ba7-11be-4d99-ab5e-ebf74b278093", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642331851, "uuid": "614f038b-c6ef-453e-bc31-f179876276e7", "value": "196608:zB+hvICteEroXxqENE+sKsXXgvke2vSoYDMC6/Nuz:2InEroXjsKkXgsec0D8NU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642331851, "uuid": "c7837e2c-0309-406e-8c07-cb79cc0f8014", "value": 7336923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642331851, "uuid": "f8c85249-6b3b-46ff-9b7f-110462b49721", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642331851, "uuid": "af351308-aae0-4785-8a54-4a2af6657c77", "value": "e3ed9dadf89ab9d1cfd468ac0aff67a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a48ffae-76a3-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642320450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320450, "uuid": "8ba77c2e-c9de-449d-bc2a-6c34f09f2403", "comment": "Malware payload (Formbook)", "value": "c0be19f4d56b5e568894ffa457ebe035", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320450, "uuid": "6ed3af55-39ee-49cf-9b45-ce8df55e3285", "comment": "Malware payload (Formbook)", "value": "39f9ad951a110966ab4905994f48498d3872e0a1ce5756df37fb68dd6681566f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320450, "uuid": "56310ecd-f663-4254-b490-da35946032d4", "comment": "Malware payload (Formbook)", "value": "50e25140e64d86f476ddd5bdbb8101f8991a9ec8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320450, "uuid": "ae8eb220-dc46-469f-9c97-774ff123d850", "comment": "Malware payload (Formbook)", "value": "09c1d88b44a4b1124400831dbf84f29c93bd3dd1201462a4160c7aafd429285f5a7f4b047c82ea064dd2c0afa2cd26d2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320450, "uuid": "cd32c081-70ab-4de0-b928-bd2c0e8e9524", "value": "T1A17423D09BC542422F8E31B2EA134064A6F37E9B757197FDBE850BC07898988DD9BC1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320450, "uuid": "09903745-e207-401a-bb83-8eb5fee81aee", "value": "6144:COV11La+0eXs+/G3rgTl84ozKRp78+ignJ/NwW16kCJob3bXOsdy13fRb8:CO/Rp0cj/G3rj4KKD7DNcrEjb+sdUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642320450, "uuid": "314abf39-00f2-40bc-a32c-abbd8014d1db", "value": 361487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642320450, "uuid": "42b81b5c-40ca-4508-aba2-54293aa32854", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320450, "uuid": "04ea1b6e-74b1-4d18-a5f2-7e090f5f3f69", "value": "IMG_9785.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b779320-76f1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642353953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642353953, "uuid": "f22e731a-6c60-439c-927c-5661c4e14f5b", "comment": "Malware payload", "value": "58a8a2f2c076fd8bc5bda909e1456a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642353953, "uuid": "c90bc4b4-93f4-41be-a7ee-4cd095be2a90", "comment": "Malware payload", "value": "3a550e32589fda38ebeca5616292a6d6e42842958a43376cd9f01ae6f7d135ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642353953, "uuid": "a26ef061-22bb-48c9-9576-92fec03f48ec", "comment": "Malware payload", "value": "bef36475216e76f0f45a33ea0c2d6600b945de47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642353953, "uuid": "d04e23b2-282b-47bd-8da7-c6a8b7db7e9d", "comment": "Malware payload", "value": "b7edd6ea9adf1ae3464350f3185873d5cf5735a0eb35eb9d4c4fe422700fb7f3812126d59fdc81f7a53b80874c575722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642353953, "uuid": "8867684f-01da-408d-8906-beaccf06c3ca", "value": "T19EF43363D13FA9F8F88340F8623078357B2E5BAA159F07E7B772445E6617854E02E293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642353953, "uuid": "2b934b1e-2409-4f4e-ac36-3c95d910e871", "value": "12288:V/vvmXJd0+p0v78i8BN/SRxL2kGY8x4FmAjqd8uxvwoEO5DUBZZz+wREpnhe:gZd/E78FBBM2kGY7Zjq5xooLMfz+Tpn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642353953, "uuid": "c38d193b-1cc5-4715-a98f-1fe806c07a51", "value": 770314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642353953, "uuid": "ef140de0-55e5-4c17-8fdc-931e2205e5e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642353953, "uuid": "d358b4c7-7e0c-489d-8b0e-c280b80d7961", "value": "58a8a2f2c076fd8bc5bda909e1456a8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4174979-7714-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642369241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369241, "uuid": "1b435fb2-537f-4eca-8a94-7e1d0147f150", "comment": "Malware payload", "value": "11e0dc456d2d8c89b792cf64468ad04e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369241, "uuid": "01c6e6a0-5de5-413a-8ea1-fb3eb60b945a", "comment": "Malware payload", "value": "3a8eb981721a8f5615f45b7d05b0134600ea56ce66c3b4d12d381fa98cac7104", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369241, "uuid": "f296327f-3802-47bd-8f4d-b378028c6a78", "comment": "Malware payload", "value": "f446fb239082a6657f447c6e8de0dedb3cc755e2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369241, "uuid": "4d7fb630-784e-4f63-9579-2df4bf1a1d99", "comment": "Malware payload", "value": "3efde9c3d25875ed95af05ba2352358b05db95aba1084417fb0363ff39c80110f45b81b70adcd6cc6f9f4f74c77f420c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369241, "uuid": "367d780a-2ab7-45f8-a19d-328603d190b8", "value": "T156A13AD4BFF9C499C66B243A105E4533964C316A021BAA0B35D864EC4FD1E848B4FFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369241, "uuid": "2410e933-20b2-47ec-9624-fd73ed759b85", "value": "96:7EfkuzDJfi3sMSTavzKrFj99KLXHCg4D+QlirNSDCv3laPFzH:A8uzAnbiFj99g3C1rirNS2vglH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642369241, "uuid": "c214c66d-7c49-42d1-bbc4-d54c9f462fe7", "value": 4985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642369241, "uuid": "24fd9efb-6d8b-4829-ac11-9940b53c3bca", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369241, "uuid": "9cf35a16-707d-4144-8c70-652919bef257", "value": "\u042d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0430\u044f \u0442\u0430\u0431\u043b\u0438\u0446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a644b96-76fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642359186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359186, "uuid": "61d0bf11-b129-4133-bea7-5e57d6485df9", "comment": "Malware payload", "value": "10f7d792c301c0c0c666f6b6602f3725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359186, "uuid": "d86fb1f6-ec61-4654-bb83-6eae1b4aba79", "comment": "Malware payload", "value": "3aa46c7ba183d328510ab735a4b816cb93bfaa09b972beafc96ec64e54111613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359186, "uuid": "dba197f2-2b6e-485c-98da-98ae3cdd1ef0", "comment": "Malware payload", "value": "b8fbfceba1b71cb3fa676acafd2caa18dcc6b57d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359186, "uuid": "8718b5cf-b35e-463c-9f0c-f03f181b5a68", "comment": "Malware payload", "value": "7d740e387db35e4bf2f287e2bf6e416dbdcec4d0e7990ae139c0670c44fe96a02fd426cf635731ba2a8222ede398a140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359186, "uuid": "92eb9b88-9c23-4967-a947-18dd4bc2609e", "value": "T17E2423331AA89C36DDDD98B3E65BC0C9C1C4466BF482C8A96E09405AAA14753DDFBF1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359186, "uuid": "8edf5eab-cf23-493f-bb5e-c52407fd48c5", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359186, "uuid": "ed4a8445-a6c6-4a36-9c24-ca3fdcd07cbe", "value": "6144:rNnpoWRFluvTfNPSzW2tRdxXGkzItV5XQ+:rhmmluTNazzRvWIOjXQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642359186, "uuid": "718bae61-6478-4ccf-a328-72c5e13ac850", "value": 229463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642359186, "uuid": "96dd36f7-91ff-4bcb-8bdf-758cf0cb4079", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359186, "uuid": "5c2e2e18-a6ab-42f5-b8de-e631484db19b", "value": "10f7d792c301c0c0c666f6b6602f3725.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8655289f-768b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642310216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642310216, "uuid": "770c1472-2c73-4be0-b5a4-4d9d8c4d1535", "comment": "Malware payload (Loki)", "value": "85f35803c2855f81844921ff2baf0379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642310216, "uuid": "137eec75-18e3-4e97-a8de-55475da1e4b1", "comment": "Malware payload (Loki)", "value": "3bedc30f4094869b790a99988431503015afe039c5e26662042b2a00d8f3f36f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642310216, "uuid": "60a4591e-d8f3-42b5-90fe-f327e28745bf", "comment": "Malware payload (Loki)", "value": "8e1e51707642b94df722a47203a7f75a884e9e70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642310216, "uuid": "dce3e750-a603-4d22-ba99-d5db5abfbf08", "comment": "Malware payload (Loki)", "value": "5a93fd9d53a9666556e3b2e9d0c2b8ad74d87cb4c79d65dbe7b2b6a440ae4b030b1dfa6380116f7446b0a55adc84eef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642310216, "uuid": "5eb47577-d857-4ab6-9319-1a5b44ebc9da", "value": "T1BB94AE9C362072EFC85BC5729AA81CB4FA60347B531F5207A02715ADEE4D99BCF251F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642310216, "uuid": "5ea7626b-67d5-4305-9b90-511a44239f42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642310216, "uuid": "7e840b2c-2b03-4f24-8f8d-192a328bd9e9", "value": "12288:Q9hgksY8bKz809aakBDT6I0ivBR5HtP/sugJTo3zF:MNuzWToj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642310216, "uuid": "11e6ed02-89cf-4570-b73e-1eedae58018b", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642310216, "uuid": "3a92b3ed-f56f-498b-a856-7857314510af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642310216, "uuid": "6aac8ffa-2c08-476a-80ef-005182db9588", "value": "New purchase order. pdf....................exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f4546c-76ab-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1642323798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642323798, "uuid": "06427ff7-76e4-4f69-9cc3-c0448621a3ec", "comment": "Malware payload (CryptBot)", "value": "71af238fbf3c5a3a2c2c3594f1ba8a32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642323798, "uuid": "0753a40a-dd67-4113-b537-572ebb5444b6", "comment": "Malware payload (CryptBot)", "value": "3c320ddeb57b9d6240cbaab26104e906dfa04a10115a773355a2157013e991a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642323798, "uuid": "d87ed1b7-940b-45ed-9cc3-2bad1c39dd98", "comment": "Malware payload (CryptBot)", "value": "b9f49782704b14572985ca13b10842d3aa836ad0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642323798, "uuid": "1e79f26d-6ef3-4dab-86df-90b5db8a3be4", "comment": "Malware payload (CryptBot)", "value": "e7c49eabbfb2a62709362288264161f0921894f5972a7620f66088524e0b22163e02f717880a331b2392b1f71d58c45d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642323798, "uuid": "63111ec1-a816-4de1-b7e2-76a46d52bb8a", "value": "T187C533C9F1D14D2CFA3613FA677796AC60A5B2C88B904336261BFB27419E7DEB741012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642323798, "uuid": "c62555f6-e9a6-4733-83c1-9fd6df1ccff5", "value": "076fd3bc44050b5480459bd4d8e1a2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642323798, "uuid": "351b9232-c016-4340-b076-6f1901a0a892", "value": "49152:CfOvZRdfTgXdzaoRCK5btOmZy7pbHjaONrPIZ:CfWG+/abzZy7dHjaOaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642323798, "uuid": "05df1b37-d446-43ff-a89d-7307df495488", "value": 2620928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642323798, "uuid": "eabdc676-7e65-4333-852b-a9aec5400782", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642323798, "uuid": "7d31d6c7-072b-4cfe-8c93-d81b4ba09a48", "value": "71af238fbf3c5a3a2c2c3594f1ba8a32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451b9d67-770b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642365082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642365082, "uuid": "8c0b2bd6-18dc-4eb1-8511-19d900cad25f", "comment": "Malware payload (RedLineStealer)", "value": "68e3c73c9189424763b2924f8db094e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642365082, "uuid": "e864f40a-64ed-43d9-88a5-ef7c610ea908", "comment": "Malware payload (RedLineStealer)", "value": "3e3d08ba09905af622fd8e48be0957a381695fed7878555205ba4e900e065fe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642365082, "uuid": "de616b27-18ee-4d5f-a525-47543b2a9676", "comment": "Malware payload (RedLineStealer)", "value": "31221dffa9286e860b62d0953e0e0db5f808dc7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642365082, "uuid": "6beb9ae6-e27d-469e-9bf5-b726df967b28", "comment": "Malware payload (RedLineStealer)", "value": "a1f6183f7ffff3d9bfc2c47931529f62a848a1c3ca1e282b7af97ef264165bc1d551e281c20368acf71ebafc41483949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642365082, "uuid": "77f72271-51a9-44a4-9cfe-fcd8265a0275", "value": "T17D55337390CB6E2DD1441DFE8E86F281AF690D10F96847985359C527A07CB168E8B7F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642365082, "uuid": "fc903732-a612-47c6-9230-756cf87be6a7", "value": "f6af73011d9ad7cbccf66eb190442910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642365082, "uuid": "4f787caa-0224-4b57-a863-1a6a3f2406f8", "value": "24576:8M05Yb0aU+sOwCVkh59kSgd9m4yuhWxwrPQ+auDmukEaHNYK3gBm5nyeVOg9:8n5Yb0aU+fvd9mjorYruDDNaUm5nyg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642365082, "uuid": "5b150dd1-5732-4f3a-b669-554b7e4696f8", "value": 1352704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642365082, "uuid": "f4b5dbca-02fc-439c-824c-8cf99019abda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642365082, "uuid": "fab20464-813a-41cd-9a5b-c544e058570b", "value": "68e3c73c9189424763b2924f8db094e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97262ee7-76db-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642344604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344604, "uuid": "caa59f15-22fb-4b0d-b90d-4a851bb3b795", "comment": "Malware payload", "value": "3216f52d6a77bf57a24fc7fb0aba5d65", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344604, "uuid": "e81e741a-f437-43fb-ac77-9ae32eded670", "comment": "Malware payload", "value": "3f132cb9f484c0ae245dcfa1cdc38783dafc311b4a21baaa8e9b2e5648664e90", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344604, "uuid": "5719ceb5-ae1e-40ec-9a86-dad6f932c1b6", "comment": "Malware payload", "value": "d36a82fe7e175f28d9536954fd0bd2bc238fad4b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344604, "uuid": "8152b1a5-eef5-4f04-9544-28dbbdd2a1ff", "comment": "Malware payload", "value": "a631db6e5ceb68c26b8e85a048bf1282fe2b1226e35e246022ac96b182f177025b56a28e55820187c5f3c6e28cead69b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344604, "uuid": "3f143e13-7e4e-4cd4-b447-daace0ff807f", "value": "T186430114C709BFA5FB7B6074B42690D2336A0BE5F26BA2C4D73E0B3215D850B61EA5D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344604, "uuid": "bf408d79-3c6f-45cb-b5c1-5d8530ca6056", "value": "1536:Cin4/vjvlGhKHhbLf1WN8WyIft9vZErRJVg:v4zloKBeNyI3vy9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642344604, "uuid": "56913def-400c-48ae-bf14-e91404b141f1", "value": 58720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642344604, "uuid": "7865c30b-4d08-4abf-9cfe-d6781f917c4d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344604, "uuid": "00b2252f-8c21-4378-93bb-5e7bd8022b79", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9462030a-76fa-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642357914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642357914, "uuid": "cc9a98a0-b20b-49bf-91fc-ca388da31c2c", "comment": "Malware payload (Mirai)", "value": "c23222a46cf7a14201816aa9facedfc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642357914, "uuid": "87721ee5-259d-4577-ac4d-52b49f7c2e7c", "comment": "Malware payload (Mirai)", "value": "4652766b871f0e0b2228b84abed9af491bd8fd057a49c460579325d0ab6f3a22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642357914, "uuid": "3ded5fb7-17d8-4afa-8016-7869553a1b78", "comment": "Malware payload (Mirai)", "value": "f4a5713b6afbc1c18f5908878bad6c99a3c4e320", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642357914, "uuid": "91fdd790-84d9-4dfb-9b05-d35eb5416077", "comment": "Malware payload (Mirai)", "value": "ec7be4c59555c586b06bad718be70c6858a677600dc64d3cb9bea4103b913c12b8ebd0016df67efe66002edc8cf44aad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642357914, "uuid": "ce37793f-8330-45e4-b16d-f7878a69f6a9", "value": "T165530A817C916A39C7D0577BEAAF108E3354ABD9D0DB7347CC044B917ACA90B0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642357914, "uuid": "76e12a8d-5137-4bd1-b552-5045f77843a5", "value": "1536:dOxGfyRWiPLacGXWzM9l6yTzpl84ETjpk19y20Yvck6YceZWGzD2MH:dOxkyRWiPkjX0QckVcwLzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642357914, "uuid": "6f800049-dd7a-4ebd-bf42-29e577efde72", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642357914, "uuid": "8cc9959c-b085-4f22-86e4-c83fc4d52d7e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642357914, "uuid": "5fcb92f3-c047-49b1-b739-8777d4f28a41", "value": "c23222a46cf7a14201816aa9facedfc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9615a770-76db-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642344602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344602, "uuid": "dc3f810a-0b05-4b0d-a656-e9e9566f737e", "comment": "Malware payload (Mirai)", "value": "21ffc9064c53ace1d6be240be2aa65f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344602, "uuid": "8d0fa01f-cae4-4fa6-a6b7-c12caceb265a", "comment": "Malware payload (Mirai)", "value": "47cb6332b605bd0fa9f852f6e94586b1813ef03a5135f21a70aa4b343a96f297", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344602, "uuid": "d2994e43-0d47-4baa-a329-4f6c85e4fa27", "comment": "Malware payload (Mirai)", "value": "ebc0ee7c6ec17bbd37ee27e9a56e3e21c06a55df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344602, "uuid": "e8213ae1-0e0c-44b4-b73d-1a5b799b396a", "comment": "Malware payload (Mirai)", "value": "1cf2d148a798c233102be69aa8453190ea377cdbb93cc97d2b587745476f1c29a39292a8906f0a94c3c07eafee15e24f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344602, "uuid": "90edc95a-fd22-436e-bac5-6b18b35c0bc1", "value": "T1E6D2D011E1979B86E1AA08F21CDD78550420A70F2880F5D3EEA5737A4D53F24272DFAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344602, "uuid": "cb513828-c9dc-4b75-bd25-1b8503be31c2", "value": "768:md78ykw0/RCgm5dY+6GtVbZHFGH1OlhKMFk2CnbcuyD7Uryqv:w7RLHY+5tVbKH16KMF6nouy8mqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642344602, "uuid": "ffe23c27-ce2a-4f20-915a-e1889bb326c7", "value": 29616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642344602, "uuid": "9ed4c8e9-e380-4b77-979e-2878efd682e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344602, "uuid": "0fd938a2-ae09-434e-9554-39eb89e38e19", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cf9522-7716-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642369815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369815, "uuid": "d46146fa-7496-4825-b2cd-28e5210e9f20", "comment": "Malware payload", "value": "57692807fac76e215a1e5338a3b68d64", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369815, "uuid": "a3c640c6-3466-466e-bb6d-d78cae51e97c", "comment": "Malware payload", "value": "4a41d9b61a9d42648bf125116b363d285cfb28358e15a4860fd3582e75c60914", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369815, "uuid": "917d6aad-9fab-4556-b82e-c01c0e10572a", "comment": "Malware payload", "value": "04e0da8228eeb0da558ad71c9037e621e571d762", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369815, "uuid": "8604d40d-e90c-4aba-924a-4c7bfc3a0d48", "comment": "Malware payload", "value": "425496f6a7a70e86c21e8b871826dc60b7cddfd227acc71eecf2cc87ea081323f39b572590154aaff8dab34d4c56f0fe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369815, "uuid": "efa0a9f6-4c5f-445c-9925-ab95a132120a", "value": "T1AFC2C0BDE8A4BD46CDED08388CDD13B4099D75C6B68E4FADD2261DC4BB2018B3C9A474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369815, "uuid": "c9b2bd1a-878e-4bfa-8666-d30e78043e11", "value": "384:PmWuv+78AdGa2nS3xbjJUFbviosPlozhfbIAawprR9gICSk3kImQ0KnEzrEcftwx:P7ddenS3j6Koolozxfk5JmsEzrttIW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642369815, "uuid": "40bb73d9-bb6d-4860-a95d-24f966bd30d1", "value": 27252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642369815, "uuid": "194bdb35-8565-42fc-a642-32d49f488926", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369815, "uuid": "adadca80-e7ca-4ca6-931c-866ccef8220d", "value": "phantom.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4723ac5c-7716-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642369810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369810, "uuid": "61ddb265-1c5f-4ed3-98bf-e256069b0ecf", "comment": "Malware payload (Mirai)", "value": "44bda6779bda7c0f9a9377d6ad456d86", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369810, "uuid": "e3c5d5b4-9c67-4e92-bced-6ed041492bf6", "comment": "Malware payload (Mirai)", "value": "4ab535e0ea707407ad4ed7ab940e7dfdc2b83cafd56bbdcd81347086691a6bbe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369810, "uuid": "41e9fdd1-960f-4adc-b2dc-8a129b154d3a", "comment": "Malware payload (Mirai)", "value": "19fce3edc08e3df3ef9ffa0a14af6671e0b1b15d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369810, "uuid": "d6179aad-5b27-40d0-975e-c71f6190e066", "comment": "Malware payload (Mirai)", "value": "f5991a93eecd0ab58529cc5a30bb3d760a75a52ce71271a19b348770982814ba6c7050af78c5fb495c71a8e7a5d2268d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369810, "uuid": "5982d0b0-aef3-4130-82cb-1a589c3395bb", "value": "T145B2E1C5D6FB1BC3C291D336E07C4A4DA2726AC10786450A610D724EA7A760E4BFF3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369810, "uuid": "7674754d-4f53-4eec-bd8c-258070eb9a24", "value": "384:M8DKKQOcRpmYLdn6RBOFRFt5rUFX1DiSIlCo3AnupCFNqnrrd1NEZgO8UXWozPLc:R/QOC0Yhn6ROHWFlAcwNEFCnNBxckEcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642369810, "uuid": "f4a0e104-923a-4d2d-8f9c-60e3f0616d2d", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642369810, "uuid": "715883de-3b6e-45ce-96ec-1fb681819cee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369810, "uuid": "260d0908-9fa9-450e-bb79-3fa0ed854e7d", "value": "phantom.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab042db-7709-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642364448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364448, "uuid": "5f160553-af68-44b8-bb3a-c2b8ae4a0803", "comment": "Malware payload (RedLineStealer)", "value": "90be1405952d8e5a1179b64bb5b68001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364448, "uuid": "a4c5dd79-3946-4c36-a8a9-2236cfec3fe9", "comment": "Malware payload (RedLineStealer)", "value": "4c25ff7d46a393a4273cdcb0d3cc46f1539287bf3c4e5f4bf7df922b9e617aff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364448, "uuid": "b0725b0a-19de-4435-bb3b-0af6abb4b585", "comment": "Malware payload (RedLineStealer)", "value": "a966975738810f4e7cda50882f49015e4ed8b7ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364448, "uuid": "8e4213b0-55c2-4d0b-b259-2f866a839d67", "comment": "Malware payload (RedLineStealer)", "value": "e6eeeefd3d11279e30d4e0d16e18cac14e664cc1732e74df223977e35a1b80266f03650c001fa0023ca2f056faa43e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364448, "uuid": "9ee74a26-3623-44e7-9763-c6dec4c28b0c", "value": "T14554AE10BBA0D035F8B752F44A7AC3ADB92E7AB15B2490CF52D526EE16396D0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364448, "uuid": "07ca0815-29d0-4498-ab31-6729e8080791", "value": "80720d283b0420bbcbb388cde3e0df65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364448, "uuid": "3dc51f74-d792-48c8-aca6-f2b6a2adca77", "value": "6144:Td49vuZ8a8pfCPwu2c/YzxNasARdXAapeMrYH8nHu:TCQZ8HaIu2c/YDasOt0M88n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642364448, "uuid": "6636ebe5-7648-425c-94f8-715b6fdf005d", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642364448, "uuid": "4bf8d91a-826f-45f4-93b6-263349cdd351", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364448, "uuid": "85590d5b-56cd-4194-b7d3-fd3c9440269e", "value": "90be1405952d8e5a1179b64bb5b68001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a24f095-76cf-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1642339294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642339294, "uuid": "1bb83bd2-d32d-4ef6-a012-cdeaa102cdb1", "comment": "Malware payload (DCRat)", "value": "2bbbe7e01f4a0945ed83ad7e33311077", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642339294, "uuid": "18081f0b-04f6-4149-8575-2904c728520e", "comment": "Malware payload (DCRat)", "value": "4d41e5806129d1aeb4c6278a3e0092bab930a910d2f7db31a7d51fb034971cb0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642339294, "uuid": "8bedb627-2461-4c5b-b1fe-14aeb0169bc2", "comment": "Malware payload (DCRat)", "value": "30e022d13069f1e0445e4c02da4b31e903a0d6f8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642339294, "uuid": "67ac74de-5e68-4138-9594-1d20efe5021b", "comment": "Malware payload (DCRat)", "value": "d030c858159eb660153735beac0148d7eca3fadb416bd946802d5794abd1193ea355c1c4ab7b7023808336918fb4f54d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642339294, "uuid": "8986261b-b67a-4d59-b96e-80e8ebe22f04", "value": "T13B944C282BED4A29F1BFAB79D8F22555877AB8677B2BD74E0CC101890923741DD40B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642339294, "uuid": "4f9f9a6a-29cf-49a9-b364-5a41460db8d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642339294, "uuid": "4ecdff9e-41f8-463d-a2af-28a5d7b4f9e3", "value": "6144:rdKWC00lyKG9s0bKOAv5hvsxdPp7NV+2YXNFso7MyBBCMk+brXbm8VxZKzscC3YL:Zs0NK27AxlsxdPgdiq7B9rS8jZKzsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642339294, "uuid": "0a768f59-5bc3-4a72-b23c-e4b8e3f25bd6", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642339294, "uuid": "071570e1-3af8-4e00-b48f-743224d797b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642339294, "uuid": "7b4931a4-0e18-404d-8978-e6daa9665d76", "value": "4d41e5806129d1aeb4c6278a3e0092bab930a910d2f7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb4b93c-76b5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642328318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642328318, "uuid": "3e20c199-943b-4b85-87fb-7df63b024f3c", "comment": "Malware payload (AgentTesla)", "value": "745474b96e8863692f33dc56a3a13b70", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642328318, "uuid": "5a34f256-1619-4cb2-89a2-24f6d4e17536", "comment": "Malware payload (AgentTesla)", "value": "50b3d692a26c9993aedf191f12d18bec7133822671183d8895e391491dedf58c", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642328318, "uuid": "433d0b8c-f246-46c1-97af-d1b57acf6f71", "comment": "Malware payload (AgentTesla)", "value": "d50da2390a144396ad676a5574278b24f0c54912", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642328318, "uuid": "83586a1a-1781-4604-9bc0-2358497d2a64", "comment": "Malware payload (AgentTesla)", "value": "15c94bde2608d3e35ddd180e40e15e21fe0144f12fe5ae9d5f68b7270884ab5ac4557f21607b95c93042b55397f8effe", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642328318, "uuid": "3e7f53c8-22e9-4e03-88ac-8757fc7248c6", "value": "T1FBB423EDA335E0A4A96787361DE37ED731B2D5D83D89E01FFE8C59434025AF09A016AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642328318, "uuid": "21963504-e6ea-449f-a996-ae5787a2a8a4", "value": "12288:xUKkgpyAJZFuJRrN1Ig3r8Mjze/3/xBrvihURQ2C:mKkgpygZwJ7SS4xBrK6RQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642328318, "uuid": "1f6e1e90-45f4-43df-ba7b-cf1bfc7f6e26", "value": 498686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642328318, "uuid": "8c1ecbfc-f570-47e8-a905-dbb2dc51bc38", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642328318, "uuid": "176f5b04-75dc-4b46-bfe8-4cec31ca4cad", "value": "RFQ DETAILS #11-17.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813b9bf7-7705-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642362606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362606, "uuid": "0d0e6076-6bf3-4a35-854a-9b272952e77a", "comment": "Malware payload (Mirai)", "value": "0875c4971fd25db0a2cad3a483de3e7a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362606, "uuid": "53ea1135-788a-44fa-9592-ce782f8e0dc8", "comment": "Malware payload (Mirai)", "value": "513d0088e4dbe46cb52592ecd63b2a756939b190ead9a0c22a98714832317c81", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362606, "uuid": "9ff83632-229a-46b7-8708-5e54a2797ddc", "comment": "Malware payload (Mirai)", "value": "69398ae6481167c2098d5506408d8d12c501843b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362606, "uuid": "858da830-16cb-4a38-8589-945529ce0044", "comment": "Malware payload (Mirai)", "value": "c8c6e48db5b6a25499596512885e7ce6e7e3a9e2ac1998a447a531714e7618c7bc31f662e4dde5317ca9e68ca4d1097b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362606, "uuid": "3d3cca75-5c48-4829-aad4-4c3353ce684e", "value": "T1EB734A82BC919B12CAD022B6FE1F419E372613D9D2EA7217DD155F2037CB92B0E77152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362606, "uuid": "90e6d0c5-e057-4c49-b3b7-2649e041e368", "value": "1536:d980zVrHKUChAIcZ5oreiWMgcGsk2/gV+9ePqlx1z9vQe:d93ZKUgU3sM3I9ey3vQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642362606, "uuid": "d30f94e1-5bb1-487d-89bd-3ad89db3a499", "value": 74884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642362606, "uuid": "47154af6-28bc-4b69-9a3a-e6451eabb833", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362606, "uuid": "ebae6754-53f2-410b-a0ad-607bff0d3aa5", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4fc89e-76a6-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1642321821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321821, "uuid": "76f08601-c48e-498a-9d71-1b98cc1f1041", "comment": "Malware payload (DCRat)", "value": "a5b07b08a04f3a7939e88ede1f014d45", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321821, "uuid": "b3fa3af3-1208-4e46-87c2-19dc49a4e486", "comment": "Malware payload (DCRat)", "value": "5737dde2ad2728e0fc513169dd4c5554a7549ed71d1d38cdefe90ab73da3e862", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321821, "uuid": "efa44a52-72ca-4c9b-954b-edd4e57052a2", "comment": "Malware payload (DCRat)", "value": "954b2ee6ec4fc23e04976432a4a3f39157f1426e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321821, "uuid": "6d2c02db-b28d-4a95-800c-dfe3c9cbfe08", "comment": "Malware payload (DCRat)", "value": "e9f710ece3d5ecf4cc6079d78040958893585defa5040eedaa545c0dffd99ef6a6e9a866ce5277f82bedd57ca59dd18d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321821, "uuid": "04ae7071-feed-435a-99d8-2538e8be46cd", "value": "T1B63539027A08DA01E02A5637C9EF811447ACEF427A63DB1A7E9F336D6551BE71C0E5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321821, "uuid": "63a118ad-b2b6-4ca3-babb-6135330b2b80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321821, "uuid": "e43dd2bd-4364-4fdf-bc47-5632ee58e6e1", "value": "12288:u+jFrEyWxu/4+opO18qzx9MSXAwDQFFZDkGDvwN/XzjUEsBslDIO5a2H4ml5OpvV:usFrkOLGnEsofXYg5Ox8jvqOE3R+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642321821, "uuid": "68839beb-d136-4051-9696-4d0c8fd66843", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642321821, "uuid": "a7caa3a2-dc63-4297-a184-298487e491f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321821, "uuid": "1501fa54-5327-4e5f-ade1-5f6a5a704769", "value": "a5b07b08a04f3a7939e88ede1f014d45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfccb6b-76a5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642321208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321208, "uuid": "98cd4149-f6b9-4c8d-a3ea-eb73a7abd0b1", "comment": "Malware payload (AgentTesla)", "value": "e61d3a8f45438dbfb5708827bd138958", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321208, "uuid": "0e790c37-0b24-4849-b6b1-969f76eba92e", "comment": "Malware payload (AgentTesla)", "value": "5a2ef97f20718bb9f6244916facdf7d6c897aee9952e9f7723ecadf3d7371444", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321208, "uuid": "0fc5acf2-df5e-445c-8a6c-78f250905c1b", "comment": "Malware payload (AgentTesla)", "value": "e8a723a9b90e286aed42f0fcb628ef2fe12add01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321208, "uuid": "ab857739-1c59-4376-9f1a-346b88ff1233", "comment": "Malware payload (AgentTesla)", "value": "3b1e36956b84ac8f71bdf30e0e4d4f2eaf2b4f26ec611881129daf823410db44f42dd3765eb4fdf9440299a1d5963bdc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321208, "uuid": "0d5966dc-5249-439c-ad26-9d1c91ba61e5", "value": "T14DC4CF8D322171EFC84BC072EEA85C64FA6174BB931F420BA02715AD9E4D987DF255F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321208, "uuid": "11a46df6-f202-4612-af1e-eb0d66a6c8e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321208, "uuid": "c44bcdf4-2d1c-49f9-83e0-cbea3126bdd5", "value": "12288:8ULIEkBExWKyIXlFMyHcBJnSk3chPbgduOgc98uQkvTn7QvHlKYcmrE6ZFjkypqP:8NEgJyTgkOJ98urv/QvlmdyYO7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642321208, "uuid": "f0afd37a-89ae-4620-83ba-6b4415dee014", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642321208, "uuid": "ce8d5f35-91b4-40e0-9ac7-41205f486796", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321208, "uuid": "7b212c5a-a593-42ad-b080-f89c0635a9f4", "value": "INQUIRY DATA #11-17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd9707f-7708-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642363859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363859, "uuid": "7e133a60-0825-47d2-a71c-b60e38ba28c9", "comment": "Malware payload (RaccoonStealer)", "value": "6ecfdacc2c23f38fe4886ea1c18806d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363859, "uuid": "58e873b7-454a-43bf-9f84-266a50ae8a1d", "comment": "Malware payload (RaccoonStealer)", "value": "5a316297fa66883f4627c967cacddaaf97e28a598077804be682ff04022d634a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363859, "uuid": "6121a6cf-1c09-4b25-ba5c-573a71d5598d", "comment": "Malware payload (RaccoonStealer)", "value": "524140233b8ea745d5036d2da108ecb45b853638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363859, "uuid": "0d35d977-069c-4b64-8c47-27b5531023c9", "comment": "Malware payload (RaccoonStealer)", "value": "dc1fd0cb712e9a80a5fcd0c090286755ad38c1e33342374876c969c74b2121099b2f733a0dd9d1507ef0db000cf0d217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363859, "uuid": "66c29b98-42b8-4509-9aac-d63022fa956e", "value": "T1FF54AF10ABA0D035F1B712F8497997ACBA3E7AB15F2590CF62D916DE16396E0DC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363859, "uuid": "4d17e16e-463f-4de2-a620-ec8311fd6d3b", "value": "80720d283b0420bbcbb388cde3e0df65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363859, "uuid": "198cf35a-29a4-4641-8322-f9d7c8751a2f", "value": "6144:X1sIWlmkarEHCF24KiZls3TFk2kF8beVHstmYM:X+9mkjiY4KAls5k2Re+wY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642363859, "uuid": "f0df028c-5219-44c2-a41f-b896da86c2e3", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642363859, "uuid": "b446d3eb-f58f-4922-8510-d041ab9a65c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363859, "uuid": "a7dcde2d-4dac-49c2-b334-06680a04991f", "value": "6ecfdacc2c23f38fe4886ea1c18806d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19f2ba4-766e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642297860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642297860, "uuid": "c77d79d2-6291-42f3-b695-dda0a6c87b3a", "comment": "Malware payload (RedLineStealer)", "value": "069d80fe8da9e837814457520aae1321", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642297860, "uuid": "50819ec6-6e45-414e-a01e-ba22646877b3", "comment": "Malware payload (RedLineStealer)", "value": "5bbceb5e3528f3d8e12993d1a4b8d637b309a1363ac7afa8c886d6231b7367d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642297860, "uuid": "12cb1063-7f6b-418a-9b6e-d3ad06a0c138", "comment": "Malware payload (RedLineStealer)", "value": "af57ef2f5661c1995b1b5b7defb5f258f97c11d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642297860, "uuid": "98f96316-c0f2-48a9-ba07-654cd668ebf4", "comment": "Malware payload (RedLineStealer)", "value": "9df16c35b17f0490d07e43bbbdc5de1e8eb30cc0763f6bfe631f37a50f45b04f1d6419777748e264770ca2f37135afa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642297860, "uuid": "7cdcfcce-612a-433a-ab23-af382fb2dbc6", "value": "T1D7A31A6437C88614E5BE0F75B8F0519943F0F5536501EB5F6EC660FE0EB2B81AA21AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642297860, "uuid": "bbd98187-8086-4e4a-9300-316c79eae5c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642297860, "uuid": "65cccb8e-1d47-468d-8435-71a3733b5240", "value": "1536:kUVrk5RhnBGHDtXNE3A0GWNzTi3+zJXAbbYpfoIeRw6vsSM00u:kUVIf4HDAQ0GSXiAwHjVEpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642297860, "uuid": "78a124f5-8213-48fe-9019-352ff92ccdb5", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642297860, "uuid": "5ce90b54-bc3f-42d2-a157-9410452244e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642297860, "uuid": "7f1f45db-69cf-436f-af24-777f85385b38", "value": "069d80fe8da9e837814457520aae1321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3434c23-7689-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642309460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642309460, "uuid": "3e4a18bf-47ae-4285-8450-2a375429a87d", "comment": "Malware payload (Mirai)", "value": "104063f1ada23709a9f4969daa4efad7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642309460, "uuid": "95f8b632-1386-43f1-96c6-b2daf145e3b4", "comment": "Malware payload (Mirai)", "value": "5bf157df7cb1d58c600472b4e5c582fc7872393ed231a923cd5b8a7bd95431a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642309460, "uuid": "9dbbd9a1-7435-4176-82f9-26cc4359ceec", "comment": "Malware payload (Mirai)", "value": "789dbfcfdf2c780e6c6fa97301f040cf06381688", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642309460, "uuid": "d40e89be-c1c6-4894-b0ea-3d3af4166337", "comment": "Malware payload (Mirai)", "value": "2ea19e2c9cfadfa282821412b1fc625d7ae98b589b88bd10cf635e2dac5703f98b8ed064f84b9b596b1d041ae7c17135", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642309460, "uuid": "773650f2-17d3-469a-bc34-2bc390d94e0d", "value": "T1A713E162D0DAA1CEC056607749F86C8B2C1CE50854D8887FAE9833BF54FAB34162C7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642309460, "uuid": "f0771bbc-3d9e-4ba6-8487-6a97f9acb311", "value": "768:+JGSoBv76iuQyfSQya+lmMvecTCfWh0cAhUFr9lJyrPw6AnbcuyD7UHQRj7:Lj7RQ5h2xefWh01hUFrfCPAnouy8HyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642309460, "uuid": "a2cc446b-c174-4dfa-b654-8be43551ff64", "value": 41632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642309460, "uuid": "320ef3cd-fb5a-4b9f-b9d0-b36d8887b4b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642309460, "uuid": "0feb95a0-7d2b-4005-bb43-c8a9a966c4f8", "value": "104063f1ada23709a9f4969daa4efad7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b82b27-7717-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642370404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642370404, "uuid": "19bfe139-6f87-4db2-8278-9f923662f382", "comment": "Malware payload", "value": "c51d92ad7700f809d6973409fa68a35c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642370404, "uuid": "1eb27d36-cf6a-4220-85f2-1400f4c215be", "comment": "Malware payload", "value": "5c1b168048650b416c151e5eecad701c718bbaf1720ac4533adab7d79c769275", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642370404, "uuid": "f0c77488-98d1-4c51-9b75-617c53cf0a8f", "comment": "Malware payload", "value": "34c15688cffa15e00767fcd7c49605aee1b9dc53", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642370404, "uuid": "57c1c177-18b1-47ec-8d0e-f14c118396fd", "comment": "Malware payload", "value": "e830feeab55cb3bbb03a177b6e3c0b4b45f6a7761fdfd1f2bfa52cd4272b480356312e7ae1905a4f617febfabb82310a", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642370404, "uuid": "d682c904-bd35-4ed8-8fdf-dfe14b3d9372", "value": "T1B4F5330C13AEB8FDB89946383B6389E0C5E552F1988260F2D77C1598183F57D1BDFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642370404, "uuid": "a82a96ce-1089-4a24-b4ec-0b3d23c4878a", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGP:0XSxVJG2fLAqFOfT9sMYNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642370404, "uuid": "2eff9880-8c03-4f41-96b2-a9b4f9304b08", "value": 3411968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642370404, "uuid": "aabbd5f5-afe0-404d-b81c-a31ea29b0e7f", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642370404, "uuid": "8fb1a78f-528f-40b0-adce-542fbe874fe5", "value": "5c1b168048650b416c151e5eecad701c718bbaf1720ac4533adab7d79c769275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95563a91-7668-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642295209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295209, "uuid": "f6c63872-4050-4530-b21c-8d31c585a0e9", "comment": "Malware payload (Mirai)", "value": "7d77f67652e553cb78775fec8f89d0c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295209, "uuid": "f6c6580d-6fd1-4ffe-83a2-eedda171c00d", "comment": "Malware payload (Mirai)", "value": "5d50672c2227591447111dec2b3f167aa2effd233497f6844f767df2f3c3cfe9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295209, "uuid": "a3e49c29-d49b-49f1-b969-6dcf6c7739e4", "comment": "Malware payload (Mirai)", "value": "a8686b2ea7c8d21cea75cd2ee40ab246b8c7938a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295209, "uuid": "493b7569-7ce0-4bbc-a645-4b8862cbb980", "comment": "Malware payload (Mirai)", "value": "626dd73a73003ffaa90d425bd21f4ad87cad2b736b36cd3fba3df1338269b792118b9c5b7f6aba29588c621882dd4fea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295209, "uuid": "d5665769-2b00-4070-8500-4af907a1196f", "value": "T132531946FC818A11C9D413B6FA2E118E33136778E3DF72129E116F24778A96F0E7B856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295209, "uuid": "222f6a5b-382b-4e78-a060-e504674ebfa9", "value": "1536:ccnAy020sNOdo94sAQVl+YugHdeqhSnJMTi0uPrhn5:h00NCHspligH4UuPrhn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642295209, "uuid": "e3d0ede9-1865-42a3-8919-7a16e483f1da", "value": 62808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642295209, "uuid": "0b174e26-2db8-465b-85d1-348e549833e2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295209, "uuid": "6618fb08-37cd-4e89-b4f5-12b5f11dc612", "value": "7d77f67652e553cb78775fec8f89d0c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f36da5-7707-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642363636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363636, "uuid": "218f5734-738d-48a1-b4a6-8956609b8786", "comment": "Malware payload (Mirai)", "value": "ad4d5c9634fc5d1c1c89277e464e375e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363636, "uuid": "e69c86ea-e10d-4ef6-bdb0-127ba992a221", "comment": "Malware payload (Mirai)", "value": "5e5b80f9a47e4a574a4fd859448699e1ef669c075349678c8a8e1134c7a2888e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363636, "uuid": "c3e359fe-166e-4b15-a55c-35382b67beb1", "comment": "Malware payload (Mirai)", "value": "e2ecabcf86ef2eb7f95dde76c56ea1c9ad7e1af4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363636, "uuid": "a554a888-af7a-4b17-9f8e-f34fa8978b93", "comment": "Malware payload (Mirai)", "value": "ed1a0a42fe8cbc090564bea7da5122d8e2fe62e512578e4b134c2ab9f3f84d49d1d3aeb2e88990da024a8d0cd31423ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363636, "uuid": "e6d83cf0-6b41-4b08-b3e4-e8f8dfff0008", "value": "T1C993930ABFA05FF7E8AFCC334599274524CD555A21A83B79B930D828B25B24F15E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363636, "uuid": "b7cce0d2-cfba-4512-9822-e71394b8b137", "value": "1536:63xhadOfj2IEg2AyxcFW3Pv4c3y3a55oG8:6BhadOfj2IEgB84GyIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642363636, "uuid": "5ec70531-bcf3-48be-a9f3-cb182b2a6e85", "value": 96608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642363636, "uuid": "1235fccf-e83b-44d0-8860-08b91ff53687", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363636, "uuid": "41307078-54f2-44c9-9a71-6e09546eaffa", "value": "ad4d5c9634fc5d1c1c89277e464e375e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb19b2cd-76fc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642358838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358838, "uuid": "9419751a-7a1b-4601-840c-cc4a102efc1c", "comment": "Malware payload", "value": "b1c8f767f5c5514670b75c37be8465fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358838, "uuid": "c4b5fe34-dd3a-425d-a678-c780142404b4", "comment": "Malware payload", "value": "6078671cf55ad16b428b1e56e95cb2d714b3549d48583a9abd30136335e1ceff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358838, "uuid": "17f5bba0-c095-46ff-949d-f4024f32ab43", "comment": "Malware payload", "value": "073c15f4826668c4274db5e16e1355c40a7f7b53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358838, "uuid": "5eb07cda-648d-4aeb-bce6-7ec1b9d80788", "comment": "Malware payload", "value": "74ac4447b4e0c5129e56d60c52eb7390eed42307e5567a49d09577d938de5c83251e2c91801f52d4ed67abfdb4bedf72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358838, "uuid": "9af01dcc-e84b-41c1-84cb-91c45fcca705", "value": "T127710A47B7738730C48940BB25197D1AF39DC97877262E075B4C18066DD148BD93A63A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358838, "uuid": "2bdb2a8d-a888-41c3-9b81-d189d1ea8c24", "value": "48:CTT53Nv9+sw1RAK4OBRuPGH+H5d7tOGxm79cyGwUkC+F93wPQWmiB:KThNVLaRAGBCGHkP7tOGx9CA+/333iB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642358838, "uuid": "7ea5f951-c92d-4f94-b94c-272bce6f2017", "value": 3504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642358838, "uuid": "99fd1426-44d4-4c3b-a310-ddd29351809b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358838, "uuid": "62e90b95-6569-438f-8a23-cb99d93dbb4b", "value": "b1c8f767f5c5514670b75c37be8465fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a059509d-771d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642372966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372966, "uuid": "c152077c-9106-4db6-aef8-04a074842bfa", "comment": "Malware payload (Mirai)", "value": "926d5f7d8e2645c5b7a05c3e625acd85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372966, "uuid": "24468bca-3b74-49e8-83ae-c8adf4d88866", "comment": "Malware payload (Mirai)", "value": "608c669405bbbc0c39762259d1484bbf3741c2d9cba0c3ca479f4a0e9d2931fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372966, "uuid": "26803d8d-10aa-4b7c-945b-6857c0725d1f", "comment": "Malware payload (Mirai)", "value": "392cb118910d517541bf1cb52225d39c641e1380", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372966, "uuid": "c4c2b09e-b1e8-46b3-9a07-eef2cec55689", "comment": "Malware payload (Mirai)", "value": "aa180239466a37656979498327dbb83af211f063dc0928481734dd1fbcd5f28f10ee26d598a0ac7bb09eeb2144256252", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372966, "uuid": "530c663a-0e91-47e4-9b86-9dacf018b52c", "value": "T14E333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372966, "uuid": "28c70e32-e010-4cbf-99a1-35f1b611bdd9", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380Di:dsfIBZeNlJDFj0imvppqmUJP6Lc8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642372966, "uuid": "72eaf247-7bcf-4950-aa1d-cc245ef20ab3", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642372966, "uuid": "64bb7222-1f56-44db-9349-05d4a041a3b7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372966, "uuid": "390f63fa-fbf7-4b02-a45b-f24532d098b9", "value": "926d5f7d8e2645c5b7a05c3e625acd85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e2803f-76cb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642337705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337705, "uuid": "28ae8b5e-7b80-442d-bdc3-5ffa07f15e82", "comment": "Malware payload (RedLineStealer)", "value": "8f40f0e81402121487db4458a81615c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337705, "uuid": "3d7b971f-4c3b-4044-86ad-9987c4ff7fdc", "comment": "Malware payload (RedLineStealer)", "value": "609a2193a30a587e3bf1e4669b6df5fcf6063175f65681055810002c31018cac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337705, "uuid": "eed2dd40-6e19-4066-b1b5-6d0d5de7e7e0", "comment": "Malware payload (RedLineStealer)", "value": "85372fba25995492954224a8c854e8c7704f0283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337705, "uuid": "1f3e1c3a-a379-46f9-aaf1-8d829a07e648", "comment": "Malware payload (RedLineStealer)", "value": "02cb1cab882ca874eae28042146b9581d139dcae97deda08046eac516c23947dabd63b764337ec41d5adcbcb84e8cb46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337705, "uuid": "cc559c23-72e3-4d00-8485-c3df8f7be22d", "value": "T12FF533BDDB7E7A1EFB0044F89BB5FE0F51BA0B9B14838C977DCA041A582297994061C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337705, "uuid": "cbcff5a1-e48b-4efb-941c-0787921db401", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337705, "uuid": "9f8150c8-1446-4403-b17a-e6894d91e342", "value": "98304:gDfkOT5VlpGMt5mBtfvaAbY2abc2IW1Uvk+Czw8QXoPQr:IsG5UMfEVXbfz/dZtXoPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642337705, "uuid": "8d5d42ae-f22b-4aa2-8d4b-a96550ce4bc7", "value": 3596288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642337705, "uuid": "5480101b-97ed-4185-8861-7e35616370d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337705, "uuid": "c6401ca3-96da-419a-9055-e123c458579c", "value": "8f40f0e81402121487db4458a81615c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dad1aa1-7709-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642364211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364211, "uuid": "b8cfe1ff-aacd-4b28-8573-c67a8537fbf9", "comment": "Malware payload (RedLineStealer)", "value": "73e7943e97231bbb549900975e08cbeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364211, "uuid": "6b4f8185-4576-4b3d-9144-d3a44ee19280", "comment": "Malware payload (RedLineStealer)", "value": "64879d2db0657354b4f23eb0a5c694876bd53ab174e79fc906f89fd5c523bc17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364211, "uuid": "a2abf4dd-789b-440b-a49b-c28b8e719662", "comment": "Malware payload (RedLineStealer)", "value": "67c4d21fc3b616fb3a640246c302fa4d0885226a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364211, "uuid": "4f2f1790-1755-4752-a6b0-85e70ce352fa", "comment": "Malware payload (RedLineStealer)", "value": "87ec9af6d1fa874b36d2c9d2ee3c60a5715f046ab993d0280a6d986e8b9c97a81dc017b4d4b9016d34910b0a5fd181e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364211, "uuid": "95b43c2e-1a30-485a-b429-f6da8e723c3d", "value": "T13E549E10BBA0D035E1B752F8497A93ACB52E7AB15B3590CF52D51AEE17396E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364211, "uuid": "d79727a2-eb18-4486-90f1-1f90d07d6772", "value": "80720d283b0420bbcbb388cde3e0df65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364211, "uuid": "6134465c-bcb9-4330-b787-cf92db6e0f77", "value": "6144:Y1Nn0vgYaHU/C/Vd2RIxahWhtQLdtKUvi:Yn6gYD69d2RIxxhtkvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642364211, "uuid": "17679367-44a1-4f4d-9601-a932641d325c", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642364211, "uuid": "05220295-9fe9-4544-9b46-ed74a07fa0ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364211, "uuid": "78dbdd51-bbeb-4360-b538-b329e936e218", "value": "73e7943e97231bbb549900975e08cbeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d928c2-76fa-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642357752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642357752, "uuid": "1e81ffe8-8f52-448e-90f0-49ab70fdbc48", "comment": "Malware payload (AgentTesla)", "value": "bf3e45974bbd68419a4c00c89836ea02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642357752, "uuid": "36380cf0-5859-4907-ae73-3e12e8b768fe", "comment": "Malware payload (AgentTesla)", "value": "66a186719c8111d97f5f9f44399f45e5ea2a13c6c1f9429a6e6cd2dc149d01c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642357752, "uuid": "01bd4579-6b85-4540-8700-6fa5c423c2b6", "comment": "Malware payload (AgentTesla)", "value": "22d49f687eeacfb651e85f4db3ae73e86186c87f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642357752, "uuid": "2896ce1e-3b73-4a3b-b41d-ca39d0f697cc", "comment": "Malware payload (AgentTesla)", "value": "490237e8a47b5db60f86e92924170661f09ceedde4f8947de25c65d171aa1597dda0e1968225bc7f0eb2e9df48b25f5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642357752, "uuid": "73c73e03-7784-4b47-8cd0-92e8ecf47b5d", "value": "T1852570B839243F9EC81FC17D8BD41CEAAA50E4F69E0ADD16D01F9DD9990CB47DA140E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642357752, "uuid": "cb6f5ddc-e984-475d-8734-3fc24c4a4308", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642357752, "uuid": "531b96fe-a059-42c6-81b1-470de48bf03c", "value": "24576:eeFN6+XuaZwy1URYcYrpfgQ3s09yXUNcfr3ibmQjA:eeFN6RaZwzbIZg89IzfmbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642357752, "uuid": "a01063bb-a9a0-4ad5-b59c-873aff7e6893", "value": 1051136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642357752, "uuid": "bb1f5ee9-db8f-40c2-9f0f-9b5cec9c680f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642357752, "uuid": "bb89202c-fac9-4112-9229-8f68bbcad01f", "value": "Enquiry2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b21b744-76a4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642320935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320935, "uuid": "7480a0bf-0dbf-4b37-b0f2-7757ba08a4e0", "comment": "Malware payload (AgentTesla)", "value": "05208b92dd93ee5e22e31b93b5e6c1ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320935, "uuid": "f72d3e64-588b-4912-91e1-e8d179ec10cc", "comment": "Malware payload (AgentTesla)", "value": "66b16b2cfdef659398e185597d3046b07af50dce8dc2286f044a1be164516e75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320935, "uuid": "2f818627-c4f8-4222-87ca-8c26d33808da", "comment": "Malware payload (AgentTesla)", "value": "5fe23c834a7f4cdc71b96bd4678de685b040dcde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320935, "uuid": "233dc880-3c13-4007-945a-2b753cfca3b3", "comment": "Malware payload (AgentTesla)", "value": "19cc09d9098fedeb0a827584858c2dced5b476806bf8a08114e6fb40cc0a546a1a0f8f982ef319c768dc2a2ac77d6a34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320935, "uuid": "e8e7cdd1-28f8-4b72-ac91-6affc40a32da", "value": "T1E8D433AC581A11A5ADF147FE24D59E83888BDF5EC2E42CB9E0200FD8CA1FD48D537667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320935, "uuid": "4c0a2712-e750-44d6-a0c8-c95861f7b510", "value": "12288:u8VrUTVIZvSvgOiIgFrKaNhJiBfkTnibYsDGrn16Q/pl:u8VAa4vplg4fkDKYsKrn13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642320935, "uuid": "25efad91-69b8-4377-8580-3d30a270b430", "value": 614907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642320935, "uuid": "538f54f0-653c-4634-a89d-29dcfca83490", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320935, "uuid": "759dbc0e-503a-40d0-b4fe-1ed504d65400", "value": "PO#7A68D20.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474ea690-7716-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642369811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369811, "uuid": "94a8f57f-ef7d-48b0-9cb0-ca64a9de80aa", "comment": "Malware payload (Mirai)", "value": "5d47bfef14d7cbcca4183ee4166a317e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369811, "uuid": "817ffde8-12f5-4fe8-b70b-79e6a1f3ccbb", "comment": "Malware payload (Mirai)", "value": "66e1290d0d3ce4c334984578dfccfbf8875bd01a49e3153295ddf41bcabdc99e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369811, "uuid": "26dc5e26-c5cb-43e4-b51c-46623b5c12db", "comment": "Malware payload (Mirai)", "value": "46ade06da3a2e33a223a4b25db5dd87eb09bd5c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369811, "uuid": "85d71d7c-87ee-4306-a70b-037c94ba9d78", "comment": "Malware payload (Mirai)", "value": "c204c42f759ee313a1cd13e1ee5e503c03079aa2e9e1e1b19b7d94e351b020e7c89426fbb97fe9be904f1088bcf122c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369811, "uuid": "b429d8c2-bb52-48e0-94f4-3cdd7bd65f0b", "value": "T17F23021320A7EE03D420547BD8259CA979044AF9B8ED7B772D4116A4CC20E62FEF16BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369811, "uuid": "93874475-6564-4a73-ae9d-36530bea7159", "value": "768:SK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFMzsm9q3UELv1Q06pMBwAA3i5+:M12O1LCNguovDPH7TcriILLtQ/pSAy5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642369811, "uuid": "3cf6b690-dfc5-482c-857a-9977fe90d713", "value": 48716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642369811, "uuid": "6c8dc5c2-8586-4598-8121-d6923cb70f47", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369811, "uuid": "3d069d67-8d70-4f3d-a614-edc6d745a0cb", "value": "phantom.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c584a530-76fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642358855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358855, "uuid": "5ffdb964-7afa-4e8a-a802-365665ed7d3b", "comment": "Malware payload (Smoke Loader)", "value": "4684d813593296b4422ebe6a012a4c62", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358855, "uuid": "c85f732d-78a3-47bc-abce-2f9eeba913d1", "comment": "Malware payload (Smoke Loader)", "value": "676675d128267eb409a15bf589b27e042db20bf60aa15c5b4d8af75c0e4bf534", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358855, "uuid": "9fc81b9c-df36-41c7-a4a3-1b3df03c3b68", "comment": "Malware payload (Smoke Loader)", "value": "3640d7f9f081f53807bab86b1540b4447bfe8576", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358855, "uuid": "e3b36714-51b9-418b-ae29-346cfee9e7e4", "comment": "Malware payload (Smoke Loader)", "value": "f2096391de20d9d6e089e0c5a5b690be4f4ef77fabdede69fe5aebe48b79f32f228b91e6be85ed0407618c6b480c41e5", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358855, "uuid": "12121ad2-6a6c-48f9-81e9-709e17f93c59", "value": "T16864AF10BB60C035F5B312F85AB6936DB63E3EA2572490CF52D52AEE56386E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358855, "uuid": "dc8c6ab8-de02-4a71-a90a-8d734a41aaad", "value": "ffc4c043a9327244f6e4bdf570a06899", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358855, "uuid": "ac79a6e0-082f-40b4-afea-c9bec8d0eb11", "value": "6144:76Y/x2IZhb8rYgYs3vaBuzUq9T6w4QI2S+NFHlgqwvDh:eY52W2cYvu8d56zQI2SSHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642358855, "uuid": "456229ea-b9e8-407f-b73d-feadc4d60d3d", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642358855, "uuid": "c517df4a-b47e-4140-bb1a-421344663f18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358855, "uuid": "b5d4248f-b8d6-4aef-97ae-306aaa03770b", "value": "4684d813593296b4422ebe6a012a4c62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253185bc-76e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642346990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346990, "uuid": "6966311e-6798-43bb-b219-443fb09e7790", "comment": "Malware payload (Mirai)", "value": "171ca0765a728fc51d7203e1c6cb2ca2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346990, "uuid": "6088bf3b-e137-4069-8093-94490fa0c624", "comment": "Malware payload (Mirai)", "value": "682a79e4c685c0fa789c36b55c190a9cadc6d59cabd992ca0a14b65016a67c56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346990, "uuid": "08942ce1-227b-484f-935e-a96acb0a0ae5", "comment": "Malware payload (Mirai)", "value": "c344a8f9dc8eab42a9565d1d6fd9d786ce0f8153", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346990, "uuid": "2d5fbba3-5aaf-4bf1-9079-226c35df3fd7", "comment": "Malware payload (Mirai)", "value": "4d66aafa016f66202b9542f64f0f355c7f6c09419ed31611078eba63dbce28ef77e77a4fe7d0593378b6631b67a146e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346990, "uuid": "58bc9949-6402-4155-8c69-c0407243a472", "value": "T136634AD3F809DFB6F809D73B449305067230A3A54A825A77B353306BDD761A92973F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346990, "uuid": "3a975a8f-63b5-44c2-97a3-6a5dda4a1d89", "value": "1536:m7pDCdtR2nOXopu158ywBXpZXX6ymwHSwIryNGmcosyFebZw:mMdtRX4pu1EBXjXT7l4mcosyFe9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642346990, "uuid": "354a7cb1-d2fe-46e0-9443-dcb99eb4705a", "value": 72568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642346990, "uuid": "1e6de1fd-c12f-46bd-a5c8-3b81a611e9c8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346990, "uuid": "e530a9fb-d245-4708-b4af-4ddf701487dd", "value": "171ca0765a728fc51d7203e1c6cb2ca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4084ea53-7709-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1642364216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364216, "uuid": "3d422934-872b-475e-8706-8cf315497236", "comment": "Malware payload (CoinMiner)", "value": "04f975654df7372935033196b70d3370", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364216, "uuid": "72512418-49de-4d51-83c6-b8e96a98cca8", "comment": "Malware payload (CoinMiner)", "value": "6bc3e296ba789615e98474078764a314a04416d898a52673df4221ca896ff780", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364216, "uuid": "60e7a479-c956-40f5-a6ad-dd1295ea1f41", "comment": "Malware payload (CoinMiner)", "value": "822736ded7c767e695e4d4d532dbac87318a7d87", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364216, "uuid": "b9f8bbe1-ad12-4ba9-9527-e3cf1e9de5c3", "comment": "Malware payload (CoinMiner)", "value": "1e7787e831821dc373a10a1c879b2b5327bd8971f90db7cadd90ef7a9330dad43eaae995b965b9593b0f684f687a87a7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364216, "uuid": "ce03cda2-39fb-4ec4-9409-b8eda9229b8e", "value": "T1CD549E10BBB0D035F5B712F8497A976CB92E3AB15B3490DB22D526DE16386E0EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364216, "uuid": "21346725-a80b-4244-9d94-564bd82defa2", "value": "80720d283b0420bbcbb388cde3e0df65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364216, "uuid": "12d815fb-f740-4877-b4d2-9b31c0ce0d96", "value": "6144:u9hiOA02aMWRJR4aycf1YSK3Gf6nuE9z9IfkHqqkBBRu:uLW02kPGaycf1Yb3LnuTkHqqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642364216, "uuid": "34151c0e-7c65-4bc7-bd58-4cb6cb0d3165", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642364216, "uuid": "5bc15ee0-10e5-4f0b-a26d-7837738ab12c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364216, "uuid": "aea4abc1-17f9-49e2-8852-6533a37cf0fe", "value": "04f975654df7372935033196b70d3370.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8e0205-76a5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642321263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321263, "uuid": "34353b71-a328-4e49-9512-074a617f1ffd", "comment": "Malware payload (Loki)", "value": "054d7f52f9da458f293f5f8d725a4185", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321263, "uuid": "ff5dbd58-6db5-4066-935e-4d3eef16a979", "comment": "Malware payload (Loki)", "value": "71d5de837cf34fa1286b712464dd1a5fd1ba591f74114a378f96b01461c9858a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321263, "uuid": "c9dbf8ad-7d25-4ee8-af52-e0138e13de50", "comment": "Malware payload (Loki)", "value": "05fe1f3f29484f4fde9b2b04a1dc0070329950c8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321263, "uuid": "0e7f1740-aefa-4b21-b83c-e7c17ad6bd28", "comment": "Malware payload (Loki)", "value": "a294eed6af211b27b0fd704f41a3ad8ff63fda5ad1985275253793611a48a9923e27fe365d59db0ca7f995dfd239ebe9", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321263, "uuid": "084693d0-ebc6-4fce-bb98-bfab6a5c685a", "value": "T1D97423B1321F90DDBCA64DA42E4FD630F39C9C193E18E4833DB485835D8A9F7AA59C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321263, "uuid": "fb59111b-fb01-4ef4-afe2-a72d25e511ac", "value": "6144:yqEvZ/0uxcU5FyrMXR09O+fMK52OSx1LOKZQ/+SxSEkoIP/mUcwX:yqEvVZxcUFXRYOI52O61vZBkS8IPuPwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642321263, "uuid": "a19ab057-4e5a-4112-b863-f34ca7243dc6", "value": 354882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642321263, "uuid": "cfdcf38c-9f3b-487f-8ccc-46d4c6aadc85", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321263, "uuid": "d6b7cf62-f6b0-46a3-bc8b-70936cf8d6ed", "value": "New purchase order. pdf...................gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9253ec87-76cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1642337724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337724, "uuid": "07357324-08bb-495e-9878-4808ac87315a", "comment": "Malware payload (Socelars)", "value": "057cf86d28cde2f0e68db088e84fb704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337724, "uuid": "5c3e80c9-04dc-4f4e-b1ca-eda98c697aa2", "comment": "Malware payload (Socelars)", "value": "73d5be92f8042cabac6eea8b8d5454d94c7d8c99676bf9af62a4a56ac12d2455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337724, "uuid": "da5780ef-dbf9-4da3-b6a2-0b0cb8ca5dc9", "comment": "Malware payload (Socelars)", "value": "034cad89012647be2f2a56af21b8cbd91d60c845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337724, "uuid": "95aa8c17-0fd5-48f7-ac4b-4e5c2f0d3e96", "comment": "Malware payload (Socelars)", "value": "b6d34ae8a64ee8fb3556b6424823bc559b05e70ac15cd26db931735e2f0be4b848325cd9f68c315c8907376d7e85dcda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337724, "uuid": "bf8ffcb3-6360-4521-b7b2-008339ad086e", "value": "T1DE659E11F6426136ECE310B382FF5AFE8D28A621030894D7E3C45D695E619F37A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337724, "uuid": "489c5002-8288-45c7-8481-8acae7a1f403", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337724, "uuid": "02096054-4f32-48c8-9d11-0372ab7bdc46", "value": "24576:M4UpDMuCSO5T9iKvkK1dA97hfNpZZ06nlvmp78nLBrzPWfLzb7:AplyTv1gpJk98nLBrzOfb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642337724, "uuid": "03ef3758-0297-4d92-9071-015a54911f80", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642337724, "uuid": "982d076e-861b-4fff-8ad8-e167cab6511d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337724, "uuid": "6cd3fd26-4705-4caa-8d57-d161bdb345f7", "value": "057cf86d28cde2f0e68db088e84fb704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada698a0-769a-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1642316725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642316725, "uuid": "860413c2-8627-48b0-838b-1a5820652aef", "comment": "Malware payload (DCRat)", "value": "ac879bd2456edee323db71360ebe7e20", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642316725, "uuid": "cbfc3abe-237a-43c2-aa36-b20943db162e", "comment": "Malware payload (DCRat)", "value": "74f58040325d551f7b63a669eb3ac1c8e6c5dd1f420a6d8c6d9a103b40211ddf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642316725, "uuid": "a66647e5-240f-4479-b9a1-1033498895ec", "comment": "Malware payload (DCRat)", "value": "bb565a40a4d19107c2d17a2ec038e42da2c19e5d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642316725, "uuid": "0e3fcf17-daa0-4974-a546-92f926c97718", "comment": "Malware payload (DCRat)", "value": "3a0427b83be0a321711f257dc1a6914e6d3ede521171374017fb40e26beb3cf9b40add6df74112185b118cdd47aae942", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642316725, "uuid": "c336b1fe-c400-43d2-a844-96b5072e3eda", "value": "T1273539027A08DA01E02A5637C9EF811447ACEF427A63DB1A7E9F336D6551BE71C0E5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642316725, "uuid": "9d7c19da-3367-4f79-929e-84df7d0e811b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642316725, "uuid": "ae2d3df2-1c21-4cc6-aaa5-5c776a9c18c4", "value": "12288:2+jFrEyWxu/4+opO18qzx9MSXAwDQFFZDkGDvwN/XzjUEsBslDIO5a2H4ml5OpvV:2sFrkOLGnEsofXYg5Ox8jvqOE3R+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642316725, "uuid": "4eae59d2-aa32-48a6-ada6-8b6b16ee8236", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642316725, "uuid": "5d9fc651-51e1-4697-90fa-998f6cd9181a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642316725, "uuid": "e869df78-40f4-4cb1-a088-a5bb3c0cb0df", "value": "ac879bd2456edee323db71360ebe7e20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f128609-7709-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1642364160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364160, "uuid": "e62e8377-3db4-483b-abf8-193f90ddd47a", "comment": "Malware payload (CoinMiner.XMRig)", "value": "d6c26d1a060bc7ce2b72d14e857bc612", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364160, "uuid": "ae765bc1-7540-40f5-8afc-3194264742ec", "comment": "Malware payload (CoinMiner.XMRig)", "value": "770e78f5262b1ad1d0d56e616b7ce40ed4fe8d8d890ddd2654af7236b96f758c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364160, "uuid": "24d862bf-471a-489f-9123-b5411f0cbff3", "comment": "Malware payload (CoinMiner.XMRig)", "value": "9e83843753836ef554304d2344ba5bfdd2cfe4ad", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364160, "uuid": "a7d992af-4f6b-46a7-877e-c5bb99af56e4", "comment": "Malware payload (CoinMiner.XMRig)", "value": "b90918d711121692e6912dbd6338471623697441fd9aaa9514a777778c0474614214817cef0c9809874deb3a79aa8598", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364160, "uuid": "ceabc79c-27f5-4d41-b248-6728c4369dcb", "value": "T12154AE10BBA0D035F1B712F84A7A976C752E7A715B3491CF62D12AEE26396E0DC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364160, "uuid": "f55d552b-ec23-4127-9ef1-a53d49804a24", "value": "80720d283b0420bbcbb388cde3e0df65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364160, "uuid": "a077d4c5-8d50-4da1-8c59-5e53c1269c2d", "value": "6144:S9AhujH1aIwRJR4aynfyEVfJn9aV3tjQH3CoWlVeH4opvRu:SCCH1qPGaynfyEjn9iVQkE4Sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642364160, "uuid": "f44e556b-41e3-4ad5-81a1-8d9a54f6d543", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642364160, "uuid": "ddb47aec-075c-45e8-b8ec-5550ea0bca33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364160, "uuid": "79300d16-40ae-4c38-b3a8-a24c3427b885", "value": "d6c26d1a060bc7ce2b72d14e857bc612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bf2ce7-76f2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642354564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354564, "uuid": "cb65b4c0-d278-44f4-a1d4-f1a7aa851ca9", "comment": "Malware payload (RedLineStealer)", "value": "f2a217f6b08b045ca263f1970f06d0b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354564, "uuid": "fbe6a598-ea9d-4fc4-914f-a442d3f293d8", "comment": "Malware payload (RedLineStealer)", "value": "7ae73e912165d0689d85ebe5db26d44f2e4301bd89d3ae60f5dacb0f38bd2be8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354564, "uuid": "68d53f84-a2d7-4a12-a79b-765f4bbc8cd1", "comment": "Malware payload (RedLineStealer)", "value": "3138ce15450f80288f7441124b4f149a1d2b9d15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354564, "uuid": "75aa42b1-f4c2-458d-8367-3584eee26eaf", "comment": "Malware payload (RedLineStealer)", "value": "fa235a8ada07f7a2899bf8ec1b797602eed197216aa78395ddc963767db17f390801d82746d1870c9a920965a793b2ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354564, "uuid": "1d7d48e5-148a-4bdf-93a6-2d5fd0fc4745", "value": "T194649F10AB90C035F5B712F84ABA976CB52E3AA1573491CF52D52AEE4734AE1FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354564, "uuid": "60a942fa-1f95-4b4b-b1ca-ef115dc55855", "value": "ece6f983f2f5d858525c32a5672c95ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354564, "uuid": "54ee2fda-dedc-425e-a173-22cbe287a4aa", "value": "6144:sfBwCPMvSaJdLQ5qyaPoBKl0DG3eNTEMihIDSgceHf7jeBg23s:sfHEvSoOZaiKkGOY87HCXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642354564, "uuid": "616a3169-0835-4cc8-8bff-0758411abb4f", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642354564, "uuid": "a0f456f8-a708-4abe-abf6-9ad6b0bd02a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354564, "uuid": "cae684d2-c592-4e6a-b0c3-f3dcdb4108b3", "value": "f2a217f6b08b045ca263f1970f06d0b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c4c028-76cb-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642337535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337535, "uuid": "4ea2b0b1-2d0d-41f7-bbb7-46c164a02d7d", "comment": "Malware payload (SnakeKeylogger)", "value": "b5ae5030e89fee46f8b9e749993b6eeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337535, "uuid": "fa9b09be-e318-4929-abdc-e7ddc39addbb", "comment": "Malware payload (SnakeKeylogger)", "value": "7d61ba069bc031d92854aef1d3b310d8b527ba3adee67d8416a1eae4abc7045d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337535, "uuid": "2c4eed03-88d8-445d-acb0-bade2b34bf47", "comment": "Malware payload (SnakeKeylogger)", "value": "95befffcb97043e7054bba6a351dadbe32854c22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337535, "uuid": "39363b76-4bef-49f7-ad32-fc92e4f58029", "comment": "Malware payload (SnakeKeylogger)", "value": "c612086447a4944be0fe8cd7ad3749d200b83948f526ce5944affcc80d91116af936270a6c8d1e9afe8d21a258059d61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337535, "uuid": "fc924fba-b228-4a2c-bb69-bf4532253199", "value": "T12754239838D9A8FFC04711322ABF6772C27B62447592090B37946FEE1D501C3E2276BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337535, "uuid": "7f018abc-f930-42ec-8054-22b51d8f40de", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337535, "uuid": "51a13e88-658d-4bb9-8865-5e8726c1a197", "value": "6144:Sw/X+m9WlFdz83YBQqge8TGRAwomgKZHCMYo226GQ:B+m9Wl/ojqge8TAFomJZiMz36GQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642337535, "uuid": "01f30558-5b33-4712-a008-3594b778d9f3", "value": 290479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642337535, "uuid": "9ef5ff2e-c3a9-4d64-9a3c-2bae99cd2be6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337535, "uuid": "ec0140d0-a3d5-44ac-9a72-b35343d8f7c9", "value": "Payment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be32a86-76cb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642337687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337687, "uuid": "d4de0dfc-a736-4da9-80a4-cc18b61ec3d3", "comment": "Malware payload (RedLineStealer)", "value": "bf4f1d9a6e6a428ac2d2ab1060dbfc48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337687, "uuid": "fda9ea50-ce58-44bb-8a72-fa01eecde693", "comment": "Malware payload (RedLineStealer)", "value": "81c6154e0a1af78c7eb126595898cb5fc0813aabdf5c90e275edd94970f664c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337687, "uuid": "05068ab8-bd97-48c1-ba97-8d9d7e2b7f83", "comment": "Malware payload (RedLineStealer)", "value": "dbf04522a51b9e7176b7a32ad54a1141ebdf2881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337687, "uuid": "720bd64b-c83b-4bf5-978b-e733d1f30bee", "comment": "Malware payload (RedLineStealer)", "value": "8c6afe8fe06e392d69c795630587103a81dc3a91331352198ddb2a85d9c3218bf67ee77ca3caee949367be1a04f676c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337687, "uuid": "3fa70249-8a54-47fe-8464-cb5d3b99e83e", "value": "T162F5333C2F182E7EEEB918F0774AF6C1D708ACD719A351A3512E250F14193AA70A5FD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337687, "uuid": "16527cef-d688-4b57-aa5a-38add14c4249", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337687, "uuid": "1fb48f3c-6e2c-4c6e-9677-32c33be2ab76", "value": "98304:G9PgZ+D25cuLwycOg1jVHBpiP7oNwm2sNq29:oPZMcuL5cVj4D4wvsNqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642337687, "uuid": "67781c82-57dc-4a18-9105-d523f0c30eaa", "value": 3591680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642337687, "uuid": "b6b79211-1de8-4200-bbb2-7c6ba80076b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337687, "uuid": "182fe8a1-c17d-45f7-8597-0d99d6973540", "value": "bf4f1d9a6e6a428ac2d2ab1060dbfc48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736f95cd-76cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1642337672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337672, "uuid": "396f1c5f-4292-4a4b-9881-3e8875027299", "comment": "Malware payload (Socelars)", "value": "df6ced352568e804cec75c8b91048643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337672, "uuid": "d5da9bd0-6ed3-4f7b-90de-147145a09402", "comment": "Malware payload (Socelars)", "value": "8431cd8d9fd51dadd50a1063bc78d26f6e4913519d88b15157994f9ff1bad84c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337672, "uuid": "63e9145c-b3e0-4d21-930e-a22880d7a20c", "comment": "Malware payload (Socelars)", "value": "2475f2a3bbf5a6dcc26cccb2e3cc23e283eb560b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337672, "uuid": "47506dd4-0387-40d6-9a22-e2c61f7f1056", "comment": "Malware payload (Socelars)", "value": "85d087453ff50a56a823930dad967c7870f837ef9782e565157f2fc25e02fce6e9de385345442e61ea0500c3d6b28f90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337672, "uuid": "6c563eb2-d4b9-465d-a1c9-0ea51369c580", "value": "T1D0659E11E6426136ECE310B382FF5AFE8D28B621030894D7E3C45D695E619F37A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337672, "uuid": "43fc3685-d202-44fd-b072-af8c6cf4b27c", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337672, "uuid": "56c61cb5-b0f6-4e1e-a43a-d0c7ad07d3fb", "value": "24576:s4UpDMuCSO5T9iKvkK1dA97hfNpZZ06nlvmp78nLBwzPGfLzb7:gplyTv1gpJk98nLBwzefb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642337672, "uuid": "f51ff794-22ce-4a9e-ac52-213c3b7a16d1", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642337672, "uuid": "f78ea088-a260-4d9f-9f9a-949d68a5fe61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337672, "uuid": "fc8494f0-2f0a-454a-a829-f144a2c757f3", "value": "df6ced352568e804cec75c8b91048643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cacd1a8-76ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642330333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642330333, "uuid": "5e83847e-3047-4ef5-81a1-61c96fa381ab", "comment": "Malware payload", "value": "c95d714f4388b2ee17a594f6253b8d76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642330333, "uuid": "67425ac2-1a19-4bcd-a9c0-deaa986372ad", "comment": "Malware payload", "value": "88ae888d074cc35d8f8eff39771dfe1b6668003a68c27495e87b8d8559d87203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642330333, "uuid": "d0dbbb67-fde7-422b-8fa7-d212e98394c8", "comment": "Malware payload", "value": "4f008ca0c87f7a027ef3ff2336c0a277dd8032ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642330333, "uuid": "718b83a5-effb-4e03-8051-3dca34fce76f", "comment": "Malware payload", "value": "4c85c780f85dc93af8d03928cad8448b377473888e804a402a8885f4381e76fb8ca20d635f9e0978953e9427eecf3d1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642330333, "uuid": "1b055c25-c0b9-49e5-82f4-8d938a3ffcc2", "value": "T1B305C25F2F81C308F2A92DF6D5D5D8F2027F71DF5E28686691D8106CC6AA29CFA36350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642330333, "uuid": "eeca858a-48bb-4834-815a-b67ea19ad1ed", "value": "4de321e101993eb64afa7391ff67dfd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642330333, "uuid": "cf154fa2-d904-4838-96c6-7ccdd89a9701", "value": "6144:CJvWo7JhhqFTkptLgBX74A19+cMBmOjHEtDYWxcGrKOwLByOBveZ+gw/TpTQ03la:UNd4TOghZ9d0mTiWALJEZuhKt5cyNMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642330333, "uuid": "fe8e7754-44c1-460f-b9f1-868681d8437e", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642330333, "uuid": "be1daa89-3679-40a0-9872-b41fca4036eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642330333, "uuid": "946c2a24-2a55-415f-a397-00e07b77a0c5", "value": "sample.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f616d753-7724-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1642376117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642376117, "uuid": "68e8c828-1733-49df-ab26-08f9fe1e8c78", "comment": "Malware payload (DCRat)", "value": "bf31a276762d973840aa374f13c8aecc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642376117, "uuid": "18d082f5-37ca-4019-afe6-841156bd3b9e", "comment": "Malware payload (DCRat)", "value": "8b28463392c4a0f9af89630bd6e72c8839e0f1684e2c0e18f93202b0a79a0d49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642376117, "uuid": "d1823011-9234-4f91-a9ea-4ca5d2b0fcdf", "comment": "Malware payload (DCRat)", "value": "e4df105cb32e9e968da9fab98760b3eb6e483b83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642376117, "uuid": "aec0a59a-7c10-40a8-9ab6-5037861b97ec", "comment": "Malware payload (DCRat)", "value": "8779d2526a7242f6b465e12dcebefd48719eb19ea605c9362c8f91727108ac95f24f0d4dcc0b4c15d6a4f0a29a8c4b84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642376117, "uuid": "1b7658cc-ffbf-4e86-8e47-d23729521e85", "value": "T1805539027A48DD11D02A1A37C5EF892447ACBE413A23DB5E7E9E736D66523B31D0D2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642376117, "uuid": "671bf5b4-89e3-4c41-bea1-2daa25792ff0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642376117, "uuid": "9344a687-282c-4d9c-84ea-a5c0656bf258", "value": "24576:U2G/nvxW3Ww0t2AVrEY/jLQTmBMKYcWzF+4u:UbA302AVrFLqcNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642376117, "uuid": "61fd75fc-9f8b-4815-9dc7-35b24f86c33d", "value": 1289899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642376117, "uuid": "a978cb35-f55e-4855-94ae-fa0c6b900f5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642376117, "uuid": "6fa0ee4d-3a97-4886-a0e8-9b7f7623a591", "value": "bf31a276762d973840aa374f13c8aecc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc4699e-76fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642358973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358973, "uuid": "2b63adfe-279c-4c1c-aae4-003f69f2b621", "comment": "Malware payload", "value": "2db9ee63581f0297d8ca118850685602", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358973, "uuid": "c9040854-e0a2-410a-9dc0-ad9e4ac073bb", "comment": "Malware payload", "value": "8c6cf25734d89865f9aaa5dea926d6dcb66558ac0493248237c36474b1d3bd0e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358973, "uuid": "aa78d089-5c08-4f63-b84b-7dcc147bd854", "comment": "Malware payload", "value": "244c7008be6f767f0f31a341fe0e70fa2e9a5399", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358973, "uuid": "1feaf89f-e0d3-47db-908c-83f26a5c7dd0", "comment": "Malware payload", "value": "875db73a35731dd89ae13154d6d8f7c6f9a7a86e861c5f4f57bafeae05850b5bc21a434390ad1e35412ce7ed08dee233", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358973, "uuid": "a1d929b8-cfd8-4190-9aee-0c0b217c8b6b", "value": "T186A58C20F696C036D0BE41711E6DDB5F91397E720B7284EB77D82AAE09B29C11731F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358973, "uuid": "3ca7323d-bc0e-4049-8a54-e5410da98277", "value": "49152:1+J3ZO5YTq2TvT7qEV3VwIDDurDx2iFVNajAYYnkpxOhGkmVgU6oiL:YaY+2TvaEVW1xyAYYnkPOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642358973, "uuid": "c982efcb-45d0-4bc6-b431-1ca5fc955a80", "value": 2159104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642358973, "uuid": "9d0d2fc9-61fa-4b71-98a1-9eaf09f1c6e6", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358973, "uuid": "3e7b8cdf-7a32-4b96-a7de-603b33945d69", "value": "2db9ee63581f0297d8ca118850685602.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04a707f-76fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642358363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358363, "uuid": "96def256-45c0-4299-b890-73e1252baa24", "comment": "Malware payload (Mirai)", "value": "57320b74fb72ba7d84a2d29926d642b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358363, "uuid": "e793460c-7340-4ce5-92a6-0a91aab356a8", "comment": "Malware payload (Mirai)", "value": "8db937bd6a3a28e06970556d59415b33d83fe02de74fbf20ca4f802a2ca52bbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358363, "uuid": "88f0aef3-e178-4f8d-9101-3909e430996b", "comment": "Malware payload (Mirai)", "value": "a2633da7cfe0fe844ddee358731454d4fb862c94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358363, "uuid": "7e89f92d-6eaa-432c-abf1-35969f348172", "comment": "Malware payload (Mirai)", "value": "f11e24c3d38e5c918c6a687d144c5c229c079177aa005ef65772b519f900cdc83f20c492f9861b0f5b6e4052caa688f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358363, "uuid": "828695d5-b78a-4c01-b7ff-8e7428912b71", "value": "T15293800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358363, "uuid": "60f498db-814d-42a0-907e-a955952a0b37", "value": "1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZq/i:qCYxrKDy46NI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642358363, "uuid": "c1901f52-1b7b-4d48-b0e5-5a88dd621503", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642358363, "uuid": "6b46992a-4ae6-47d3-994e-9e139f1edae3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358363, "uuid": "dd2dd998-d4bc-48f1-b902-957d7b00f56e", "value": "57320b74fb72ba7d84a2d29926d642b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb98456-7707-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642363649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363649, "uuid": "09249bee-f453-4396-90b3-a6c052f5e84d", "comment": "Malware payload (Mirai)", "value": "e4cabe439215f37225981f5266596ac2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363649, "uuid": "73f0e997-6d9c-4bac-9b31-9fe3bb8c90fe", "comment": "Malware payload (Mirai)", "value": "8eefb7b244e6be55c4b557a79b5efde25fe702a0af9b395d4f0616691686b9d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363649, "uuid": "0bd9fe2d-f7ea-4d15-9561-92a538e5d263", "comment": "Malware payload (Mirai)", "value": "b8a414cf52a87a163920923882106c385489effe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363649, "uuid": "6116328f-b5f2-45c7-9d2c-8aed75889d6b", "comment": "Malware payload (Mirai)", "value": "f5dc2a44d7a43aca6555da62f87ed7e75b5121371e71aae9a6128c106a1aa0ac81100e729472db71a872faa574bfb1fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363649, "uuid": "c847e391-fc9d-4d3f-a944-0edfd562ce24", "value": "T165634A01775C4E43D5A61EF8393F17E593AEEE8021F4F5852A0FDA4A4232E33594AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363649, "uuid": "968415f2-696f-4fb0-a814-00e26c234082", "value": "1536:Cgl2wlB4kL3XDDerh8rnpVMhdSe1OjWSL8:3dzDereoSeMj78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642363649, "uuid": "47a598ad-00f1-4839-8987-4321e819043e", "value": 70888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642363649, "uuid": "40fb4a4f-77a1-4cff-8fd9-44952c13793e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363649, "uuid": "9f2cbabb-b78e-49f5-83a4-2aa0cc80d455", "value": "e4cabe439215f37225981f5266596ac2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b581dc-76a0-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1642319154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319154, "uuid": "205294ec-f7ac-42a2-a8ba-b6a6864f0743", "comment": "Malware payload (CoinMiner.XMRig)", "value": "ab54c7300e784173d43437efb30d05b1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319154, "uuid": "2c9e5be9-261a-4389-a512-a4d9da65d2d1", "comment": "Malware payload (CoinMiner.XMRig)", "value": "8fa2e2dc944134530288f4efd6b7b7288591993c08fd69dec0902b689435c028", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319154, "uuid": "f4354f70-84ad-4893-9f0c-fa2654fe7625", "comment": "Malware payload (CoinMiner.XMRig)", "value": "7d0fe7468bd2e572b720abed5468f33c809ab01c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319154, "uuid": "5ac08026-1347-4ba9-ad73-c53e259681da", "comment": "Malware payload (CoinMiner.XMRig)", "value": "62f78dc2e209e4436bc6b5c7c54f557323eb2cb1065fb71668c93b84b9677b5e30c66a2710f903f4cde8299f9823b6a6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319154, "uuid": "3abab53a-ce64-44b2-8b0f-7cfbfe5eee7a", "value": "T18D64BF10BB90D435F5F722F84A76936CB92E7AA1572490CF62D42AEE57346E1EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319154, "uuid": "70ed497e-d6d5-44fd-a572-e13f82d21b49", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319154, "uuid": "0e1fa2d2-f793-4bcc-a635-cbe3e3b105fd", "value": "6144:jK9UxmaDCNtQADQMfXD2SFneCgNMaVjGqyrhUKjnHxykt:+gmh71DQAXDXneCgNzViqyr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642319154, "uuid": "c2826578-ef91-4fc0-a09a-1d8f0fffbe46", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642319154, "uuid": "89c92d89-a22f-41bf-954a-70f3ab350d0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319154, "uuid": "3082a8d1-0f5e-4d84-a723-6aae00eaaaa2", "value": "ab54c7300e784173d43437efb30d05b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e00c658-76fb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642358225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358225, "uuid": "92e9b35b-aaa9-4a9c-8f07-698f3b90a6e0", "comment": "Malware payload", "value": "0c93bf2007aeb7077bb28b28d51309ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358225, "uuid": "699e8345-8ecf-494a-9dea-9ef8e647415c", "comment": "Malware payload", "value": "8fe2ada7119ce697fc34046eeb62cfef1c568f42760376226c4ab82fea01eb44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358225, "uuid": "5fca8048-373a-4f03-95f1-9ac04c36918d", "comment": "Malware payload", "value": "1e92fbd179a9a33394d04da073fc2af73bc29394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358225, "uuid": "05a4343b-0641-43e6-b183-ac602b465ec1", "comment": "Malware payload", "value": "edadc125ff9cac7dc832aa6a8c05227dfb7daa7be346d3f468aa25c0dbe48e1b1cbf7cd563f1ef8dcfe491566f21762f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358225, "uuid": "2f43543d-cae3-42f4-9016-8f7984081386", "value": "T107B523A6B37920F1F015E17A8CC15B1AF3F2F449872552DB536093A66E035E0F8BA3D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358225, "uuid": "bd6b1407-6d48-4ebf-84b7-74ada2cca808", "value": "ce92706925e359aa40f23197a9743843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358225, "uuid": "411f74fe-c249-4e86-b538-e55e398cb501", "value": "49152:nZb84h8ohujx7Tf4bN/OPHW6Fxiz8lVHTIioOFy:Zb8FF1f4bN/OPH5Fxiqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642358225, "uuid": "c6b2534d-92a2-4153-9268-f16f7f92ca09", "value": 2315359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642358225, "uuid": "d260d43b-8a9c-4bba-970e-d7882ecc8836", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358225, "uuid": "825f1e55-7cdd-4a35-b16d-40b39af27ec8", "value": "0c93bf2007aeb7077bb28b28d51309ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e5dae2-76fb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642358213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358213, "uuid": "079ec7ac-4141-4ece-8d2a-337ddda4679d", "comment": "Malware payload", "value": "d8bbd45a97d4c3102804fdbb0d3fd239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358213, "uuid": "85fdb144-5cae-4618-b68e-8873aacad9e6", "comment": "Malware payload", "value": "90f3f9ebe2249e9294a134b9bb4c59d380fc5ebbb73251437cc2146d2a646047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358213, "uuid": "77cdf978-cc2d-41db-9280-cb17c084c557", "comment": "Malware payload", "value": "7777d8dcb43cafbee1819bfeb02252dfb4425a0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358213, "uuid": "637ec8cb-add6-4821-8679-b81bf31bbad3", "comment": "Malware payload", "value": "1e1442a0545c1a0fb8d7a992ae255ae6fdc1b3e8967a78b4e746e35416e73d3199c828a8c6bdf41888a097538172d009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358213, "uuid": "83a537dd-20cd-4f71-95a6-718e70c6ed9e", "value": "T105D41210A3F04030F2F7A771AA756640AD3EBAA16F79C49F8719459E0A38EE8DC71717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358213, "uuid": "303f5926-c737-4384-bd46-ddea3cbc60af", "value": "12288:YzQtOoggWqSwUd+fh+Ncg5bamQN9cyOWbxpe/3azPtRra8:qQmgNZhigd9nLXe/3azFRr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642358213, "uuid": "f37d1281-26da-479c-91c2-f946b6f415b2", "value": 599781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642358213, "uuid": "bed5a3e8-ec1d-4066-9dea-0b62bf22a083", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358213, "uuid": "add9d379-193a-4861-b8bf-2e46eda1c88f", "value": "d8bbd45a97d4c3102804fdbb0d3fd239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d0e1c4-7716-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642369815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369815, "uuid": "821df5b3-9424-43e8-bb2c-e64ac6c7453c", "comment": "Malware payload", "value": "95e81e903258e9d45d5c8b3861ad7b0f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369815, "uuid": "d3f9b216-6a9e-4922-97da-deaa0c504fba", "comment": "Malware payload", "value": "93c28c0e82ab07a1aca73feaf960b594674db9be48b6805d946e3254c4ae1601", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369815, "uuid": "0d8dc6d5-d491-467f-90e9-7a7fb077cd87", "comment": "Malware payload", "value": "11bee7f89f35adcee995ad6ac6a7cc7cab90e3b0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369815, "uuid": "3637ad8b-7b37-4a94-be5c-dad4f0b80b28", "comment": "Malware payload", "value": "90ecb76438af7ce12c21f1edd48f06b355f9d68476656b22b9bfd2ac2e533e2462567ca7fedfdd0ec013c0ca0d9fa338", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369815, "uuid": "d87d2424-a9cf-46c0-a74e-f0a66a9e7ba9", "value": "T15CA2D00921CDEE72D170913AE13CC357AEDB83B666FE713E1E08079CA49091AD3B9945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369815, "uuid": "6621051f-94e3-4043-a489-c022f2262f5b", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbrJhymdGUop5hX1:Ypoh/DxCvhdR4IjWVFbShs3UozJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642369815, "uuid": "8eed1fad-2b4c-48ef-a916-9f61e84116d5", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642369815, "uuid": "b7ac2a31-5de7-4068-a0bb-a8b7cdca4eb8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369815, "uuid": "042653b8-b240-4c65-9c25-3d51eff71ec5", "value": "phantom.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5258229c-76a2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642320007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320007, "uuid": "499a1f4a-d0e3-495a-a226-81d5252e1898", "comment": "Malware payload", "value": "5de91512d8fb9665b8242e7bf51f6ea8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320007, "uuid": "bf36d9b5-1b10-4fe8-b742-2c46d7e95c10", "comment": "Malware payload", "value": "9561bae25fbeedbfefdc23493d7e373e784256ac7ee2c51f44485f89a589096b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320007, "uuid": "509fc330-f435-47da-bc62-0fd23d235e74", "comment": "Malware payload", "value": "2c10bc094f5ecf42201de0735ee6c23697ed168f", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320007, "uuid": "7f623720-0f1c-47eb-8ef5-a4d4d1eeba24", "comment": "Malware payload", "value": "574886dbe2abde5dd357431c8288c36b36935d14f31cc42766c8212171e8a4684661dac4d6aa7e5e838260a27d16be32", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320007, "uuid": "a11ffd25-321f-4c17-b76d-87006f29d4f1", "value": "T1C1F53366247D4DEC2DA672D33CD670CD76C81F6204F3C25A92B1CF4A197A13926BB2C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320007, "uuid": "62b43f42-2ea4-4b45-abff-b1c74b2690b8", "value": "98304:mmakkDotN06KTaHE2Z0qonh2vYZQqkV/9qIm6Lf:mgk0t2uEx2v+QqkVvmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642320007, "uuid": "a61ab09c-ae32-410a-8a9a-949c2517f18a", "value": 3391488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642320007, "uuid": "1b80fa12-4976-448b-a6f0-2d8ea7c0c3ee", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320007, "uuid": "ca0faab4-1157-46ac-acb0-478fb33ae428", "value": "9561bae25fbeedbfefdc23493d7e373e784256ac7ee2c51f44485f89a589096b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c5d280-769e-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1642318555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318555, "uuid": "fda1c04d-d4b4-4c8b-b132-6a2ef6fecc7d", "comment": "Malware payload (CoinMiner.XMRig)", "value": "3033f43d2b5bb29d1bcbc35cf2038d4f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318555, "uuid": "62dbe8ff-09a4-44f8-b742-79ebab91597b", "comment": "Malware payload (CoinMiner.XMRig)", "value": "9584a3d230cfc5d5fa3656849622cebcb251397b4ac08d251f98347c53aba263", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318555, "uuid": "e38d09da-10e1-402c-9bc8-77355ba284dc", "comment": "Malware payload (CoinMiner.XMRig)", "value": "3d053c898269472fd9a0625a409d5f2a4175f35a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318555, "uuid": "ce047b62-4c50-4a38-83f5-406fbccb5e2f", "comment": "Malware payload (CoinMiner.XMRig)", "value": "7d3784ad5c0f045d39ab219b3906dafff078a4d9ed3d496d6849f55bdf6e07182386cfc77a66553bdaef7ae8f47931f8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318555, "uuid": "da0cfbc9-535c-4967-b812-b156e21e7d80", "value": "T11B649E10BB50C039F5B712F84AB6977CB92D3AA1572490CF52D62AEE57386E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318555, "uuid": "9a52fdf4-1699-4c3b-af67-9ab19d29f75b", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318555, "uuid": "afaa3ef4-8f89-4c2a-911b-5b02db76b576", "value": "6144:1atUeYr9ScL4iOTAuMWsxANaegk9ULkjYbMFcOKdayy7Slc:QUtc2QlNwqikjYbMFc3ayZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642318555, "uuid": "62e89642-add9-44fc-9fa0-6b660e996d47", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642318555, "uuid": "85e15973-5ffa-4885-892d-973f72d3cb68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318555, "uuid": "9c438cbc-106e-4d9a-87b2-0fde05ae16cf", "value": "3033f43d2b5bb29d1bcbc35cf2038d4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f008525-76fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642359032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359032, "uuid": "213e31cb-63d5-4915-8d20-27de8e138147", "comment": "Malware payload", "value": "8ab96c4c790f9abe69ccec1021058588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359032, "uuid": "dadaeb8f-c587-4a50-8e0b-08d6c924e22d", "comment": "Malware payload", "value": "963386648f87316092494fb3af1cb46a6a3de2972b26e04dd14aafc4b9e34043", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359032, "uuid": "851c0090-eddc-4f91-a885-94393048f5a8", "comment": "Malware payload", "value": "d76aaba38614c4ac79e0878b6021472c03b78c6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359032, "uuid": "6ee44259-55b5-4f82-a6fb-87d240d57d10", "comment": "Malware payload", "value": "5ccb9bd3f66f46f399c9302c8a6a0e43ab0eb60ace7ec950f520be7b91a32d31ed2b43010bc8d943a56eb1aeac07cbdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359032, "uuid": "cf99b431-28b3-4015-b46a-c83371ba1236", "value": "T153845C1FA512CA05F65C9B70DA736F510BA6AB77C820D35BE39C67B8C42F3A9255C302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359032, "uuid": "f37c7464-227d-4be0-9c25-c038d7e36d4a", "value": "6144:tWjcoYksyUHSvOBuFmpow1y3hBRx/LRTR/DffNoQ8wzjYAmioNxTPt:tWzY/jOmI1TRTA0DEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642359032, "uuid": "5da15692-e8be-4688-b6bd-72c68892464e", "value": 382356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642359032, "uuid": "ad0609af-e510-47dc-87c3-3b6c65a8de7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359032, "uuid": "422041a0-87a6-4a06-a1b9-a6859051ca45", "value": "8ab96c4c790f9abe69ccec1021058588.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f05d34-76cb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642337621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337621, "uuid": "d4ea63c1-5fb3-47c3-b63b-4042d263253e", "comment": "Malware payload", "value": "6e7430832c1c24c2bf8be746f2fe583c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337621, "uuid": "e6177727-3b7c-41c2-b15c-61bbdb8e9fe1", "comment": "Malware payload", "value": "972d533e4df0786799c0e7c914aa6c04870753c10757c5d58cd874b92a7f4739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337621, "uuid": "e5f8cda1-4a46-44b6-9e03-6d52f0ffda29", "comment": "Malware payload", "value": "158936951114b6a76d665935ad34f6581556fcdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337621, "uuid": "9c0dfb2e-945f-4fd4-8917-f9fa4297246f", "comment": "Malware payload", "value": "e59510a6438b00b44068d452c2162808e196d4bbe41a530db7e50f99b6da36a4548917332c1258ca39210b2bdb316b78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337621, "uuid": "b8eea9ca-9942-492a-b809-3cddce20495f", "value": "T1F5740145B2D542F7E6F2053201E6B12EAB77A735872198EBC34C6D029503AD1AB3D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337621, "uuid": "ea83c61e-e844-48f8-bfeb-ce8a48f29d53", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337621, "uuid": "a6a20960-f32b-4076-ad35-248513b2a341", "value": "6144:v5aWbksiNTBiNg5/dEQECtD2YajndnU4aomwStqUJE0ra7yswH:v5atNTMNg5eQX2BdUcDStq+J4bwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642337621, "uuid": "c061124a-d8b0-4e82-a067-c25bc1dc677f", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642337621, "uuid": "c374a451-311d-4002-a554-3f4f7a9f8ee5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337621, "uuid": "14ef692d-7cd0-434c-b38e-60f6160e4c0a", "value": "6e7430832c1c24c2bf8be746f2fe583c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763a3739-76bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642330805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642330805, "uuid": "20949a36-b567-4d93-91f6-df67999fa2c1", "comment": "Malware payload", "value": "a6157ee0f5dc7179458af0b436d4e041", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642330805, "uuid": "9107cce9-ca36-4ca7-8997-e9235d2f9672", "comment": "Malware payload", "value": "9907feaf34068f7f35cda5b5615a93eef11d21bbc151ea8f93e984397738f454", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642330805, "uuid": "f813b9e6-5498-4a81-bb0b-a27350017211", "comment": "Malware payload", "value": "0aede15fb66e8ef4e2dd02e053600360327e00ba", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642330805, "uuid": "4d61e169-77bf-4068-915d-4ad7b29d58db", "comment": "Malware payload", "value": "201a5318e86fa00cc327e5b9eb0cdf32061441661b210f163ce6db2637d555bba4f4503e20dd78f2c6cd161e60b19bdb", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642330805, "uuid": "2ef1d323-613e-49a5-b65c-a30e65787d4e", "value": "T19CE5330C12FAB8FCF89D0529376389D0C6E452F1A98265F2D67C1998083F5BE1BDF961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642330805, "uuid": "66af4ca6-67d5-49b3-9fb9-17ae2bede45a", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4q:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642330805, "uuid": "2218f4e6-e697-42b3-b05d-a47cb6e26db6", "value": 3129344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642330805, "uuid": "9803b453-a4d9-4161-bcf7-b87567d8369a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642330805, "uuid": "7df359c2-d7ac-4029-b142-75d47b847271", "value": "9907feaf34068f7f35cda5b5615a93eef11d21bbc151ea8f93e984397738f454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46be9142-7716-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642369810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369810, "uuid": "d30588b9-af74-41b7-845d-3d25a4103db4", "comment": "Malware payload (Mirai)", "value": "9af009f316e7f46148da33f4220088cb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369810, "uuid": "edb2b674-ab6f-4abd-b197-abeade86c4b7", "comment": "Malware payload (Mirai)", "value": "9d9462567feb28e1552a5b522198df6434b9262e4c0c71d833efc3483327083b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369810, "uuid": "82781f5b-9389-49b1-87ef-44394c2f0319", "comment": "Malware payload (Mirai)", "value": "27386a43f898f56489b919000b65ba948521e118", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369810, "uuid": "6ece7644-dea6-4e63-b65a-c0eae4cb31d0", "comment": "Malware payload (Mirai)", "value": "26eea4c34b4bca3c614d42a7e36211a6acd716fb9aa612f29394dd8dede6ec7b977f8972013d4824544c8d7497b76009", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369810, "uuid": "1616b738-5efe-40c9-89f3-fe61fe4b88a7", "value": "T17FC2D1E8D94F85DAC09E74B0C3B817503FA84B265943EC9A1FDED686DC0A7E431836C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369810, "uuid": "2fb188b5-3189-4c4d-aa9e-9b90aa20d015", "value": "768:18kbmEOt3oOmSQxJUdvwte/up3JgGlzDpbuR1Js:ykbmEOt49SiCdoiuTVJuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642369810, "uuid": "097713ac-6fdf-4b43-90e5-2cedad6bb0b8", "value": 26176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642369810, "uuid": "4ac5c2f9-4676-4407-b131-7b28549a19e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369810, "uuid": "dcce5c09-b2e6-4fb7-b644-24757f84eb3e", "value": "phantom.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c45f3d8-7723-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642375429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642375429, "uuid": "739615e6-f3b4-4765-9c6b-9749aad0212a", "comment": "Malware payload", "value": "5d5c99a08a7d927346ca2dafa7973fc1", "object_relation": "md5", "Tag": [ { "name": "DEV-0586", "colour": "#A6BCF0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhisperGate", "colour": "#0BDFAE", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642375429, "uuid": "32ce9774-e6dc-48f6-aec4-d0175cad1baa", "comment": "Malware payload", "value": "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92", "object_relation": "sha256", "Tag": [ { "name": "DEV-0586", "colour": "#A6BCF0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhisperGate", "colour": "#0BDFAE", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642375429, "uuid": "fd4c7177-b65b-4127-a47d-525ed84fb8f8", "comment": "Malware payload", "value": "189166d382c73c242ba45889d57980548d4ba37e", "object_relation": "sha1", "Tag": [ { "name": "DEV-0586", "colour": "#A6BCF0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhisperGate", "colour": "#0BDFAE", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642375429, "uuid": "c42c4487-07af-43e4-b7fb-4f11228ceae6", "comment": "Malware payload", "value": "1cae12a5c55df0df5298d4f279904819c22069efce205bfed2caea5f509420982ca20c701616eb18ff3e509b72702179", "object_relation": "sha3-384", "Tag": [ { "name": "DEV-0586", "colour": "#A6BCF0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhisperGate", "colour": "#0BDFAE", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642375429, "uuid": "a7c8bfce-41f2-4b2b-8104-0d2653d60119", "value": "T192C22A89F2494DE9F062C7B514DB9FB2EE62992244116BA3CB2DE3BCCE3B3415D13521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642375429, "uuid": "b563c985-174f-49df-8cb5-e58c2540c694", "value": "3a2a2de20daa74d8f6921230416ed4e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642375429, "uuid": "18f789c1-37fe-4a66-bb05-817730227d9f", "value": "384:hgvApUHEZKu08YtQI4GS1dxRBUHCHCHCHCHCHCHCHCHCHCHCHCHCHCHCHfskp2BD:ivmUHEZ4yVUiiiiiiiiiiiiiii9pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642375429, "uuid": "f36e5159-3195-4d3d-92fb-f0e5fd4e00f3", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642375429, "uuid": "94c1a20e-60bc-4fb9-9500-647dd1bf811f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642375429, "uuid": "96e6971d-f23a-4af5-81b4-baad77e14c9f", "value": "stage1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500ce7b8-771f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642373691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642373691, "uuid": "3f1f5a84-8273-41d8-a1ab-0d8b68265025", "comment": "Malware payload (Mirai)", "value": "79c9e1a7f88959c477efc020f1264417", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642373691, "uuid": "b20e6a9b-224c-42c2-9b2b-0c524544a2d4", "comment": "Malware payload (Mirai)", "value": "a1da123fdf61a9d8d28c29354f86734366acd4ee748fc5237408366bf9f3611c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642373691, "uuid": "249e1eae-8127-4ac7-a9e0-f920e50564a2", "comment": "Malware payload (Mirai)", "value": "50387140e3755c7b94c760b96e67e6299aa4793e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642373691, "uuid": "41225cda-0bef-451b-acd4-be2c9b0f753c", "comment": "Malware payload (Mirai)", "value": "e6213d085731c7dc565b6a504a75a520086d92e28ebe63a6256593e18b25601dbf4e7b75ab529c90bb4903885503e565", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642373691, "uuid": "f93f58d1-4739-4366-bdb4-e3f769d1b3ab", "value": "T141432925AD792E26C0D8B57E11F7C724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642373691, "uuid": "29db9303-92a0-4365-b976-52a233803f9d", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDk:eL0AxvSHfymp0xgunvCkV6vTMDauv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642373691, "uuid": "078ee8df-aad0-4d06-b420-ef8cad7a58b9", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642373691, "uuid": "a9d8c293-491b-4ce9-bcb0-f84f31cd2237", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642373691, "uuid": "d54092a1-56c8-406d-a421-ef71c7db9b4b", "value": "79c9e1a7f88959c477efc020f1264417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b01d60-770e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642366312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642366312, "uuid": "1c7ee27c-49dc-47ca-9469-448b42f48501", "comment": "Malware payload (AgentTesla)", "value": "497555e84de2b4e6f9d43e92873dc719", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642366312, "uuid": "9604c20e-1ec7-4ad4-9b9b-b53ac0ce9217", "comment": "Malware payload (AgentTesla)", "value": "a2655dc19c1fbba64ea94b3de86d8cbe1ad1e8bdf0ef1234fd5717f6feae61f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642366312, "uuid": "f1512051-cc44-4b34-84bd-bce0a2023e83", "comment": "Malware payload (AgentTesla)", "value": "92ebdc371b50cd5bb80e765784e66c42e0762612", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642366312, "uuid": "fd1ae0e2-d60b-4c0c-ba9f-71005edc30d2", "comment": "Malware payload (AgentTesla)", "value": "1f42ca4ba9e7c7d03da25c0213240e52c9019947ae4b3921e8379460a5a0126a978101c86367466e60c616ef55cb385f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642366312, "uuid": "498aa786-d0e4-4469-9d95-7e48c6ad142a", "value": "T1D9F48D3122A45E59F4BF9739177454488FF9B512E337EB5EAC8500BE0C21FA2C66A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642366312, "uuid": "64c2b244-0443-4126-be06-b1dc8fc67d12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642366312, "uuid": "8ef70dd6-53aa-4e70-a1f3-fe6647cc67db", "value": "12288:13EHlMEA4MRKpInUxDjApc6lDDk9plyw6quVgujnA0J0Dk3AMCFUdDVF2VTCh:tKnDjAhlDDqpl1NuDAwuk3AMCFUdRmCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642366312, "uuid": "847d6e13-06f5-4fe8-b23d-de20bdd854ec", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642366312, "uuid": "47db2dea-bf72-4357-bdfe-4d47d708ab18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642366312, "uuid": "e5577df4-67d8-414a-8fcf-a5a28f9304a0", "value": "UPDATED SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0cacd0-76a4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642321150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321150, "uuid": "e40f60f7-1f4a-4a0f-9e78-58f389d5302e", "comment": "Malware payload", "value": "7741e450704a40151e12958828c09d99", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321150, "uuid": "818aa3b1-72a7-46a8-91aa-a0138b48d05b", "comment": "Malware payload", "value": "a27697f5b1ed6b0049ef6100a185af0d7e9a2ab43185ca19a024f2749ed15d5e", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321150, "uuid": "9102dcff-2066-45ac-bc43-9d98b348fa5a", "comment": "Malware payload", "value": "4a41d1955d2fab39a93b4841888cfb8e9a3bbace", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321150, "uuid": "0ad812ba-88c1-4f31-9280-3a6b20e385f5", "comment": "Malware payload", "value": "be52e1b611a732ba5e3783d3ccf9211adb20295fa142f987f1379cbba106a95b07f5b7598b556424da50da47ed79982c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321150, "uuid": "53bbe38b-3530-43b3-b897-fa9305ec8e8f", "value": "T14145333FAC818CF8C6928937506553850DA4B2BAB4CD3FF6D793DD07496950DE2CA788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321150, "uuid": "ab93734b-40af-4d44-8e9f-2b24546b9256", "value": "24576:uWMo6aVnU+qb1Ma0Vw5M991Ov+xwoU4xKH4jnxK4wMwrgp:utaVnUDO9wmxwoISnxK4wMbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642321150, "uuid": "83a84971-e4b8-4dd2-84d8-18012aeaa4ed", "value": 1216263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642321150, "uuid": "068caa1d-291a-406d-91b5-4f3344c37126", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321150, "uuid": "007d1ebf-15e8-4ca5-875d-342da8b14d8a", "value": "RFQ-EPCM-Purchase-order-specifications.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d10777-7668-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642295217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295217, "uuid": "8fc493d4-61f6-4fed-a6ba-210a66457e57", "comment": "Malware payload (Mirai)", "value": "8c105be833efdbe8971c4f2e5942dbea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295217, "uuid": "93eaa794-24b3-434c-9a0e-b0a44e0f07b0", "comment": "Malware payload (Mirai)", "value": "a3284ef294236991828fa8c5c7856c6ae335414a52ba75c0d45ab0ba924524af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295217, "uuid": "b5c8265b-d6a7-4fb7-8768-eba94b69df8a", "comment": "Malware payload (Mirai)", "value": "7dfd09b88d31c263f7383a8ad0fc36da1f3573c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295217, "uuid": "373f4afc-a7fc-4ec0-ab9a-d00af95a07f8", "comment": "Malware payload (Mirai)", "value": "4a861272e0124f9ba97d8a6f250db401ee17194aa58ac86239394480afbc46b9bf88bba704ee77bf6ce5719c59033e98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295217, "uuid": "7bad1bfe-7901-4c49-82f4-68ea1adad48e", "value": "T168331881BC919A02CAD41377FA2E01CD372663A9E2DF72079E256F1137CAC2F0E67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295217, "uuid": "f87205d7-efea-4e58-8880-bac1b0bb9aad", "value": "768:yCgJg62/F1gKxdy8yayUgPuJwvLSJLz0o1uV7l3BNOZ9x5eevMV:UJgl/vgesVayUgmgLS9zoS95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642295217, "uuid": "4a869500-d007-4aa7-951c-59a2dc340032", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642295217, "uuid": "4207b51e-4649-412d-b8ad-85afe7f2b210", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295217, "uuid": "0c74d134-1970-4fa2-abf8-f85fd09b4efb", "value": "8c105be833efdbe8971c4f2e5942dbea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67128f2-771d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642372977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372977, "uuid": "c7ee4036-f2db-45f5-852a-16c8c3beeb12", "comment": "Malware payload (Mirai)", "value": "7cc297ded1dda067399043c3279ca942", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372977, "uuid": "d99a7e43-1842-41bf-8397-6c0c0df61379", "comment": "Malware payload (Mirai)", "value": "a32a929217a07f63e8e2d8bae7634fa28a32f32c3980c7d985a022e26c784f8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372977, "uuid": "fa067081-cb44-4fd3-9443-432a5a37441c", "comment": "Malware payload (Mirai)", "value": "25518596aa5fec37a715c89f6217a6504201ccba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372977, "uuid": "474a2107-fd8d-4881-8dec-a42bca4b01d3", "comment": "Malware payload (Mirai)", "value": "a5ef630551db3761e8c8eac0976b72b9a33cc95abac9aed7f15eabdfb8064cef2d996719b1ab68ca2ce8433125435279", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372977, "uuid": "d58615de-2ef1-42a6-849b-b551fe975886", "value": "T1AFB2D0717015F8B7C7E600B7AAE9DB43FA801EF8D0E8B3391469099DE6D5942AAF1107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372977, "uuid": "e0866387-57e8-4935-8f09-3316a6d4e877", "value": "768:QX9nxn8o9wnBoWzEQf2EjKb3pQWs3Uozn:Qtn+o9wjfBAZQ7zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642372977, "uuid": "77f18550-449c-48a7-af11-e22cbe57972d", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642372977, "uuid": "74242436-6ac2-4693-bfb8-4bf8b1d34347", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372977, "uuid": "16a7d0b0-2cac-4758-82fa-aaaf0466f001", "value": "7cc297ded1dda067399043c3279ca942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09faf897-76a1-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642319457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319457, "uuid": "9eafa0d2-b788-4b80-8b7a-511711d987a0", "comment": "Malware payload (RaccoonStealer)", "value": "dea02ae09c5fbe30756446ebee5fcd9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319457, "uuid": "67bb21fe-78d4-4e43-aadb-138f7c4e1ef8", "comment": "Malware payload (RaccoonStealer)", "value": "ab65ada1f9b259a38ff9a18aa666465a86aecf440fcb8d35a44c195954241ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319457, "uuid": "35791221-3d32-46aa-8acf-d080016cb65e", "comment": "Malware payload (RaccoonStealer)", "value": "86381d620c45c4ee3404be86c68cc3d16c0d02a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319457, "uuid": "3fbe2218-707a-4eb8-9626-1d24b64c1d5c", "comment": "Malware payload (RaccoonStealer)", "value": "ebe7a3b4bbd939dc3a111079a6238d29d4d56af6d32f2b448fa161a08d699944dc230915fcde9b2c7098ccfcc271d679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319457, "uuid": "f0679255-de7c-4002-b72a-5ce652d3fbe2", "value": "T1C9649E10BBA0C039E5B712F84AB6936CBA2D3EA1572454CF53D529EE57386E0EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319457, "uuid": "508ff393-f4de-43c2-950c-b87b1654c61b", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319457, "uuid": "06fbc878-4715-4441-b111-d33830d9cb50", "value": "6144:JoeMTQfGnVrlsacszq0P2h9vtlcOl6LteWV:iDTz7siOG2h9vtlcRLtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642319457, "uuid": "1db796a8-e5da-4027-b354-bd5d7210b307", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642319457, "uuid": "6788d75a-0111-4590-9202-42b0e0917521", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319457, "uuid": "7a9bd8ba-b547-425e-a473-731d9aa1b66d", "value": "dea02ae09c5fbe30756446ebee5fcd9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642557e0-76a0-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1642319178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319178, "uuid": "62605758-6f72-4347-aff5-bfdddd681f32", "comment": "Malware payload (CoinMiner.XMRig)", "value": "75bdebf790bb5fbc5834fdfe7ab9f576", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319178, "uuid": "c9eb8e5a-0322-4cb9-9dec-24193c0cb660", "comment": "Malware payload (CoinMiner.XMRig)", "value": "ad221a0e4b9b7a0a2da6f3c3fb059deda23076d897d7783835d9c39a354a2232", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319178, "uuid": "e14c7a5d-f541-4c6b-910d-4d5af518b2c3", "comment": "Malware payload (CoinMiner.XMRig)", "value": "309e31bf7c842d0988234e4d3117ab0502851b20", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319178, "uuid": "41a2db24-14d8-49da-852a-c774f9b7c9ca", "comment": "Malware payload (CoinMiner.XMRig)", "value": "26567960b6f72296debf4d676245a21a752ced0cd67f1cd0026c8bfb6805e5031fb9eebda64dcd85597a3e75b854e9b7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319178, "uuid": "98da0d33-0180-409f-aaad-a49a1885ed78", "value": "T1E464AF10BB50C039F5B312F84AB6976DB92D3FA1572490CB62D52AEE57396E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319178, "uuid": "c76f8390-c43a-4849-bf6b-3aea7dcfe890", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319178, "uuid": "34f253de-0bda-4885-8d2c-23439dbfffda", "value": "6144:WyXIrNC7ADLlVIra6iPe8UAmMfFLcOzonSbWQT:N44wQrOWNAmMfFLcRnSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642319178, "uuid": "57184ee2-38f3-4a5e-ac4b-eeb46c6ad366", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642319178, "uuid": "0e30a125-7ac9-430a-bf34-1735d29b522f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319178, "uuid": "901a6b52-6590-47c8-87ab-f4699941139e", "value": "75bdebf790bb5fbc5834fdfe7ab9f576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c200dc04-769f-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642318906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318906, "uuid": "9c0b1ff6-bd25-447a-b02e-b081fff2c27d", "comment": "Malware payload (RaccoonStealer)", "value": "9884f13df8b19b9f16ad9eab7c4d411b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318906, "uuid": "89e7295e-b85b-4f5a-8a2b-8845837eedb6", "comment": "Malware payload (RaccoonStealer)", "value": "ad61f980e5610e1c8b787ae74ad39f08681d3b1d75c15b664432130ec3175b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318906, "uuid": "b039840f-d419-46d5-b7a5-c5200b6b98a8", "comment": "Malware payload (RaccoonStealer)", "value": "7c4bdc9bb94a4a7306b7d9ad8b241a5db0be00b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318906, "uuid": "b9cd82c2-ae2f-41c9-9b38-a1ccd0bef45f", "comment": "Malware payload (RaccoonStealer)", "value": "dba1cf43733d48080f858bdf670d82d71042abea320127762d8f9a03f58bdb14dd0cd51bfe96e0c40aefd2996770d79c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318906, "uuid": "b04a3f13-79d3-4544-a5bd-5ed3408c0a4a", "value": "T1FD649E10AB90C035F5B722F84ABB937CB92D3EA1972494CB52D569EE57346E0EC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318906, "uuid": "475769d0-e0e2-4689-9366-99ce614b19b5", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318906, "uuid": "d9e461df-17c1-483c-b9e8-89f1917efa10", "value": "6144:nF+G4EgjU5vW4+WONVoTsFad3829qayeqo5cOZxXQBj9u9:FUEiU04ehFCJIayeqo5cGXQ5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642318906, "uuid": "f9ffbc86-caef-431e-be9a-c907159d12e2", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642318906, "uuid": "036e3c38-e26a-4a11-9a45-c2fbd5efe7cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318906, "uuid": "ead76dfe-1118-4d2b-b757-e268d0ec6eca", "value": "9884f13df8b19b9f16ad9eab7c4d411b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0e97b7-76fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642358358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358358, "uuid": "f7461d4f-603c-4fb1-980c-8b98b24d18d8", "comment": "Malware payload (Mirai)", "value": "3214b288078258bb06ed99b89e0f0742", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358358, "uuid": "49610255-291c-4f09-bbc3-698430474841", "comment": "Malware payload (Mirai)", "value": "ae3f0819d033e92758c71a36bd71ef08c979be3f525d908aad306d58d0c8f304", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358358, "uuid": "96725108-99db-4c18-bade-e14fafde3f57", "comment": "Malware payload (Mirai)", "value": "9ca3f90e8153019a630e1025bc50695092046363", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358358, "uuid": "c9c5d392-2618-4a64-b612-b561395dc0a2", "comment": "Malware payload (Mirai)", "value": "40d82bb8f085f6824fb4a5f2f54a397438a21784443a91bec2fdb34fda3633156087c6190fffba14eaf5c15786448f9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358358, "uuid": "541bf3c9-2586-4fcc-834e-506fbc60c045", "value": "T1005329C8A593F8F5DC140978307ABB66AEB3F13B7135E99BC3D82927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358358, "uuid": "4dd88a61-af82-4078-8987-e07f56d043fd", "value": "1536:IoRC9170vwHbQXZ5+qXDEuXi90dSW7V/DjObeFt6PuQ4Zr:PC917iwHbQXZ5+qXA594SWZ/XObeb6G7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642358358, "uuid": "19ce2c5f-1301-4c86-bb4e-5fba2308047f", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642358358, "uuid": "1229b664-8375-4508-abc5-ccc1c78eb970", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358358, "uuid": "4cbfc1f7-2c1b-4f50-9619-1660717c1f4c", "value": "3214b288078258bb06ed99b89e0f0742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543cb505-76a0-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1642319152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319152, "uuid": "8dfb4cf1-4cf6-49ef-84b6-1e7a6c057628", "comment": "Malware payload (DCRat)", "value": "9c7adc45cf73dd66cbd6f9cee81f0bb9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319152, "uuid": "0536b814-b8d5-4335-b509-9257d4070a9e", "comment": "Malware payload (DCRat)", "value": "b171e02cae66ed30e3e5d3ea6e79f38ccac759225883683856a8017d1bc351be", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319152, "uuid": "dc7df9bd-3088-4fc5-8a7a-7be1bcd1fc0a", "comment": "Malware payload (DCRat)", "value": "0e48008bb694726d257584c145d1c8e5be83ae76", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319152, "uuid": "5a95c369-290a-4db8-9689-865786f22de4", "comment": "Malware payload (DCRat)", "value": "bbd87acfb94d8c8f8e0256fb98f4701779abd116fdaa404d2f5464d91c9ca32ce53c3d09e32bcaa2a0a8029eb8fdda54", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319152, "uuid": "be1858ce-aede-4bc2-89e9-17114ecdd4fb", "value": "T1BB649F10BB60C036F4B722F84AB6976DB93D3EA1572450CB53D52AEE56386E1EC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319152, "uuid": "30d141fb-f020-44eb-a71b-845874b5386d", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319152, "uuid": "a1fc472c-f4ae-45a7-bf45-2b63792c3269", "value": "6144:XMVyYJck/85NMg8pmLaIUu1SN7tSvyNcO0cAXt2lCV:oyYJc5d7LWYu7tSvyNcIAXMlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642319152, "uuid": "2b5e6fdd-8f1f-49e9-8fff-d481d7a9eb87", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642319152, "uuid": "c7e790f8-d5f6-481f-8faa-48d2a666ebbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319152, "uuid": "70cc7525-e146-4fda-a725-ac92d1470377", "value": "9c7adc45cf73dd66cbd6f9cee81f0bb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8074eb27-7705-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642362605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362605, "uuid": "29be5c1c-a787-4131-ad3c-170e834cbf24", "comment": "Malware payload (Mirai)", "value": "de1248a9018e246f286a9b13e9f3baac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362605, "uuid": "e3ad8101-c513-466f-9726-583cc4ac3cfc", "comment": "Malware payload (Mirai)", "value": "b2304448a4b35ed9344406381c290292f122c416210f98eafdb2f060d53d4052", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362605, "uuid": "daf9c7fa-8389-43ed-8af4-dc1ec0dba4e4", "comment": "Malware payload (Mirai)", "value": "346dd7db0731017e6d1f78e830e8c3c57a9b2403", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642362605, "uuid": "691d9330-48a1-4231-995c-bee13c8d141f", "comment": "Malware payload (Mirai)", "value": "42edc56bd6fd8b31418dd40a737f38afa1e82c42df0e0bf76a7cd60d06b3841246bbcf3953ed0a6f7d7225ebcda663d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362605, "uuid": "9e563aa7-4447-4098-b763-435dd2cc480c", "value": "T1BC535CC9E5C3E4F5EC121A31217BDB339677D63E2069EB53E3A8A532E961602D01739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362605, "uuid": "5b359507-bd3a-49c8-8249-7be1ca3a6f50", "value": "1536:Ho6d9rIUwxlXcndlSA9z+8ba1LcY47f/NH0clEbSkMf3KlCS5:I6d9rIUwO0Yz+8b2edOb72all", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642362605, "uuid": "4b950285-5092-4807-8c2e-190d7c61019f", "value": 66448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642362605, "uuid": "3b7a52cb-f34a-487b-881c-282174140541", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642362605, "uuid": "d7c7f167-a5d2-4e85-aaa5-c1c965116a8a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dc5c10-76cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1642337628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337628, "uuid": "011b0594-2468-4fb3-ade0-a7f7d1b9b0cd", "comment": "Malware payload (Socelars)", "value": "ac1210272877eff394df1d2ba6de36bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337628, "uuid": "0904d974-2b6b-460d-a57f-77d7c63c6e0d", "comment": "Malware payload (Socelars)", "value": "b35c9271f87632ea2bd487dabee22913073a6120898ead08e50bb4e7f28054e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337628, "uuid": "966b9e3f-0dcd-4ea5-a23a-fa92ac86ae74", "comment": "Malware payload (Socelars)", "value": "07a501e7b86f3f8fa15ac613d604234612f35786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337628, "uuid": "16e230ca-e311-466f-bd65-934dee18ecc7", "comment": "Malware payload (Socelars)", "value": "8490fd6733b63369e39cf04a6990b26edfc5175964b6dcbf323a5465715d673e0812d8a776370c41f4de4f4957c92cbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337628, "uuid": "69b018c8-b84b-43d6-835b-b1bd5566f1a6", "value": "T18E659E11E6426136ECE310B382FF5AFE8D28B621030894D7E3C45D695E619F37A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337628, "uuid": "357d52da-f88d-4e16-b3a6-1a53d626d996", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337628, "uuid": "a62b3eea-6f8c-4da1-848d-3feb49f14455", "value": "24576:z4UpDMuCSO5T9iKvkK1dA97hfNpZZ06nlvmp78nLB0zPCfLzb7:hplyTv1gpJk98nLB0zafb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642337628, "uuid": "8c462df9-e788-4016-9308-ae5489daae67", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642337628, "uuid": "d909ea77-9e55-4a31-ae40-15a6403e85ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337628, "uuid": "741eb000-a811-4f2b-b078-e24cfdd8b04e", "value": "ac1210272877eff394df1d2ba6de36bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f8bb27-7668-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642295232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295232, "uuid": "61ec1e8a-548b-4b1f-bffd-5966b40c2634", "comment": "Malware payload (Mirai)", "value": "1c797e49f7c5cea08fb5c4f810f63101", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295232, "uuid": "42b1e5fd-fbe7-4a7b-a244-48176d47fc4e", "comment": "Malware payload (Mirai)", "value": "b449ff608504ffb1af6c6d7c59b59c141b808b14ae50bc232a8082e942a237b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295232, "uuid": "1ac465ca-12c0-4346-b2d3-e94746e0c9b9", "comment": "Malware payload (Mirai)", "value": "4e8d19bad5df6844506f6c060db5b4afaca2e538", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295232, "uuid": "ffbb7872-b6c4-4f46-9844-2de53bea30b6", "comment": "Malware payload (Mirai)", "value": "ccff94abedb2e3535f1512a88a7845df57cb69495174e07906ed623fb970717ff185e9d7f8129f82a14a5b2f15dccef6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295232, "uuid": "01bc5c1e-129a-4781-9749-a1f9a12cd28c", "value": "T14763975D3E218FACFFA886344BB35E60924833E626E1C945E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295232, "uuid": "76d3395c-2c2c-4d0e-a02c-a17f7cbc3bf5", "value": "1536:48xw3DOpSxUzpP+vntvnCEvnNI8Oo3IiHW1rU0IUjwuya2M:DG3DUSqZc/W1rUNGwuy7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642295232, "uuid": "0db854ba-207e-488d-b5e2-3c0b1a59147b", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642295232, "uuid": "302339de-d7f2-43fc-86ec-c21fb9303531", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295232, "uuid": "4ad542c8-2364-4306-ad48-59064696b329", "value": "1c797e49f7c5cea08fb5c4f810f63101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a87635-7667-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642294804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642294804, "uuid": "9138c5c8-998d-4d12-863a-0df122669408", "comment": "Malware payload", "value": "d7f6d7ff59a541137cc78ca6d53c2b5e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642294804, "uuid": "db775e6b-0e73-40d9-9135-958576ab69bc", "comment": "Malware payload", "value": "b7a9d981f8642bb827622a36da2d8dee83c2505c525891d7a897e73b6c4c32e8", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642294804, "uuid": "9cb9e182-4927-4108-85a6-1d997c0cb4ed", "comment": "Malware payload", "value": "95852fdbbe0ee4d261d8dd84a093df067fa50f9e", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642294804, "uuid": "a2b1febf-48ac-4c76-a5fa-ebc57b3452da", "comment": "Malware payload", "value": "6b40325e5c4a63a30107030e3e532f1f31eac2fc541a44b6e115952ea9f81f09d0561cde5404eb860daac4a8382731c8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642294804, "uuid": "5d424cf8-a5c7-4b32-b6de-210ed30b5bbf", "value": "T1AB05330552B77CC8F5AF6A7821130C98C7BEA2F69056925922884C85117B7FEB34F3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642294804, "uuid": "82fd5692-0069-4c01-ab82-d843cb9b6780", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekAE:IDSOgOhntWID2I0WkAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642294804, "uuid": "d5a1b934-7113-4a8f-9079-bb373d2e8b6c", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642294804, "uuid": "8ebdf3cc-478e-4066-8003-de7df3907c67", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642294804, "uuid": "8f602c1f-7ccc-4ac0-8703-a672ceb2eee7", "value": "b7a9d981f8642bb827622a36da2d8dee83c2505c525891d7a897e73b6c4c32e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecb449a-7666-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642294205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642294205, "uuid": "2404a93a-4d21-4867-8df7-daec35347213", "comment": "Malware payload (Mirai)", "value": "c49e96dd9c48692eb423efc7d5b5df18", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642294205, "uuid": "2c8bbbd5-fc05-4730-819c-22e951b015dd", "comment": "Malware payload (Mirai)", "value": "b84183c153320e0d7aa7b01ba5902ca156fedf3fe82f6bb6f3f33ac774ba732a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642294205, "uuid": "8c6cf70b-edc1-4fcf-9cfb-387d4175e6db", "comment": "Malware payload (Mirai)", "value": "2046eebb129ecb2a2ceddb0180f5316293686530", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642294205, "uuid": "04a9c46f-2bff-4f36-92eb-92ac7e3bb2ca", "comment": "Malware payload (Mirai)", "value": "072f6e53bcddbe9819247e90443035d6a6c3941271fe3586e048e68ea6aabd1f6ca50e3e7db9011d16d01e85b80bc5cf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642294205, "uuid": "fcabddfd-08d7-484e-939b-2cc3bda75ea4", "value": "T1BF633946BC814A23C6D513BBFA6E01CD332627A5E2EF721BCD216F10778691B0DA7752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642294205, "uuid": "a5cf8165-e878-4b7b-b6c5-ed7ba46da2af", "value": "1536:SL6Iq0r0ZeKOisLH4pwkXJSacY6pC1WLcjSxITDuOvH:SL6Iqjx1WLcA6BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642294205, "uuid": "ad3078df-b7f3-4d45-8ce8-06849b805970", "value": 72056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642294205, "uuid": "b9824ff1-448e-48d4-bc63-d19e08206862", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642294205, "uuid": "e2ea3d96-6fbe-41ec-bda0-ec8b295d55c7", "value": "pop.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b81f463-771d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642372958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372958, "uuid": "a006de6e-214f-4ce4-a147-7a32ee847f7b", "comment": "Malware payload (Mirai)", "value": "0ad752c412c103009aafc978850c381b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372958, "uuid": "656dc211-c8ef-4e5d-b5fd-125afdf93855", "comment": "Malware payload (Mirai)", "value": "b846e8f4155475e83bcb38aab64e0de5a48544516ac06acfc659f0ebcc367a71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372958, "uuid": "3e492a47-9d24-480b-9f2d-e3a08d980162", "comment": "Malware payload (Mirai)", "value": "633300f30c1cdb2a801879865322c3a362742c4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372958, "uuid": "03e3eb90-2777-42cf-a2f3-a85893ca6767", "comment": "Malware payload (Mirai)", "value": "39c8ce85d8ee640597ad49a43d90ef688ca58f5361af2b1cfd38f881319adbbc5daf7e02bb25cc1b9ed4d953762f6623", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372958, "uuid": "7cb4c53e-d40d-4dce-85ac-d116e66cc962", "value": "T137D2E1016641FEE1D5B00231ED668A9B72253DB8D1D174FA873C0DF8A6E9A1D4BF8D43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372958, "uuid": "c1673314-b7a5-48ac-9928-908633e6e574", "value": "768:FusHfRavjynNKnjFcZIhQzhKMXgVSO9q3UEL7U:VRwynNIOQQ1KMwkLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642372958, "uuid": "d1b3baf0-1445-4957-8792-2d5f07f0c157", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642372958, "uuid": "bd3e27b4-4d34-4e2a-bb62-143e124e55a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372958, "uuid": "079aeae4-f889-4afd-aec3-a453eb7b1cc3", "value": "0ad752c412c103009aafc978850c381b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18487a1f-76a5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642321199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321199, "uuid": "927bd0bb-5b7b-4016-b0ba-cb2c73b57eb9", "comment": "Malware payload (AgentTesla)", "value": "a0bd52d118faefe80e975463fb8eb173", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321199, "uuid": "8f9e6458-f705-422b-b526-01aa5a85559d", "comment": "Malware payload (AgentTesla)", "value": "b90b9b3567c7fd77450a9282e532e57c9e19ec7d21522263ba976bebc4eb5877", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321199, "uuid": "66743586-3b7a-42ae-bade-511a24a67faa", "comment": "Malware payload (AgentTesla)", "value": "51c1f44a2003105d47846da532a8146a08a83573", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642321199, "uuid": "ce5b009b-c760-471a-84b0-09d60397f759", "comment": "Malware payload (AgentTesla)", "value": "071325201151689abafef74013ead8ff20442e1fe8d21c5bb894b6da22edca170aa6532a7ac772c101569e2002a6460e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321199, "uuid": "d8967c9d-7622-41ef-96cd-7d5ae40490f2", "value": "T159B423EDA335E0A4A96787371DE37ED631B2D5D83D89E01FFE8C59434025AF09A016AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321199, "uuid": "78043381-e3bb-44d5-8975-64f4dcc4aa00", "value": "12288:DUKkgpyAJZFuJRrN1Ig3r8Mjze/3/xBrvihURQ2u:AKkgpygZwJ7SS4xBrK6RQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642321199, "uuid": "b4f8523f-7d15-4d4c-a726-939f3ebcd7c6", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642321199, "uuid": "efb33048-473b-4229-8c49-fd7c5c10c92a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642321199, "uuid": "f1423616-3889-454a-8b3c-bb202f9ce324", "value": "INQUIRY DATA #11-17.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8e1279-76cc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642338332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642338332, "uuid": "d29e8f90-55ea-494e-b36d-939af4f9b0cf", "comment": "Malware payload", "value": "66e3103ebd4e94b69efda203606f09bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642338332, "uuid": "02a591f8-5af3-4597-bdf4-3e4a42d1cb20", "comment": "Malware payload", "value": "bc5c16685482832a733991a0a5a29c0affe69cb5fa4e07c1ad6bae49c46bad2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642338332, "uuid": "1ab91a26-8729-440c-803b-ab23a3affa63", "comment": "Malware payload", "value": "f5a3960c89330930a045d0b9f6babd8be6c2a971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642338332, "uuid": "d3fc77a6-d501-460c-8188-9e4d7fb95232", "comment": "Malware payload", "value": "2dc893c7ec95adc578c612fe7c36decc9cefc3e7096c9dff587b36226e42b75019d281d06cfb872616687fc7693e04c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642338332, "uuid": "a0218624-90e2-4ae8-a5bc-0bd30028fa96", "value": "T17BF533A048804BE7FB7FD23C049C8A5D2F09EF38BBD9719A853436C9951B79DCE81295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642338332, "uuid": "e6dd7663-2754-4f77-83bd-b92acbdb2c48", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642338332, "uuid": "4672767d-6f4e-4dd0-af8f-4a0f1df677b6", "value": "49152:LZ1BiQJlkxmHAYHkMBJsgimq451+n/o4FFGUHGv1b8yYBW6VyE8MwEx1uEmAI8cB:11BiQJSqAgPvi126Wb8Wx+1wPPb1Qux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642338332, "uuid": "4392eaa8-1987-4147-85c0-393042feb97d", "value": 3409920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642338332, "uuid": "4ec40b32-e73e-4261-83b4-a0180b3e60ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642338332, "uuid": "354568cd-8a65-4ca5-83e3-e313ea74cafd", "value": "66e3103ebd4e94b69efda203606f09bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2b436d-76f2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642354568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354568, "uuid": "72ae6282-d171-4b62-aae1-d149983ebcb2", "comment": "Malware payload (RedLineStealer)", "value": "7feecc977c92152424ae4e335253fe27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354568, "uuid": "57fd88d2-91a8-4f1f-89ce-788dde333a1f", "comment": "Malware payload (RedLineStealer)", "value": "c0448d733802bd6ebc97b099bdcb5744fcd6149c9075088e88eb0869a6d8d175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354568, "uuid": "1bc37580-e571-45fe-90ba-603c3caa8489", "comment": "Malware payload (RedLineStealer)", "value": "2076e05437a076a3a8aeca64631e6bb21cab39d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642354568, "uuid": "15b9eb84-fa5a-411a-b080-6a4a82cf1ccb", "comment": "Malware payload (RedLineStealer)", "value": "18bc94a9c799ed110c85140e009e64abac19ea9b1fd3ea8d3ea3936c1ed3da25c2a2b6ac85fecf3b87b89f27b3075623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354568, "uuid": "152f825b-d591-4fb9-84c6-6ef330efd54f", "value": "T1FB649E10BBB0C035F5F711F846B693ACB53E7AA1572451CB12D62AEE4638AE1EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354568, "uuid": "7021d52b-c254-4f3a-9c4c-1b3c4aeb0c7d", "value": "ece6f983f2f5d858525c32a5672c95ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354568, "uuid": "c1766200-3c88-4e5e-a126-5a539e5de48f", "value": "6144:uvyGFPyPvaDdQ05Yun3VpA5e98fwuOBhLkDWzkPFfBaehf3s:uvlaPvt6bnHAg8YxcnNFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642354568, "uuid": "c66e1cc2-4324-45d5-a169-be543bfdb67b", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642354568, "uuid": "9cad643b-4295-42bd-af83-580393c20ce6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642354568, "uuid": "488633ea-c32c-4f5a-a7a4-c4826de84f0b", "value": "7feecc977c92152424ae4e335253fe27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94eae69-769f-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642318865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318865, "uuid": "d678f057-bc1f-47e0-a15d-305177af40d2", "comment": "Malware payload (RaccoonStealer)", "value": "2699d35257bdf6bf8cd40ebfb5b2e68e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318865, "uuid": "244285ea-4b7d-49e4-9c7b-ca11f095b0f6", "comment": "Malware payload (RaccoonStealer)", "value": "c06ecd964923696d7c6df9d4cbf9386cb68325d308c5e2f907609c60e80df2ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318865, "uuid": "30bb3ea5-2ae6-49f2-b991-7af404178e74", "comment": "Malware payload (RaccoonStealer)", "value": "1f94686fed17590b6c05e6d93a89e15aa7567cf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318865, "uuid": "2060655b-6bcd-4e87-b179-755a891a1a13", "comment": "Malware payload (RaccoonStealer)", "value": "f7fd7a5fd58b01a5b4459dd7e81cdeb0790bc99aa69b14be9e40410cf43e1eae8ae5b4454ac1cdfa5feb9ad690252563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318865, "uuid": "f63735fe-4114-40ad-9b0c-379897e4e46f", "value": "T19564AF10BB90C039F5B712F84AB6936DB52D3EA1572490CB63D52AEE56386F0ED3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318865, "uuid": "c6ee6cfe-e5d0-43c5-9e95-cff521ac3ebc", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318865, "uuid": "4fbb8133-bfcd-437d-b2b7-4b0d759d5650", "value": "6144:KGP+pIEOAU+jq6pYNcREa0UNIZPkmRbXGqcO+UUB/AXvJ:VDnf+jq6pYEEqeRkmRbXGqcqUB6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642318865, "uuid": "83ebf314-20ff-47d3-be76-0c15061f8776", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642318865, "uuid": "27b51935-c701-4112-9ac5-4bdbc218dbb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318865, "uuid": "04a0f290-cf6d-4986-94fa-cb946ea8f933", "value": "2699d35257bdf6bf8cd40ebfb5b2e68e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93db5b96-76fb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642358343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358343, "uuid": "d15a961c-7bb3-4fdd-bf20-a35682223501", "comment": "Malware payload", "value": "596a21fe60b7758ed65d17eb19c104e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358343, "uuid": "ce763212-cbc2-43f6-aa64-ecb9033834d8", "comment": "Malware payload", "value": "c0d9a445934f06d3f4be670b7a8c29e81418a927c834c3c82de4302c1b3f8e2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358343, "uuid": "30fc9e77-095e-49a7-ad29-8d7eef539cfa", "comment": "Malware payload", "value": "0d6f2893aaff911fc0f1fec117e327aae5817121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358343, "uuid": "a86b52e6-979e-4f9d-a2ee-255a0ccb9529", "comment": "Malware payload", "value": "0018c975a191cd80177dc694c3f17f0cc7c82a64c595f0da52a53f7bb8e23350053f1aa27839864a08588121644b620b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358343, "uuid": "6fcb52cf-d525-49b5-a549-5b40271f15aa", "value": "T12BF633334503616AFBC6B0F1DF12C2B246364AE161B5B719A9B46A1EC4EC5C2F2F725C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358343, "uuid": "3bed05f4-31f1-4b4f-8b4f-1f1c546db637", "value": "393216:gC0B8c1YbuKeYQPmDpN57ZYmAzv9Go0i3ESpm:Sv1yneYKmRNYRzvGi3ESI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642358343, "uuid": "5cab0384-e18f-4c33-96b2-f259df1cbbec", "value": 16181269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642358343, "uuid": "d855af20-5fd9-40e9-8938-fefc4cc7c945", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358343, "uuid": "87fceed5-bea9-4e19-bd18-e41c4dbe5d91", "value": "596a21fe60b7758ed65d17eb19c104e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b477f5ec-76f0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642353673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642353673, "uuid": "b8db6497-63d9-4010-9392-1aa98d9214fd", "comment": "Malware payload (RedLineStealer)", "value": "bdd6d822a048ef822c8374d97700eb99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642353673, "uuid": "8d95fbf6-80cd-4509-b785-0ebd390fc8da", "comment": "Malware payload (RedLineStealer)", "value": "c25d1fe88e1b97a9b07941683641db28863d24e4c422a9cb4033db3cf641a9ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642353673, "uuid": "f752a44b-80e0-432a-a513-8b1c39dd6ca6", "comment": "Malware payload (RedLineStealer)", "value": "a1a5dc908c4e61677c544db664b79b3cb39200c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642353673, "uuid": "918238fe-1698-4975-b64f-d51cd8abb066", "comment": "Malware payload (RedLineStealer)", "value": "33c97517454621d6bb05be7a8136caa5e0872a423271245b4de386f32389c1f506b66a0032da7b1ece96eff8cfe140e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642353673, "uuid": "7e402b73-26d4-488d-a6c1-67c3eaa0ede7", "value": "T1F3649E10BB90D035F5B711F84AB5936CB53E7AE1972494CF62D52AEE5A386E0EC3070B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642353673, "uuid": "495b0703-1b7a-4583-839e-7d8f6519f40e", "value": "50ed4f508f1ae415f83955c4c39766f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642353673, "uuid": "cf3deb0a-fb3f-4994-a9ac-6a10d2a924c8", "value": "6144:yAcmE3aMr3xih3v7fKDWErtH2v6bcJHRVGQX362/akI:yAG3VM/7yDjtH2vwcJHRMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642353673, "uuid": "ac82d31c-dcc6-45cf-abad-0acedb1fd09b", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642353673, "uuid": "865d7bb4-bfca-43f9-ae88-afa7e2058f39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642353673, "uuid": "31304bdf-64bb-45e9-b55b-0fbc01e54457", "value": "bdd6d822a048ef822c8374d97700eb99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb01b00-76b1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642326445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642326445, "uuid": "1193e940-3159-4b4b-9612-9b61aa5b3954", "comment": "Malware payload", "value": "cd6737ad3fd4deffedae0d1fb48cd600", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642326445, "uuid": "7b9790e1-361b-4847-ae92-f72b03265a26", "comment": "Malware payload", "value": "c2d95a006f6d28af0a332a9dc8b962e7572b40ee05cde1a2b4e48a5c379a6572", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642326445, "uuid": "3a2753f1-b420-43ad-9ed9-6a61869a3f2e", "comment": "Malware payload", "value": "23b37daa5f0bafb20b7d70eedb7633fc33de9390", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642326445, "uuid": "9edc5475-a5e4-4097-a550-abf90a4fea6e", "comment": "Malware payload", "value": "fa92cbc9f06b7192f277abef6503a6b04d27cf31e912353aab4970bed44be8ca0adf2ac271a1a97ea764a501e4037d3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642326445, "uuid": "c2d90e22-fcd8-466b-8522-c135a70e903b", "value": "T1C8C4B00177ADFCF2D172463157BBC3F15B3DF8100A69CAAF67840A1E4AAC1937A21B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642326445, "uuid": "daa55b04-b018-4e22-89a3-e67d8a794d26", "value": "66eb3112320efccabe3dbf9331a2023a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642326445, "uuid": "2cafac84-ce5e-4bed-b864-64b440a90512", "value": "6144:VWr41a+d+wXqNNobw5Ps/At/smyQTqAOLphldlYuHAGC2qS9tXhxAyi9W3EstTCg:6ik5UICETqFphlrF5qQ1AyiLWg2lvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642326445, "uuid": "130ad317-859f-448a-8058-31a985cc0c64", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642326445, "uuid": "70730f81-02b4-45d6-bee8-f79b70f3bb6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642326445, "uuid": "abf0d056-638d-4fe1-9684-fa4c4dafab6f", "value": "cd6737ad3fd4deffedae0d1fb48cd600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4800487-76f4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642355418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642355418, "uuid": "a05ea47c-b43d-45c6-b161-0f9c3fa481bb", "comment": "Malware payload", "value": "7e3479ac62acbf7608d40a0705dd6c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642355418, "uuid": "cea1f226-6b5e-48f5-9620-5d421796d448", "comment": "Malware payload", "value": "c2f67092355cada8a5782cc7f50ba81e508950888a9775439b4c1d1f4a6c18f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642355418, "uuid": "34720f39-b77a-46a2-84fa-9e3105cb8f65", "comment": "Malware payload", "value": "8c1c850a65f24ae3c7bb09254d1448ef450ab3d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642355418, "uuid": "3a30bd30-3766-4d12-96d0-48e1470890b4", "comment": "Malware payload", "value": "f0d67b6dca41e90631e5bab4a94b3eb290af4bb47d90ae751d79fa577a29c1fdb82815b2c75bd7b60dcc08c5d56b9acc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642355418, "uuid": "2a538d8a-ec76-4ebf-8758-c989e8e375b8", "value": "T1EAB3E087A2C08F65C0610A725F69127E4D31BD2E21659CC303F9AD7FBB7DD618B061B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642355418, "uuid": "ea7f5953-4640-4c83-9059-b672d204010a", "value": "9a2ca68608f47503562b69da9c6862c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642355418, "uuid": "dcd617ad-2106-4427-a504-8dddde284282", "value": "1536:m6Ju4KlMkWhHWn3tm21FqSp4mNo+4/1jykjKPjj3YwCnHW0Eo6UjtSQ:VukrJWn3tVrp4IEH/r20KUjtSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642355418, "uuid": "26e38396-f3e1-4275-97d1-8fff89242da8", "value": 112725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642355418, "uuid": "fc3a5494-9424-4d7b-90d9-1cc947d3f1e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642355418, "uuid": "e38eb67b-1e02-4300-8fc3-431408f05b2e", "value": "Stage2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c273e2-7716-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642369815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369815, "uuid": "88d2ccf2-c6ed-4082-9132-32c1051ca915", "comment": "Malware payload", "value": "de7b1ad656d339c67cd97fde91f7339c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369815, "uuid": "eba12f9f-f59d-4470-b236-59a6d39cb6b1", "comment": "Malware payload", "value": "c5a4f2d317db1ab9e6051e7f08e2732ed22b6367815ef7ebe4477fd4e9812732", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369815, "uuid": "25a42a98-6afc-4b93-b423-5b7d49bf306e", "comment": "Malware payload", "value": "2a1a3b299bd2b625b8b5ec499ef9f415d89aeff6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642369815, "uuid": "b5b032b2-9d60-466c-84c2-f37df3b7ff8c", "comment": "Malware payload", "value": "1540a59aad92d2533fef2a0a99d3d443e45250dac4175939e77cc9b039fc906f59074328dc06020f216cdac3899f7aff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369815, "uuid": "5bc8a555-36aa-4f34-9750-6aed6c071a0f", "value": "T141332A83BC80DA06CAD4137BB6AE41CE33256399E1DF7307AD126F51378A85F0DAB645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369815, "uuid": "7937cab1-e801-4d75-bb19-cb07caad3480", "value": "768:F3CdNF5CG7HBR151EyIOJ9TZsCxu7HrKyiHmxmp/Onm4e0RNOfRFLETrcM1:UdlZ7HL15CyI+9T+Cx8HrgHzCm4eb0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642369815, "uuid": "c4b4481e-524e-4e4a-8288-e4c93ac3a92c", "value": 50684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642369815, "uuid": "a5cf7cfc-5bca-4d37-8c04-ad3a1569b2fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642369815, "uuid": "7eee3f8c-5583-445e-a5ee-1064a6385cea", "value": "gigu.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2125a641-76e1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642346983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346983, "uuid": "11d5f668-dc3e-464f-8c88-dc7cb57967b3", "comment": "Malware payload", "value": "f30a81298e1d31f4a427781d821739a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346983, "uuid": "7dc96071-ea6b-40f2-8737-499016a49a4b", "comment": "Malware payload", "value": "c5d17a8e5a86a03e9b2ce77a2ae48b7a8340c0409877fb234c62beeace50ca4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346983, "uuid": "713a9f6d-af34-4a25-8015-5d25443144a5", "comment": "Malware payload", "value": "55ef87930074ad798f27c80da02cf754a9fc1a83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346983, "uuid": "9ff2589e-0a67-41c1-9b4c-919f63b90e64", "comment": "Malware payload", "value": "d6e6b2d85ae67efc8692c206f0155fa678db963b1ad25885f6a873a1c193bc0764c5eadf29fbd0a6c40fd212870f728e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346983, "uuid": "5e26e0e9-1f49-448f-9f26-1081af9df179", "value": "T19AE2E051F0289EA0EEB6A7F2DDD4E2852BF72D49AD8005D692927E011C7272D2541BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346983, "uuid": "5f0cfe91-4482-4f68-94f0-af3ca03a80c0", "value": "768:tRRzRH1CSD6jK4RrdrDjrhrEuc5ngNMGlj4uVcqgw02NWXa:t3DMVNVE5cP4u+qgw06WXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642346983, "uuid": "58a69a8e-48eb-42c8-b710-2f5a25c98a4e", "value": 31224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642346983, "uuid": "911e5929-8acc-4a1b-8b07-163c38335061", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346983, "uuid": "0983c2f2-1e90-48db-9c09-6b3fb0666781", "value": "f30a81298e1d31f4a427781d821739a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6bfec2-76d6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642342601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642342601, "uuid": "df728ed3-d334-497f-bb41-b48ce62cbed5", "comment": "Malware payload (RedLineStealer)", "value": "ab1df4b56d71d3db5ba39b1566004034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642342601, "uuid": "fa46edc4-0a19-4223-94ca-fa04984c8727", "comment": "Malware payload (RedLineStealer)", "value": "c9a291e4568a80c7834148e99fc2e765d440af1844e65838495973e3d9cf3874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642342601, "uuid": "d542d33c-79ec-40b1-b983-007b0654e9f7", "comment": "Malware payload (RedLineStealer)", "value": "60c7423195e04f75b5c9b5b5658e70fdaf7bbf52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642342601, "uuid": "86f9b26c-1952-4b3e-a6cb-4b3548a09786", "comment": "Malware payload (RedLineStealer)", "value": "8370447993572f8ba8f8b3a36e032000a722cb52969769e1caea54e40e5d9211d0b418f461e258ac06407936fed8a6dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642342601, "uuid": "b8581ad1-0f6e-4fb3-b913-14ac9f9b570b", "value": "T1A865C6306FD4FB21CFD8F7B6935B922043F159D5637A920BAF4B36B06C17A267A41281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642342601, "uuid": "bc5a414e-09c7-4db0-b530-653873563d24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642342601, "uuid": "c088fc82-10b1-4814-bbec-74f89bbb65b1", "value": "12288:vD5JMdN6IhJdRg2L01WPbHB/shPEstwN/aRBewbfXidRlKeFTgFLQMNeQcP2yx7j:vgdbRg2L1lFTUUWRS2yx7iLTN2Yub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642342601, "uuid": "bd817220-70d1-4681-8eb2-ae50c79e4b99", "value": 1446400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642342601, "uuid": "2baf777e-61fd-402b-b193-8fa4476b7bb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642342601, "uuid": "48d12d0e-4492-40ab-a499-4e457c679ef6", "value": "ab1df4b56d71d3db5ba39b1566004034.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70979fdc-7672-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642299442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642299442, "uuid": "5438ad9d-bcde-4731-83ed-33514f9b668f", "comment": "Malware payload (AgentTesla)", "value": "32466b1e6b2ea104d176e297aa1dace5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642299442, "uuid": "69a0fc9f-25c6-47d7-b4c1-983fe8e65efd", "comment": "Malware payload (AgentTesla)", "value": "c9a6d59745a7eff46ed411e4f7f4894eec5df85d70d931082194b35becc25799", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642299442, "uuid": "8aeeef27-f19a-475e-b32c-354bcfcaed6e", "comment": "Malware payload (AgentTesla)", "value": "136f71da888e97dd1dcadb321187c199260eb72d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642299442, "uuid": "8d0633a2-6e63-4f1f-bc44-8b807ec86b5b", "comment": "Malware payload (AgentTesla)", "value": "f3f2e98e4529c14853b5cab739d7ffd7667798a9f2378d178c7ab1b94e36a632eb680acebd8e02d9936d6acd4dcec922", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642299442, "uuid": "27bb9bcd-a69e-4d24-9bbf-17039a468503", "value": "T144C4DFA8726072EFC85BC572DEA81C68FA6570BB531F4607A027019DDE4C99BCF245F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642299442, "uuid": "673d1af1-469e-4321-91a4-cf1874742245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642299442, "uuid": "a1448a4c-ef22-427d-a463-1195c93b900a", "value": "12288:Ep2mZ3/2lWIzPRWhkU561PHSdD0BeEuAu7OwhJ+g3RFzcNrt7ABEnw8U:OAoD0EEuAmO2ZcZnw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642299442, "uuid": "48fac510-97b5-4647-801a-84e017dea4b3", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642299442, "uuid": "78806daf-10c2-476f-a5b9-54286db25ae7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642299442, "uuid": "16a02516-15ee-4579-836d-591ea796b222", "value": "##RFQ MT-QUOTE 90920028726Y27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadd5a3d-76ea-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642351214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642351214, "uuid": "b0921114-d0ee-4dac-bde4-8eaf80ebd695", "comment": "Malware payload", "value": "4341ca5a6cbe4c98e8e44842fc594a2e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642351214, "uuid": "d98c35e5-9eb8-4171-8dc5-6c983d7d8611", "comment": "Malware payload", "value": "cad208840c494fa59cd7f55981a677c3d806ab2ff4dd606428da92beffd5f3fe", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642351214, "uuid": "be7dad1f-47c4-443a-a896-f5d2f2e49d5c", "comment": "Malware payload", "value": "0a26c73aa0863bca3d2ee73c09ae87fa56fc31f0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642351214, "uuid": "8aaff213-6edb-4ca0-9502-10954037fa81", "comment": "Malware payload", "value": "2c7293d04eeb536c9ad8d99b5830c6c404c5675fbd26ef4d5818b5bc688bf174dd916a11b4891fc4a7dbde7937309763", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642351214, "uuid": "3b42adbb-3f39-4045-b5ce-3d82bfb4d4c3", "value": "T1A62733B0D474CE673E37DA34CEB2A91D0EAB94368C435877E616122A5DD7EF234AE014", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642351214, "uuid": "76bad6af-4ba5-4549-8941-e4a75039f448", "value": "393216:udR1ECwNYJDrBhW/c8ANj6CJdHQcUkEzbZTcM94RvJhXP4FGv5599y2BNRY:ymNkDr38c8ADJZM1Td94RvJ5g4x39yAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642351214, "uuid": "2bf1a92b-59f4-436b-a4e1-769a470257fc", "value": 21093461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642351214, "uuid": "24083dfd-70ef-4295-8461-d298e6f50b1c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642351214, "uuid": "07e5232b-7740-4cd0-af13-527d4e92fdb7", "value": "Takolya.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba25a14-76db-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642344397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344397, "uuid": "ce6686d8-9048-44d5-98b3-6fe28a55429e", "comment": "Malware payload", "value": "ba229065a014b5460806e826228e749a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344397, "uuid": "8b2344d3-84b2-4360-8fad-cc359ae95787", "comment": "Malware payload", "value": "cd8af5c41e8d847ca8107731cc89b98ee653255e93ef41064a1ce9f1bae35a7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344397, "uuid": "db7f39c3-a91b-48c8-9934-5648d0baf6c2", "comment": "Malware payload", "value": "5b3505cd8e3bb42ede57ec4c4852eccaaf01b079", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344397, "uuid": "d4009cb7-9c5f-4e39-8ed2-811de2d3efcb", "comment": "Malware payload", "value": "28ade9faaeed57f9a658cbb4ae8ac1a7a9fe41a3b4b918ace24691d40e6e5dd1a15c5ed718250bcecec9aff847d23cc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344397, "uuid": "c57e81d4-f2bd-4d5f-a178-4e0207323ebb", "value": "T1D963E961B9809037F9D302FF5EFE58EC90987C5087DE01E3A05656E5D22A7F6263B287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344397, "uuid": "24637096-3964-4fcb-8048-d0a02df83911", "value": "a7a743b3c1679b74e8b9e02afb6fdf6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344397, "uuid": "4d68e715-9bc3-4452-b28d-490ba09de818", "value": "768:zXGb+S8S3dSm1Zb2oUmKeLU8lADkashKZ3iXSwDj:j++sL1k1mKeA8MkashKZ3iX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642344397, "uuid": "3d1ffdc0-6a13-4aef-b3b2-15d94545ce7c", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642344397, "uuid": "7dea7970-95bb-43a2-b635-c26332c8117d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344397, "uuid": "d53b88de-49dd-47a3-8a04-747643894a78", "value": "ba229065a014b5460806e826228e749a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b548a9f-76e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642346973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346973, "uuid": "d00d3dab-4ec1-48a8-bd59-f38e782be269", "comment": "Malware payload (Mirai)", "value": "afc30585016059a01403ef22353856eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346973, "uuid": "c82dc325-2156-4aa6-90fc-a27ac231f3ca", "comment": "Malware payload (Mirai)", "value": "d0909e5c9ce39a8a0a1a3e245e54d58e7bea687be5a861815cbbd45d116ecb82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346973, "uuid": "8da77aee-2a27-4a19-920a-a6fe84278111", "comment": "Malware payload (Mirai)", "value": "e8529a2e9e3bb696073bada519dca853f104060c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346973, "uuid": "481ce899-831d-494a-8519-fbb1a4f81b63", "comment": "Malware payload (Mirai)", "value": "9a3bbbc6ebf344f7073305b420536956d1f94bbed79a7dc9fbdfe98e1601fce94f0d22d6e89c10ece9e94cb15435dbc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346973, "uuid": "0b10e2c3-4de2-437b-9a7d-5f6ea53248a9", "value": "T141439E23C9215F18D2999AB0B075CE784B53AA5093A71F7B6069C23C9443DDCF52B3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346973, "uuid": "c4834205-1527-44c4-bc23-e780b119cc82", "value": "768:4m/m8J+WWjegNiQruQSelZznKH8JIazola2x/fCfn010fx4bzOtvN/hYLORnII:tmCWjeOldlRKH8JTElF3CfB4yN/xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642346973, "uuid": "e2a506ba-2b2a-47ad-a6c1-04564f668a4a", "value": 55232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642346973, "uuid": "feb8ddc1-df73-4ab4-9938-01e50fa4a9ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346973, "uuid": "573b0375-9eed-4303-9eb8-29766cf2e34c", "value": "afc30585016059a01403ef22353856eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe977be-76cb-11ec-9275-42010a9c0029", "comment": "Malware payload (OnlyLogger)", "timestamp": 1642337693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337693, "uuid": "e4f6c868-897c-43c3-aac9-19e779da0177", "comment": "Malware payload (OnlyLogger)", "value": "57620fe23fe46b9b50f5ec40bdc6b8fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337693, "uuid": "d2026d34-91aa-4c4b-bec9-33bd14b8b62e", "comment": "Malware payload (OnlyLogger)", "value": "d1a299c8b89530ee091ceeb89c172bdd9317816825b68926b0e368714e74d27f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337693, "uuid": "02cd1379-ff7a-46ae-9b6a-ffcce99a8533", "comment": "Malware payload (OnlyLogger)", "value": "fe38a4e6d66ad1cc621ea39e3d344d1fcd6227d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337693, "uuid": "45093131-7e69-4282-98c0-fa4cc309c316", "comment": "Malware payload (OnlyLogger)", "value": "8b7297376c9a77fea82fd3dba51d9226dacaf296666888470e707ac5887144298cbb1d11606405b9672fe844635301d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337693, "uuid": "8cba9b21-89e2-49b3-9ef2-ae11d0ce8534", "value": "T14F94CF00FB90C035F9B752F89A75A76CB52E3AB25B2450CF52D526EA96386E0FC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337693, "uuid": "2eb8cc07-a80b-45ec-8220-3b94d16c10b6", "value": "e35f8b1f81e9ff2dab196a397d763305", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337693, "uuid": "cd26b997-86ff-49d2-bfba-fc8c18d8ce46", "value": "6144:1qH4z36C4T4+vJSMo6NH3IuMcWml++Em3aH5WO7qxCico7BEn8Zr1:1q5C64eGuMcWO+o3GzexCoyn85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642337693, "uuid": "4fea738f-ecc5-43d3-8322-1a67f67e5db8", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642337693, "uuid": "8613876b-88a1-4094-af80-5193c30bdf9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337693, "uuid": "02c52254-7ee1-4a5a-a71d-8618b0fe160f", "value": "57620fe23fe46b9b50f5ec40bdc6b8fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fce880-7722-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642374937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642374937, "uuid": "83309fe6-f47a-48e0-9dc8-8f2f32fcd8cc", "comment": "Malware payload (AgentTesla)", "value": "347aae961cd7083fe7dc54ec86498c08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642374937, "uuid": "f287acb9-b89a-4194-863e-04a31942d3ec", "comment": "Malware payload (AgentTesla)", "value": "d54f3f0c53c9d51da53faf67c8c6880286ad2d6e41d75d985928b09a28c1cd0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642374937, "uuid": "03f2df54-137c-46f6-b648-e53a901b9824", "comment": "Malware payload (AgentTesla)", "value": "e05f034f92fa22f7570bcf91c62b00379b3292a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642374937, "uuid": "56fc7940-ff13-4106-b18a-81864c0c3ad4", "comment": "Malware payload (AgentTesla)", "value": "db29ac5e54313fddd4795cec48b945013849b080171a58b0e24307d27d717c96aebca51ee03573c75cac6a10438e8109", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642374937, "uuid": "e4a5bf76-cb70-46e4-ab64-24934c536685", "value": "T1F5D4AE2D0B1AA408E44873F7627D57A00BFA5D687915C2C94F7738C568B2687FE6C2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642374937, "uuid": "c66f374e-cb14-47a5-854a-a7d3c44acfa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642374937, "uuid": "2776e47c-8bec-4000-89a6-669e560c8711", "value": "12288:UfN9+WvOVj3sHH+q5CFwB78ABlauxuy4SIKhphBkRRRRRER:UfN5OVMPnfxxxIAVkRRRRRER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642374937, "uuid": "600b9987-239d-4f94-903b-0bf2f5ba55aa", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642374937, "uuid": "da553089-0d9c-4bc5-99b2-fac77c7eddb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642374937, "uuid": "ced24ea9-5162-4300-9965-87cd8534d6e2", "value": "FT213075JCQD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cac8bfb-770b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642365068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642365068, "uuid": "19092072-5531-4e24-ab38-efb4600a1cf7", "comment": "Malware payload (RedLineStealer)", "value": "c90c8b21cc3a91d5657404916080575c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642365068, "uuid": "0487fe30-c45d-4a03-9e6e-dbdfe4b00210", "comment": "Malware payload (RedLineStealer)", "value": "d5ebd419722037637eed6c7d9f7f3273b23abf220ccc266e466ee2e4b99d44d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642365068, "uuid": "888e3c76-a181-4cda-bb33-f89603850651", "comment": "Malware payload (RedLineStealer)", "value": "c20f3b8a223c52dd8ff3b9c2b53cbafdc6c3fee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642365068, "uuid": "a5927356-6f3d-439d-889a-089f0673cd08", "comment": "Malware payload (RedLineStealer)", "value": "ae1f0635e530f5c54aa43b4a852d60888f22064edc561c72e71f934ce4e0ed8c340d5af27ee69c5b832df8baeeab38bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642365068, "uuid": "8f33ae40-8860-46d0-83ce-cbb160f30398", "value": "T15FF533986502912CF8D7763CD9282B0795280BFF6866271356EFEBD4E2E35136B0077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642365068, "uuid": "ce201281-f799-401a-b622-a15d368659aa", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642365068, "uuid": "ceab3002-b1c6-46e0-b1e5-c8c65878892f", "value": "98304:bajxGQlLsGNo9ybWtPF/zHQcYqkrsUEijmrl8F:mjPLKmWtt/EcYdH48F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642365068, "uuid": "e4604d0d-1053-4db8-8eb2-7e53fde71cd8", "value": 3595728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642365068, "uuid": "a924fe3a-6eda-410e-be70-343f33c55c06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642365068, "uuid": "d7ad770c-0ea1-406e-ad01-a8c29f3e31e5", "value": "d5ebd419722037637eed6c7d9f7f3273b23abf220ccc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93607e5-767e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642304772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642304772, "uuid": "b4101e75-9a57-4c60-83aa-71fa16b1d3f7", "comment": "Malware payload", "value": "e59f4f391bc0fcd8eabd596b6b018c79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642304772, "uuid": "c8ef641f-c60c-4a8f-bef1-501de9ce4c0f", "comment": "Malware payload", "value": "d5fcd3efc0f7f0c3aa9ff8869fe342fa7532d4d75ca73f7fdd9dc47530050879", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642304772, "uuid": "22e6567a-c1eb-4c9d-9185-e01a5e353072", "comment": "Malware payload", "value": "91c7f0b541cebf229b0dc0102534cc73384a28bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642304772, "uuid": "cef153f9-fc89-4aeb-9f02-c7df3b635d12", "comment": "Malware payload", "value": "ce609d7f6dcae9368ceb31d2db51c5fccaccb020f1dc12f1bca17a4e7bd01a423f55e519e14fb7b5717208f0045ae23e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642304772, "uuid": "6ad49e76-b1e2-49fb-b912-c565698b7a27", "value": "T1EA44B6AE95559C31EFFAA3F191E5CBB3C15B8430235809BFD7FD6072163CA989238582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642304772, "uuid": "479fd418-2f39-4953-8d1e-6b1f812fb7b9", "value": "6144:cNU5LwA22222GgngDrDRVyYli/ci2tEGW78ODm:x5w7YM/cYVVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642304772, "uuid": "e778b745-c90a-41f4-bcca-a35bc6d2f210", "value": 277998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642304772, "uuid": "2d3a1832-c063-46ec-bdd4-6f83dad29503", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642304772, "uuid": "291a5dc5-b9fc-4ac7-b7bc-e0f62d2b9da4", "value": "emotet_exe_e5_d5fcd3efc0f7f0c3aa9ff8869fe342fa7532d4d75ca73f7fdd9dc47530050879_2022-01-16__034608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8005367-7702-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642361490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642361490, "uuid": "ede9a6d9-2e07-4a93-a9c9-cbc0ce7eae89", "comment": "Malware payload (RaccoonStealer)", "value": "f45189e23cb7e39916bcdef2d4fa5a7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642361490, "uuid": "4b8012d7-7423-49eb-a3b3-f002e2a2f5dc", "comment": "Malware payload (RaccoonStealer)", "value": "d65fdc8389357ba633919c9a52c6d6ae0568343676be45e33652ad41d665e935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642361490, "uuid": "922c5469-f049-452b-8623-e5e677fa871d", "comment": "Malware payload (RaccoonStealer)", "value": "0deae82cc14f39ad281ca02d98443aa343df71d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642361490, "uuid": "b54b2990-79b6-4cf0-9616-99c2848c6a3c", "comment": "Malware payload (RaccoonStealer)", "value": "9d2b3053386ce0ac0e307b729653d741d42587c037a77ca0f9047615d3d63a0750a74045eb048b19f98e191767b5174f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642361490, "uuid": "0a66fece-50d3-4584-97cd-7a9995c3121c", "value": "T16054AF00BBA0D035F1B756F44A7A83ACB93E79B15B2590CF52D56AEE16396E0DC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642361490, "uuid": "25893815-773f-4a1a-bec3-9de44f73971e", "value": "80720d283b0420bbcbb388cde3e0df65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642361490, "uuid": "5dd11e4a-c4e3-443b-9fa0-c401e2fe36f0", "value": "6144:k1N7qpiAabwEp8PCV7niAkwBMYFnY5j6cWGQ00PyY8Ar40PSKq+tc:knuiArEp8qJniAkwBMYFnY8cWGQaAU0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642361490, "uuid": "a716e989-90f4-4b41-b1ce-a3a4733fd0db", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642361490, "uuid": "6faa80c0-9d8a-4528-89c8-56c97727a5be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642361490, "uuid": "d5b18e39-b7ac-40b6-b452-38f3e6a7122c", "value": "f45189e23cb7e39916bcdef2d4fa5a7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5d5957-76e1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642346979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346979, "uuid": "b792398e-0f94-4e1a-a7ad-fabfc3636086", "comment": "Malware payload", "value": "5e96c525909c283bba44e7fd53f8c47c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346979, "uuid": "da1b96bc-6d03-44d2-99c5-945dd4881c88", "comment": "Malware payload", "value": "d7fe62b5ee250084d82158990c025d0925a66ece71a7414a75ea4ff1bc128224", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346979, "uuid": "66505a56-4237-4306-85d2-7b4b2631b71c", "comment": "Malware payload", "value": "bbfccd9788e31491ad6d4394686d80fd88ee6302", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642346979, "uuid": "22e35098-35ee-46e0-ad86-022636366802", "comment": "Malware payload", "value": "25ee7331080535d6d4f7c560873ee9a823c63e93682ed6163cacadc3f67a885c9634d5f4651122f205bffdfb5486c814", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346979, "uuid": "c414f7f8-47ac-48cc-b9ec-4d0dc4c9fade", "value": "T121E2E15D90D46DB0C27F0FBAD6AE22A12C24A8E473994BD247414D88C12F802F5EE1FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346979, "uuid": "faea5a79-a75f-4275-8f05-9001cb73db04", "value": "768:WDLiTHtK/LJxyIWPbZLzjRJgG9FwCnxvcCilWRb:WD2MVxUzZvdyG9FXnxvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642346979, "uuid": "92ab3c6f-fc8d-47a7-bb81-0dbc4709f4c4", "value": 33776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642346979, "uuid": "40167a1b-db29-40b0-b4eb-9bd5ce2b49c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642346979, "uuid": "2c38b929-2cbc-4919-ad68-8fc71fada569", "value": "5e96c525909c283bba44e7fd53f8c47c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9501804-76fe-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1642359694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359694, "uuid": "a699205d-8a59-4250-9fea-333cb67b1b36", "comment": "Malware payload (CoinMiner)", "value": "3d2ab2f92f149cde6bc1ef54ddd1311d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359694, "uuid": "c87ae16b-c139-4f08-beb6-b96973541d3f", "comment": "Malware payload (CoinMiner)", "value": "d9ded5efabfdbf4b0741c546225e2cb788cf84100dfe5adc518ae9572a4cde7e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359694, "uuid": "66c46a36-0f9a-4fd3-b39e-c2f3e23b345e", "comment": "Malware payload (CoinMiner)", "value": "bc9f10f0ca4c2e7fedb1d1589549e0a5ce4b34a4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359694, "uuid": "c1bac72d-cff6-4f2c-8faf-d98e9955d5b3", "comment": "Malware payload (CoinMiner)", "value": "65fe28bebe47b4b371bd2540391a516c7f0d3a4e60b7961a635151d03575f5471084f7e40dc52c59884541c4fd345f9d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359694, "uuid": "dc2d928b-a2c5-43e9-951b-c7701f5f38fe", "value": "T10764AF10AB60C035F5B712F84ABA937DB93E3AA2572450CF56D56AEE57346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359694, "uuid": "3af7d206-d2b4-49ce-af32-204d16b91e22", "value": "88fbbbc9398f6f7d5af159298dfad177", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359694, "uuid": "868ec0c2-a0f5-4190-be2a-f49c5c3dfec0", "value": "6144:zLVPTv74HYfssAFZagSlQAsiYkw9rz+83ITX1ko:PhTv7WRZ76XTYTX+1X1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642359694, "uuid": "0cbd4a49-5d28-41c1-a669-3860d963122d", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642359694, "uuid": "892a65b9-a95b-4342-8b55-a8dda9010aa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359694, "uuid": "7cdb6363-1ea7-48ec-97d1-854331360822", "value": "3d2ab2f92f149cde6bc1ef54ddd1311d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f508194f-7707-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642363660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363660, "uuid": "3e9588fa-443a-41e8-9a6b-39e08c4a3992", "comment": "Malware payload (RaccoonStealer)", "value": "0cc3d87ca8e7ef01fe4555f222a738d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363660, "uuid": "c00dc1e2-0efa-4435-8e40-e9baa7398671", "comment": "Malware payload (RaccoonStealer)", "value": "dcd4d107e6a28a6975ac1ffa7769051fd4ec5dc5c75314d426a69a9495208043", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363660, "uuid": "819bb70b-6904-440e-b592-9b447a62b4c9", "comment": "Malware payload (RaccoonStealer)", "value": "c0fc242592754aa84c44c1f260548d844b592af3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363660, "uuid": "d46c0078-f952-499e-bf27-afdcf1bccf52", "comment": "Malware payload (RaccoonStealer)", "value": "dc642d72486cef4ef7bc4ec458dfaef633d9cb4c8112ffd12c8db58e5a65caf1a748fd39d347854eb4e12c4bf0ae16da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363660, "uuid": "0804afeb-39ed-4210-9597-0dfaadef1177", "value": "T16ED4239C8BCA5E67C1A5CE3A8371D0E7577912EBA207CDBD64893F6485FA1DE05BC002", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363660, "uuid": "ea49b070-6230-4fa7-8c82-3b8c25cd8686", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363660, "uuid": "252ed9c3-b1ff-4fa0-b403-075a94553c6e", "value": "12288:bmO7zm7mhKbb/L+XabeQM29pRUBFu78VH5AinaqHj7Qby3zfFkPXF1U9v:bmO7CKhWP+XabN9vIFu78VH5tLDiy3zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642363660, "uuid": "5b59d9b6-8b19-4f75-837d-ee9edc1e4505", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642363660, "uuid": "95703365-c2c6-4fcc-bf6b-570280d7886e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363660, "uuid": "d0acae65-8415-48dd-a96d-cc4eba8564c3", "value": "0cc3d87ca8e7ef01fe4555f222a738d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5b12a4-767c-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1642303729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642303729, "uuid": "15dbc5d9-125c-457d-a0e7-44201c522274", "comment": "Malware payload (DCRat)", "value": "149939efc80bc4dd49378f86b468a379", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642303729, "uuid": "de9d1357-6d0a-408a-9782-1f895f653a09", "comment": "Malware payload (DCRat)", "value": "de0d24df79f99286da0234aa1536470d7596c53e531173d693d6ccc60b98e84c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642303729, "uuid": "94105a32-5e68-4754-8c80-360110b534e7", "comment": "Malware payload (DCRat)", "value": "5a07815b243e635ecc9c71c55bde5119b9fa4116", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642303729, "uuid": "9dac6989-f807-4a92-ab03-0ea941804bfa", "comment": "Malware payload (DCRat)", "value": "654255023d2657ba9ee5cfab5f5e8d23f6d100717d29ba17c7f6226a24b7215d1275c43194327a1c35c173b4ef572a84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642303729, "uuid": "f0406602-cf91-4796-b0a1-bd6f15d3a727", "value": "T144C4F8342EEA5529F17BAF79C5F03596DB7EB5733717960E04A1028A0A23B41DDC0A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642303729, "uuid": "43840e81-3dae-4985-aa06-ec4350300f21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642303729, "uuid": "d5bdf811-6584-46e0-a3e1-30e2a119f362", "value": "12288:ZfNUfRIaDnJqEocrRbv0jFpcuUDbHMi4LNIREepU:ZfNUpHxoARIjFjSSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642303729, "uuid": "4ccd60ed-24f0-4830-82d5-ab3d6247eb21", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642303729, "uuid": "c7feb3e4-eff9-4f3a-be6f-ef9f484829e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642303729, "uuid": "a6a6f815-9414-4aca-92b5-bfd460b02979", "value": "149939efc80bc4dd49378f86b468a379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe26e6c-76fe-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642359571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359571, "uuid": "6e62ea23-c014-4649-9169-0127cf60960c", "comment": "Malware payload (AveMariaRAT)", "value": "905554a3c09555c7538a39fa4c8055c4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359571, "uuid": "c41bf7e6-14f5-42e2-9dbb-155d69365ef6", "comment": "Malware payload (AveMariaRAT)", "value": "df547ed09111fb931cc6ddd280726b3f1cbb889eafaca6e6f465259ccd871e59", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359571, "uuid": "6cb44a42-8023-4531-8813-55f9911205bd", "comment": "Malware payload (AveMariaRAT)", "value": "807d455d93791596ef3e54ee437017d64fedf36e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642359571, "uuid": "63c23a80-0b73-4f91-b4c2-886beacf95b0", "comment": "Malware payload (AveMariaRAT)", "value": "2d944769a52c31ad16ab58ce51ad8c91c2be983e24dfcf3d224777da7d1967eb2731a776965237e6d6328f115ade6bc3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359571, "uuid": "b028099f-0117-47c8-a43b-cf4934779b8a", "value": "T121D3D6A6BD37A050D674B978FCE28F614970DBBC2022B0B959A16FD512F133D0B2FA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359571, "uuid": "6eae337a-fa58-4aea-ad42-9523da903066", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359571, "uuid": "0d1293ff-fa97-462e-9a58-8d8ad575ac30", "value": "768:7u6Q86Pbwe4VFYj6d1boU+6HRTfRlI8GEqYG+MfF:Y86PbwZYIoOTRlAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642359571, "uuid": "77273507-f291-4a88-b7a0-a4457582ddd0", "value": 132996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642359571, "uuid": "af37327e-1264-4308-86bc-3784a0b56b82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642359571, "uuid": "dd39052b-0d8d-4a3b-8918-3d5f5ea99c83", "value": "905554a3c09555c7538a39fa4c8055c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7193001-7668-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642295239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295239, "uuid": "83f1db21-610e-4723-bcd2-2d803f98f6b5", "comment": "Malware payload (Mirai)", "value": "ca82d16acfb5dfd87a99e08f7967b65b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295239, "uuid": "826393c0-a1bb-437b-8ad2-3d3b8786ff51", "comment": "Malware payload (Mirai)", "value": "dfa595e7fd441ff43addbb965541a9a6d53ee856efb9338c37b259275cb39774", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295239, "uuid": "7521c71c-017a-4989-a340-b2b20acc27f9", "comment": "Malware payload (Mirai)", "value": "9001362990ab9fd9d42926207c57e1920e38d79f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642295239, "uuid": "82e4736d-1acf-4a10-850c-c469e1111bd3", "comment": "Malware payload (Mirai)", "value": "c9caec5606cd23d3d268841b6ff16da9a9885bda3104aad380bc788ded02370be1344fa683a89b7a4028427cd6e43106", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295239, "uuid": "5a88b89d-4db4-46e3-ac48-62ee13967791", "value": "T1DC238EB3E02DADC8C54842B97A384D3D5733E501D2231EF7679AC6A59007EACF51A3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295239, "uuid": "1afca821-ce7c-4ac5-a69b-03545c63af80", "value": "768:vQal/hgiHqCgVU5Tsvq4uNhe68yzt2Tq0xMinCjo7rI3BCXa:vQal/RHywx4uNh/2SoL7qBCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642295239, "uuid": "7404a54d-dcce-40de-bad0-b30662bf78da", "value": 47136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642295239, "uuid": "2a0651b0-6a43-4135-b52d-6d6af4228b1c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642295239, "uuid": "7a8985b9-f250-48ba-963f-e86400414240", "value": "ca82d16acfb5dfd87a99e08f7967b65b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194ea720-76a1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642319482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319482, "uuid": "7fe8bc09-faba-49df-bc3b-7be9cc046d7c", "comment": "Malware payload (RedLineStealer)", "value": "f2e62d29c572883965d33a0b0375dfc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319482, "uuid": "17320265-a1f8-44d8-a982-fe3e552f6516", "comment": "Malware payload (RedLineStealer)", "value": "e25d95968d86bd491dadb93ab387142b436770074b879f7adbb860188f8592e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319482, "uuid": "c50940b1-a651-4795-88f2-afb3593db9f4", "comment": "Malware payload (RedLineStealer)", "value": "f70b37d95df7047aaec956159e8f4d4167daeee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319482, "uuid": "3de58473-008f-4c6f-82b4-318555f598ec", "comment": "Malware payload (RedLineStealer)", "value": "613361793c3f1bc0c078965c03f11606ec5ea51b431a0cdbb1176a7cc0a1d69388f52d4ad9bafb92ee9144ff62c62cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319482, "uuid": "1664daf2-c57a-4e2b-a1fa-921c363d190e", "value": "T1D564AF10BFA0C039F5B752F84AB6936DF92D3EA1572490CB62D529EE56346E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319482, "uuid": "300f58be-7b2c-405a-8ec6-7254d49ff9e4", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319482, "uuid": "0e002d08-9543-441e-9bb8-f3ee1d4d5026", "value": "6144:1GsPr7tBoMSrQ2BayEfhUbk5se1GcOfQCHDmnWAb:QsPrXZ2Bwpqk5se1GcPCHDlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642319482, "uuid": "ed54ed49-95d3-41cb-9425-4045ea11b7a8", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642319482, "uuid": "d5c0c8ed-37a5-438c-801e-ac7fc397ba3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319482, "uuid": "963ace60-6a67-4c53-aedc-2191504cf05f", "value": "f2e62d29c572883965d33a0b0375dfc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4763e828-76a4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642320848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320848, "uuid": "28ed6ae6-5f9f-4e5d-ba79-9311ef9cda31", "comment": "Malware payload", "value": "978b7f1dba9746c29ac4b61bc219bd7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320848, "uuid": "c27b2ac8-e443-4cd6-b110-5f98102843f7", "comment": "Malware payload", "value": "e36e717ad1f661f695e905d457dba6729aa238c0da051893ebec1429e042ddf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320848, "uuid": "e5b8bc0d-7aa8-4bd3-8fad-d17811e15ce2", "comment": "Malware payload", "value": "f498e5ebf211bace3e027a1596edfdcf7900317c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642320848, "uuid": "b7394511-bcde-4618-be9c-586a8549b01f", "comment": "Malware payload", "value": "9fc68066e69b9b37bf26a79ef127d730a76d33f849b8834465851e6c5094950c91eeae7afe261618680fec9cabd97ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320848, "uuid": "a9c7df5a-3ebd-4a66-8e4e-d0b37b6348d9", "value": "T144F5330D09E85E68C68FD9B594B9945102D0687F8C52A4E86FCB844D732C63DDBCEBEC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320848, "uuid": "49c9b15d-f47d-4e97-9b64-c2994c37b8ea", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320848, "uuid": "691a4a19-16ba-4e3b-bde9-e4295c1e9c5b", "value": "98304:P911lVWeyp3lEqoNi6ANcHMIg4yMfOvC2ui:PFlVWeyp3l+U6x/gVFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642320848, "uuid": "aadcb698-985d-4211-a68b-bca59f903a21", "value": 3385344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642320848, "uuid": "e3ef665f-61b8-4b11-b01a-213292e763c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642320848, "uuid": "5432551a-dbf5-4f08-a838-be227c0d8d01", "value": "978b7f1dba9746c29ac4b61bc219bd7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cb9f78-76cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642337614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337614, "uuid": "a9c038b0-1d04-44ef-bb0a-38a876eb977f", "comment": "Malware payload (Smoke Loader)", "value": "e61b1d89735bc27175e9c7c6dc2be36c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337614, "uuid": "e702ae8a-ef44-4d24-871b-5026e77d6ca1", "comment": "Malware payload (Smoke Loader)", "value": "e397dc721542e4edcb2453699c782558e9ce7855b1993889cbe2885660935625", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337614, "uuid": "e4b4b716-1a9d-4067-8db8-68ee25cc150f", "comment": "Malware payload (Smoke Loader)", "value": "f2689277493930feebd5db9d2fe4a99a3320fd05", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337614, "uuid": "caba313c-553a-4a3a-b4ae-7c03c6218675", "comment": "Malware payload (Smoke Loader)", "value": "9f11e825e2a86d2b1c0f99d360769ed2551e63ae0098b7865e4e6eff24acb172b9327feebee14e7590d9b085c53af76e", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337614, "uuid": "e78c2c47-de60-42f0-8cda-c8f53494ac10", "value": "T14164AE10BBA0C439F5F752F44AB5936CB93E3AA1572481CB12E51AEE56386E0FC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337614, "uuid": "86f0685c-fd95-4f47-ba98-835f9bca5356", "value": "e35f8b1f81e9ff2dab196a397d763305", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337614, "uuid": "37e77ad9-7ad5-49db-a8af-3aa1463434e3", "value": "6144:7Ux2gD80+MZ0nRafanE7jzh5hsaAjjFaUdiAU68n:7Us9HufvX15cj0UdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642337614, "uuid": "98493330-df32-4b47-8383-669b604bb111", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642337614, "uuid": "cb6e4df1-a29a-471f-85f2-0b461913e51b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337614, "uuid": "f3adf08f-6239-4779-888d-e1dccd6385af", "value": "e61b1d89735bc27175e9c7c6dc2be36c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f5e779-76cb-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1642337818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337818, "uuid": "2f0dba07-88e0-4d35-a88c-514ac2336f6f", "comment": "Malware payload (AsyncRAT)", "value": "a8205eb2fa0010d8f6789e0fc8480c7a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337818, "uuid": "aeb22b96-b12c-4f3d-bfec-b73ea64bb8b9", "comment": "Malware payload (AsyncRAT)", "value": "e5f9a8cee6a1efef515db6dd09c7993617f097374c0f323228dd24a55b317389", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337818, "uuid": "30f4b444-2def-46fc-800c-d05e8232bb4d", "comment": "Malware payload (AsyncRAT)", "value": "a89ea163bfbb27fa0d10a6562f1c1601562c06a4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642337818, "uuid": "074a2d3e-6ab2-40bd-aced-a12cf6e4bd2d", "comment": "Malware payload (AsyncRAT)", "value": "033e26d6d888ca647b1dd7ea34b14e8483d75f3a027c779c97270f27ccbc850851ae614b5091fd450d1f39678d83faff", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337818, "uuid": "3e943bfe-c7f8-4d66-8006-38f6f041fec4", "value": "T1B7C4F101BEC195B2D9721D325968AB21643D7D201F38DFEBA3D06A5ED9310D1EB30BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337818, "uuid": "a7cd1943-cf11-414e-a1d1-deeda7293cee", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337818, "uuid": "24b26461-6f64-4911-be1e-416f2c424bbb", "value": "12288:IzxzTDWikLSb4NS7t2X+t40XfMddrlWHLgDrC5be:+DWHSb4Nc0i6rl0kPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642337818, "uuid": "3d34438e-3bd1-4d75-9b2b-00175547608c", "value": 573735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642337818, "uuid": "a9c91e9e-3da4-480c-821b-1129fd7cd39e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642337818, "uuid": "7596b57d-745c-4338-b99d-bffdf81468de", "value": "a8205eb2fa0010d8f6789e0fc8480c7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925d4f02-76ce-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642339013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642339013, "uuid": "10135b9b-143c-4b7e-8274-54ec8d4c22ca", "comment": "Malware payload (RedLineStealer)", "value": "23f04e6c5d482be8eb12ed4b8f42e466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642339013, "uuid": "0b66189b-bc70-409b-a98f-edefd5138b99", "comment": "Malware payload (RedLineStealer)", "value": "e60afd1bed6886d27bb07b56c20d079deed3b002f598a58276ecf7739c250034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642339013, "uuid": "878b0814-98d6-43a7-84a9-f1367f72b8b3", "comment": "Malware payload (RedLineStealer)", "value": "3cc41625728cd5fe0540efa093355ba4b4899d88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642339013, "uuid": "a1c45929-1e4e-45b3-a363-973fcc7f928e", "comment": "Malware payload (RedLineStealer)", "value": "7201eb3778075f95c1550f06fd46b330c60503a63782a6149cb29b8530d1832345fd1660a84fda7cedc5d7a9fb6ea4fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642339013, "uuid": "5d398db2-97c0-425c-bb64-bc79d81f6e1d", "value": "T19EF5336CA55B1341FC524AF83C8D3B4AB5CDAC2C27AF362F1AB02D1D64B8A678458735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642339013, "uuid": "c21a2322-181d-415e-b511-643688a774a4", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642339013, "uuid": "67e05587-028d-4902-a9b6-765826bd3a80", "value": "98304:Ov2QXf5zf+kc2byMVx5Y4f+tmK+mv5+8Jwjp:jIzL+Mb5HWEK+mv5JOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642339013, "uuid": "8086f63d-b600-4e55-8200-e634a5c7a727", "value": 3589632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642339013, "uuid": "ad3a77aa-50a2-4155-b78f-31f36be67ec9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642339013, "uuid": "839643cf-b1ad-468f-aa95-0e564b96de93", "value": "e60afd1bed6886d27bb07b56c20d079deed3b002f598a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28788489-76a1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642319508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319508, "uuid": "b3176e74-103d-45b0-b3af-290a9db8ca4e", "comment": "Malware payload (RedLineStealer)", "value": "a6cfb10c2d19aedfd94c7ebe64af00d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319508, "uuid": "7727bace-8ad6-4930-9186-62114663987b", "comment": "Malware payload (RedLineStealer)", "value": "e616d1a92bc5df7b90a71d524de68db2bffb1e5a59d7dfa273ed7f2b68611852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319508, "uuid": "30b05f94-f8e9-4532-98bb-7e6cfb38a1b6", "comment": "Malware payload (RedLineStealer)", "value": "9fa9b28e838755df366aa41458b5f60945c1aae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319508, "uuid": "4a57619f-0e23-4d38-84b9-f7eb0d899cb0", "comment": "Malware payload (RedLineStealer)", "value": "8427e2b32336f7836b22bc7d712ed9508336593396b923d7afb53535ea693beded3a305d4903cb9bb9a2d0142413cf90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319508, "uuid": "361ac078-e1f1-4484-a5e4-139adf7345d3", "value": "T10C649E10BB50C435F5B712F85A7A936CB93E3EA1573490CB62D46AEE5A346E1EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319508, "uuid": "ee503aaf-6241-45e9-aac8-8b896e729927", "value": "dad17b3eb5a4845e196a965a8c5a55db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319508, "uuid": "429c9b24-68a9-4c8e-9b5e-370da6aa3cf9", "value": "6144:TMooACaMjh+bX6mr1stPaTTo7OzFwkTsoKqEHiP:goCB0r6mr1sETo7O5Zsox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642319508, "uuid": "f553bdfa-e3a8-4a78-8f16-33a4f7be508d", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642319508, "uuid": "7c13a1ec-6e43-42ae-8264-c8ec836a2ed7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319508, "uuid": "4ea9c019-b580-4ef8-9499-e3350a1a7925", "value": "a6cfb10c2d19aedfd94c7ebe64af00d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b3f376-7661-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642292171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642292171, "uuid": "e1380b39-cede-4b45-aaf6-b3b0fcc5e097", "comment": "Malware payload (RaccoonStealer)", "value": "af343ce3956d9bab49c791eb72b3bed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642292171, "uuid": "d2ca5ca0-cc32-4918-9792-3283a753cca2", "comment": "Malware payload (RaccoonStealer)", "value": "e8a5ee3ea1aa198e6187b3adf18c307ce27830e827f797dd7dc1435333672c0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642292171, "uuid": "200d13e5-cf23-424f-9ff9-3641a333c27b", "comment": "Malware payload (RaccoonStealer)", "value": "8e2ac3193c2764178d26ff68333dfb552867b361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642292171, "uuid": "869795bc-c5fe-4268-8d3a-bc89842598ff", "comment": "Malware payload (RaccoonStealer)", "value": "adbf8d251e553ef6b3030866b96b33e7546db4222af7c74656152438b6ab8c997b42ce8f54bec0c251e16160d29f52ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642292171, "uuid": "ff8fb2ee-653f-4ea0-ba9d-8b1dd45eec6b", "value": "T17CD4DF10B6A0C039F1B212F8457A936CB53EBEE26B2491CB53D56BED56346E0ED3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642292171, "uuid": "60884c1a-967a-450c-906a-4c965001bdaa", "value": "a6d0c9bcb4950ea77f22a5d095ec79c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642292171, "uuid": "3437d1a3-9e2b-48b2-857a-20d8516847cc", "value": "12288:BdghG3ZY+Va4kH48zHlPBvw7HULSr0Iqv4Nz3j4IaV:BbZY+c4K4KP60LiQ4Nzz4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642292171, "uuid": "2321333a-3574-4b77-87c0-47593eef8ed4", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642292171, "uuid": "8a4910f9-8b95-4f37-add2-817f555a56dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642292171, "uuid": "52c0328a-d5e4-4b54-814c-e917f41be252", "value": "af343ce3956d9bab49c791eb72b3bed1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baea4681-76e7-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1642349818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642349818, "uuid": "5a88359d-4e62-4a4b-abc9-d2a34bd04a1a", "comment": "Malware payload (QuasarRAT)", "value": "ab666f3fa3ca9ef8b338cbe631923b5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642349818, "uuid": "e05c2570-16c1-4c00-a6ff-e193c5da1bf2", "comment": "Malware payload (QuasarRAT)", "value": "ed246e895a4d39d6bacc778df9eca4a5dbbbd7ad5f031b87eebbe4e6c4db4022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642349818, "uuid": "2ebf78d4-1786-4ed3-9752-54ea5f6dcee1", "comment": "Malware payload (QuasarRAT)", "value": "b6d88091172c8dfd7ea206d9bca816b957730659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642349818, "uuid": "cfa30e01-a0d6-449d-87a5-44c0debf1af4", "comment": "Malware payload (QuasarRAT)", "value": "c020271195c9e581084d56346f732034618bc8b61af676e79ab487c94dec75215820b5ebaa3af0b8922b4859e39a8f46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642349818, "uuid": "d4c1af08-f796-4a00-9a4c-ee43e73e6a30", "value": "T125B45B8123FCC52BE1AE57BDE8B11421ABF4F407A667EB4F4940A2E92C567429D407F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642349818, "uuid": "abd01d7c-fde8-4cd2-98e7-9678e629c291", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642349818, "uuid": "d15a69ff-97ab-4865-9f6d-37324b8a2e84", "value": "6144:MTEgdc0Y6ebGbXOsA6j1RdhtnNlRmxZYLR5EtqB+yw4GUcEkOb8F9r8UuRmcTR3L:MTEgdfYQA6ZNDjw4EywQ0pRXomcdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642349818, "uuid": "5f929582-9c0e-4b60-aa80-7fe5c0eca9e8", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642349818, "uuid": "4db776e6-3ee4-4f58-b2be-afbf60bcc130", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642349818, "uuid": "68b6801c-757d-49bd-9248-e66dca7b749e", "value": "ab666f3fa3ca9ef8b338cbe631923b5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70d218f-769f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642318861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318861, "uuid": "fadda31e-1f27-4b6c-a4d8-a819615f08c3", "comment": "Malware payload (RedLineStealer)", "value": "a6c4829fac2841a9c83391a4275c3901", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318861, "uuid": "589eda2e-81d7-447f-be55-aeb514713b37", "comment": "Malware payload (RedLineStealer)", "value": "ee907caabbeb9840e89ba0a214d4e652a336c882a06d6e93af878fa018275e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318861, "uuid": "0b9b8ee2-8b9e-47e9-b0b8-3875365ec866", "comment": "Malware payload (RedLineStealer)", "value": "817f3436f0c83223e9231bd1a69e0dd74ea0bfd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642318861, "uuid": "748d792a-8557-440c-ab88-ee91ab2b0b91", "comment": "Malware payload (RedLineStealer)", "value": "3e4ffd2f62bc8ac5b3a6aa61ab3d57c7c645463fbc519583ae54dc762a00f6391ca0dab94916d0dabe5bfad6f4a8ac48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318861, "uuid": "fbfc5a9f-7816-41e9-902a-e9c7e456a027", "value": "T145649E10BB90C435F1B751F84AB6937CB63E3AA1573490CB62D52AEE56386E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318861, "uuid": "314421ac-7a51-450e-8b9d-4d88783feb8e", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318861, "uuid": "b13a903d-188f-4c7f-ad0f-ef0abc54cc65", "value": "6144:nrwDtsahCAUtphX4wsDo3Btp8NGDDo8jaFy:rKsnAC3X4wsDKtpSG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642318861, "uuid": "9ccdb0bc-a203-40ae-817c-127018fc5ada", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642318861, "uuid": "3093d675-98ff-4ec2-be56-365108ee1b38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642318861, "uuid": "bf976d0c-3760-4125-b75b-5fa427507ddb", "value": "a6c4829fac2841a9c83391a4275c3901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b710d96-76a1-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642319459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319459, "uuid": "d75a3852-8deb-42c1-b673-68766cb8ce8a", "comment": "Malware payload (RaccoonStealer)", "value": "c12650a51b23065d8f39ac845ea857c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319459, "uuid": "cf79e1b6-e4b9-47b4-8ba6-d1aec812c5de", "comment": "Malware payload (RaccoonStealer)", "value": "efb3c09ce6bc18c1f2f1b1d3f1a01208ad5519dd85a8976ffbe1cddbe322eb65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319459, "uuid": "fd490fa7-186c-4170-bf9e-eedb4281ec0c", "comment": "Malware payload (RaccoonStealer)", "value": "6f701d1ff2648f37ec7b7ba3a0058d83f602c014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642319459, "uuid": "d4dfdb9d-0e16-457d-909a-c7b7e7ba7e7a", "comment": "Malware payload (RaccoonStealer)", "value": "f3ded8cd687cb11d2ed5159769f67a8ef26677b10acdf936937a44c6eceff2ad73edad1b88927db2d8f12304686c9a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319459, "uuid": "029f2bf4-8ecf-4f90-ae02-95f3daf9b2d5", "value": "T19564AE10BB60C039F5B322F84AB6936DB52D7EA1572494CB53D52AEE46386F0EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319459, "uuid": "6de7a627-da73-4fe4-8e4e-9be0f18b50f1", "value": "ff3e4cda8b895030c8a915a582759da2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319459, "uuid": "a85a3d45-93dd-4956-9f27-2fcea77fb2e6", "value": "6144:ad4U75NDEQKcM/uaFlap95vgCJ2xcOGSq9CvZuX5:+tF6QAuYoLvgCJ2xc/9CvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642319459, "uuid": "2c61ae97-5adc-471b-9d54-2ad13157a6b2", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642319459, "uuid": "d2fe4788-d70a-4396-a794-53a0262fc6d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642319459, "uuid": "711e9e0c-924d-4b62-b744-1355b9f749b9", "value": "c12650a51b23065d8f39ac845ea857c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bc9072-76ee-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642352546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642352546, "uuid": "33deaa17-a0a0-4d50-b3ba-0c1a393da9d9", "comment": "Malware payload", "value": "45ce2200b14445ebd519d88d2b314760", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642352546, "uuid": "e00e6fd9-9e09-4702-a276-2c1cdfe04634", "comment": "Malware payload", "value": "f0abd35da5a0d94d3411a2ffa57f424e9a4feec6cc4ba290161e868e081c7008", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642352546, "uuid": "b6b9b071-86c4-4331-80bd-3b43ba881ee3", "comment": "Malware payload", "value": "5c06a2354039964786365f6094c0472c42800dac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642352546, "uuid": "e701b7e7-dc72-4e11-9211-dc17f868307f", "comment": "Malware payload", "value": "f4382197e0379504d2522c250582378f441df673a54851ccb56caa92654af79696fc7cf0c88158a6fbc95425dbb4e3c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642352546, "uuid": "c2395119-67e5-47d3-bf77-ef92974397ea", "value": "T1F4544B0027EC8B9AF2FE8BB8D4B01165C3B1B466F83EDB4E5D4465DE2922740D945BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642352546, "uuid": "0164ef06-2eb8-4738-b7e9-bc8fff975e47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642352546, "uuid": "341012e1-2ab1-453b-807d-53a6ba0066cd", "value": "6144:Yuf+BLtABPD9E2iPAcNU8Y91A/ylYeJmlA1D0Tcy:YYEly8Y91AalYeZ1D9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642352546, "uuid": "bc41a9d0-2105-4436-9d95-dfc41c9548e4", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642352546, "uuid": "9aa950a7-f152-4308-ac80-5d9312b29e6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642352546, "uuid": "c7bd9c26-4e6f-41a2-a532-1b324ed59423", "value": "45ce2200b14445ebd519d88d2b314760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978e36ab-771d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642372952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372952, "uuid": "89473c7d-7a4e-4045-8c57-5e4a785b4484", "comment": "Malware payload (Mirai)", "value": "ecf10b4d946784afd0bf372a1a5c0e10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372952, "uuid": "55ebbc1f-3a9f-498c-bad3-a030c07232aa", "comment": "Malware payload (Mirai)", "value": "f2a4d8f09b81227fbb15260fe8ef2f3a97b1874ad561f97440ea2651c4f05cda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372952, "uuid": "5e217f96-b580-4ada-9485-818889e24769", "comment": "Malware payload (Mirai)", "value": "d904fafbbcc97255ea6078408a3cc1d26e9075f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642372952, "uuid": "35dabaaa-fbf8-4197-ad11-20f529cac9e3", "comment": "Malware payload (Mirai)", "value": "8d2eea64a3563b923d61e0446c0238adc75d86073668bf6811467294705504e5639ec31ec9381fcf2295588fa2c327a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372952, "uuid": "925a5eb9-7973-4ce4-afb1-b4e33d385143", "value": "T112B2D119C0AA6E70FDEB7D745941E2817FA19BDF7E62CEC016C15B110222D681F9CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372952, "uuid": "b64ddb54-da60-4d55-8644-7ee83cc35d44", "value": "384:EA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoteuM4uVcqgw05Vx2:KApCdvwJr69VJoA8FZtxCo8ay4uVcqg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642372952, "uuid": "02e65792-069d-46db-97ed-06d37155ff00", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642372952, "uuid": "2a76a8b6-f1dc-4ea8-88cb-d6b84c28bb02", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642372952, "uuid": "bd93fb83-36be-4cfc-8c3c-4bb1921a54e6", "value": "ecf10b4d946784afd0bf372a1a5c0e10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982e8224-76db-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642344606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344606, "uuid": "9e456c1c-49e1-4024-868c-0e773a14e3f4", "comment": "Malware payload", "value": "85a5fa3e0918fcbfa9cceeb65d244e19", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344606, "uuid": "a79d696d-d37c-4ca6-84b9-4d5edb4d4b63", "comment": "Malware payload", "value": "f7086a5c04503be74268acd9d4afd554a2d12f3be14d223d9a1fa2677704a04b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344606, "uuid": "d9dca982-4806-4f35-9ace-718975093f7c", "comment": "Malware payload", "value": "2da81b4b1ee1c7015c80aee1467a5bcc42614bc4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344606, "uuid": "f17d85d6-a29b-436f-9752-d5bd32666457", "comment": "Malware payload", "value": "4e4d63810f141082aad73ca5a99175d9b1d922cbbfb0d45cbfc67856f40cf2be3044151e6d1b2eaaf9ab81f6fb9814f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344606, "uuid": "40be21cd-e83e-4d29-81f4-5b346dc2d87f", "value": "T123E2D032E70368F3E5F10DF73AAAC208229675BCBD4375BBA8195378E4D30115E7598A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344606, "uuid": "d2b60de0-3c9b-4d19-b73d-22f842876382", "value": "768:8QCEJ3Eda5gR/GVbBxkIsWdR9tZ8q1IvmRewPdkBOauz6x3US:8QCGEE5EsbD9LfInodkBOauz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642344606, "uuid": "df9cd15a-30a5-4d4a-9df3-71455be2c60e", "value": 31760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642344606, "uuid": "1cfbbdf3-40a1-4c64-b8f8-428f215ff759", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344606, "uuid": "be272ca6-c4e4-48b2-b1cb-be27e2b981ba", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2309c067-76db-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642344409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344409, "uuid": "592a9554-0be8-4d77-bde8-c7089dc044dc", "comment": "Malware payload", "value": "4d75dea49f6bd60f725fae9c28cd0960", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344409, "uuid": "7604ab37-5c69-414e-9a1d-da9014755b3a", "comment": "Malware payload", "value": "f780f1b37685e902aa4910e5a6d62c7a209f002f88c83598b30ca804f5f4e1f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344409, "uuid": "bc0acd6e-e686-42eb-bd1f-ddd01a3e733e", "comment": "Malware payload", "value": "39875c55b440554253b32d581e1c1e01bd50eb90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642344409, "uuid": "80302e11-5d9b-449b-9206-64750f611f6f", "comment": "Malware payload", "value": "689d949d9b224ff67ad86031a74130e3ba88df0a79ab288c01f0030426caed1c5a8099bfe56f7f15b8f8318dfa2c77c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344409, "uuid": "326f05b0-1b63-433c-93e8-7731f9695dae", "value": "T1D4649D10A7A0C035F5B712F856B6936CB93E3AA16B2452CF52D52AEE47346E0FC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344409, "uuid": "0f7d5981-4473-41f2-8ac2-64b2e40df378", "value": "e35f8b1f81e9ff2dab196a397d763305", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344409, "uuid": "83f13088-b239-4ecf-b926-88938d527e6f", "value": "6144:XBdBtcbjt2FLgBtuHaHNLqAkAgM65n7udwB3NJi:XBrtclmLbHuWxAen6wBdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642344409, "uuid": "f00d4cfe-4805-4258-aa2d-2910fca40cc8", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642344409, "uuid": "ecdabd0d-bd04-4f71-bb5d-58444096987a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642344409, "uuid": "dde403e3-f4c7-4888-8bd1-5dc5f7164b7c", "value": "4d75dea49f6bd60f725fae9c28cd0960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9f5c10-7708-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1642364077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364077, "uuid": "ffb61651-398d-4b6f-a169-81932246a605", "comment": "Malware payload (Amadey)", "value": "577c591dfacfdbb0cbc36e610c9d3b7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364077, "uuid": "307e6678-ce0e-49c2-8c14-86df16175f93", "comment": "Malware payload (Amadey)", "value": "f852bd483136d30e4355cdb9a4e671261df58f9f141e8d7fa77896ae512137c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364077, "uuid": "d1720ed0-8cfe-4928-9936-9e5c69f64949", "comment": "Malware payload (Amadey)", "value": "aafc6201615de3b37190a79b34b7e1b22acdc793", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642364077, "uuid": "33e10285-52c7-4aea-a1f8-1e2583841d12", "comment": "Malware payload (Amadey)", "value": "167878133438679611830d256983f87e05069ff9e3d52aa363d98d964b28640ad91ad2da58f27eb8f04d6d6cedfb8d2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364077, "uuid": "2fed15ce-511c-4bda-93d4-6bcf3e75dbaf", "value": "T11864BF10BAA0C035F1B756F4497AD7BCB52E7AB1172094CF62D42AEE16396E4DC3072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364077, "uuid": "52a9fb84-cc6e-4381-8fd5-b23e68396de5", "value": "80720d283b0420bbcbb388cde3e0df65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364077, "uuid": "b8c4d4a6-5828-4d57-b076-cbb517e9cb0e", "value": "6144:8d8Q3uzCAaiS5C2vlSucGTlYHbxi9htOsxDQH5m7YtGNl:8mQYCASkklSqT0bxWr0ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642364077, "uuid": "61510fac-d8d3-4dd2-82dc-f35f650b577b", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642364077, "uuid": "dbf47e53-46d6-4f05-b482-9c579d281d88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642364077, "uuid": "66328650-d730-42c0-ad64-cb4068d5905c", "value": "577c591dfacfdbb0cbc36e610c9d3b7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ee3f26-7707-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642363629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363629, "uuid": "79d2c98a-4435-48ce-827d-f4c819aef51b", "comment": "Malware payload (Mirai)", "value": "7d7e5933c6e6760bf22bd93551b5972d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363629, "uuid": "adfe1b89-3347-4af8-85fd-b4240cf6301e", "comment": "Malware payload (Mirai)", "value": "f9eaff2421319219e23e97d0189a3d4665fe0acf08c9cc42d6ad655021bdf363", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363629, "uuid": "5b27a349-404d-47cc-987f-68f5acb5f6d4", "comment": "Malware payload (Mirai)", "value": "c1d0758e9c21f6dbbdbfe8581c53d0a6183a6144", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363629, "uuid": "20b6a91d-a6e0-4185-b679-5851044a3a17", "comment": "Malware payload (Mirai)", "value": "c6442269981e20da0103c36abac6c0c1fbf163bdfee635a39a6084efabbaf7c513b18fbd029d907798c5594294955edc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363629, "uuid": "ff82666c-040d-4702-af39-8bca225c1e46", "value": "T173831846BD819F01D5C912BAFE2E118E332317ACE2DEB2139D149B2077CB92B0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363629, "uuid": "294fbb70-f69e-45a2-84c3-d8c4e6a730de", "value": "1536:uxnEbHoP7wIKhZA/3XCEMPN4bHIar64bXMTirlYX8DxX/5lYM:/IURk04boaNlYX8DxX/Xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642363629, "uuid": "b8e8f014-bb61-4aa7-b26b-46bb584f6940", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642363629, "uuid": "773f1a67-673e-4a46-b76a-51e3b6fe6cf1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363629, "uuid": "f8219dc6-e237-4850-81a4-999af0e00ca4", "value": "7d7e5933c6e6760bf22bd93551b5972d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc46eb2-7707-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642363644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363644, "uuid": "92200a8a-0a81-4849-b072-3eddc754823d", "comment": "Malware payload (Mirai)", "value": "bb44fbfbfbce1912220b71e889e6e995", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363644, "uuid": "dfb6cee4-4dcd-49a4-9db8-5ec9777403b4", "comment": "Malware payload (Mirai)", "value": "fa99f58d21ee9dc1046836dbc6f1038ddc0e8e9881a4288baa13c24e830cd802", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363644, "uuid": "465b4194-f5a1-4bba-aea0-60392ab903f7", "comment": "Malware payload (Mirai)", "value": "b4fca3fda91ea1afffb913969416285391dd1cbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642363644, "uuid": "b93026fa-a4d9-4357-a4d7-006bef63ea97", "comment": "Malware payload (Mirai)", "value": "2b35c595a5b656bd34084aaf40878bcd5df7b551115b6f1f90a200d4d3da0831fe7a694f9a47b4bc31ed4e383f71b98c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363644, "uuid": "ccdbc484-7961-4ad4-bdfd-16ffcbed77fe", "value": "T183733BAAB400DEBDF94ADAB78167490AF530B3814B930F336327FD937D620A54917D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363644, "uuid": "fd80430c-5256-4abf-b928-d849d47bbec6", "value": "1536:hTiDjbZHPIkV0VbgoTE5g+rsagF4kr8TCLTU4qgqe4OKG/61XEEGR:hTigTlTE5g+Xg4kz3LX4BWEGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642363644, "uuid": "afdf6aee-5522-4614-b77a-83bd0bb40e46", "value": 75084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642363644, "uuid": "be2af9ce-b307-4b57-b628-ed36a9e37ba9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642363644, "uuid": "d9c1b828-e1da-4bf1-ace1-021a154c03f9", "value": "bb44fbfbfbce1912220b71e889e6e995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81de870-76fc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642358860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358860, "uuid": "6d5fedc9-ac3f-4a60-874f-a216fb5ec395", "comment": "Malware payload (RedLineStealer)", "value": "d72ed9e0d93807f8d9bb9d0ec2fb6886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358860, "uuid": "3297a6a0-cd52-484a-8e4f-cf1409e4cb2a", "comment": "Malware payload (RedLineStealer)", "value": "fd55e0e52033ba78112d67d8b42c914316b019c73a87e5257ea22fde719afec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358860, "uuid": "48db11bd-0d24-4f92-b8c6-209a0522defa", "comment": "Malware payload (RedLineStealer)", "value": "b4185641ca737ce9eb45ef4fdc2e7f1b74d78c07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642358860, "uuid": "91588dce-123c-4140-b209-deea21afc94e", "comment": "Malware payload (RedLineStealer)", "value": "e1606cc5e3a513f0ef41a271809a246ea8f0787ca2acdd2ee41de70debfc52aecbb5c1855d116ddddcbdd180bc028f30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358860, "uuid": "2ce7468a-d26a-41c2-a64b-53bd4e98a783", "value": "T1DE849FCF5D92AF7ACA8C01737AE60B8DEB7E540230E27B5CCB57167A199637305608C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358860, "uuid": "28732f0c-2580-46db-b5fc-2bb74136d836", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358860, "uuid": "fdf46c15-8ddc-4cf6-9a27-30137d036aa6", "value": "6144:4jDVuvzNHAXStVLgYbZP24ec4zufet3Agp0q9ygbX+1RzDU8:oVqzuCcUx24N9saMJcR/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642358860, "uuid": "ac89b873-4cb8-4d32-b512-ef19a678076b", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642358860, "uuid": "b729c58b-3a6c-4d58-8c4a-a60793cdda7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642358860, "uuid": "3ede710f-063c-417d-99dc-b029a9612a59", "value": "d72ed9e0d93807f8d9bb9d0ec2fb6886.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b792778f-76cd-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642338646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642338646, "uuid": "c64111fc-4b33-44f3-bbcc-f6c62df6d290", "comment": "Malware payload (RaccoonStealer)", "value": "2cb2a55af83803b57caa53a21dec20b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642338646, "uuid": "e078605d-0789-4b09-89f2-0ac4975d62ce", "comment": "Malware payload (RaccoonStealer)", "value": "ffbd7362a9f5f0b564bdff0a2efbcc3ced81e324cd8403efcc87ef83d4c72abb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642338646, "uuid": "0daf423b-3d07-4a6d-b03a-6498ce7794e7", "comment": "Malware payload (RaccoonStealer)", "value": "249bed77c1349be7ec1fc182afccb1234adfacdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642338646, "uuid": "74b0e431-62f2-4789-b645-efca9cf347dc", "comment": "Malware payload (RaccoonStealer)", "value": "a807c6bf44fa15f7de3b1112d045be819a37b8376b099321a91638de041627544470c159f368837fd14db5908a8f06ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642338646, "uuid": "0e2d38b9-924b-4d23-b86e-646c3df556f6", "value": "T17E649F10BB90D035F5B756F84ABA937CB92E7AA1572450CF13D92AE90738AE1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642338646, "uuid": "c8b3b8af-bcc7-4841-a5c7-dbf9dc1edc59", "value": "15bd0dcd9a3dc65b1ed9be7a73f9a4e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642338646, "uuid": "a9d83bc0-b08c-480a-bed8-f3c4cb61a733", "value": "6144:jiS1PsxWxafJLELagOE7LPrPOoE0pjx67VBZQYF:jiYExWxqoegLPCoEQdEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642338646, "uuid": "2b601dd3-778a-4b14-9d02-eccfe4b7aa7c", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642338646, "uuid": "263b3d41-8c9e-473e-a095-96de01debf53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642338646, "uuid": "80240bce-e4ce-4973-84b6-480fdb3f34ba", "value": "2cb2a55af83803b57caa53a21dec20b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }