{ "Event": { "published": true, "date": "2022-09-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-09-09", "timestamp": 1662768181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3930b3ea-1256-4064-b0ff-6370cf9c719b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1453da94-3013-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1662709402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709402, "uuid": "a80b892a-caa2-4fc4-bb60-d78e696bdd42", "comment": "Malware payload (AgentTesla)", "value": "ee16f893a9810bf9abe3d1c08b6e667e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709402, "uuid": "ee07af37-1846-4f63-ad0b-42a8e8745f6e", "comment": "Malware payload (AgentTesla)", "value": "0018996fe46e255578c6efbef54ba7eab18282bd707c6bf5a626d87bd146121e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709402, "uuid": "8ba3f912-a983-448e-8897-17b27b532e8a", "comment": "Malware payload (AgentTesla)", "value": "06dafd64abb13655e76f81fa1cd34c9086cb4ea0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709402, "uuid": "568ef729-1afc-48e0-a1ab-3150b00c52bf", "comment": "Malware payload (AgentTesla)", "value": "05ebb2558d3237fbe2b9c00e1d3d7b3c173bbc47a7213afd4db245ab49b4cc743f5d5e0447c09d25b09f0e970f56923e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709402, "uuid": "c98e073a-47d2-473c-b986-d986b548b955", "value": "T14D252A0721950DA5C17290FC24CCC5B74BAADE85E63BC945BFC99CAFF592F2846D22B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709402, "uuid": "457799cd-f146-4bbf-a62f-764b5b375d75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709402, "uuid": "099c7830-c328-4c49-8b1c-4754720d0655", "value": "12288:Xwdox11WoH3KA0FWkQaCzqwKJRI0p6XsN1dAoem2WFKrKQ9A3s:KotWo6A0MkNiK/I0E8p2WYGQ9A3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662709402, "uuid": "981f8e83-8ebd-4bb4-b177-254fdb70fe78", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662709402, "uuid": "0e4630bf-56f0-48f1-8da9-cc5e96c88bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709402, "uuid": "adf04382-5255-4a23-b08c-7834c92a37d9", "value": "SecuriteInfo.com.Win32.CrypterX-gen.3731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0866d3e-3027-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662718227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718227, "uuid": "07383219-8c75-4b29-b1dd-21d619dc0d4f", "comment": "Malware payload", "value": "033111a5bc9bc1a3a3a22b67935c5558", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718227, "uuid": "506673df-2969-4b72-a902-9dab396c7e38", "comment": "Malware payload", "value": "01de89d02b76005adf55fbe89299377dbb50976617d82fe30db19a197c8dbdad", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718227, "uuid": "41eb5a1e-be3a-4d9d-b7b5-6e71a49df51d", "comment": "Malware payload", "value": "6a9d9b752f1e28b9d3fcf221ad3bb9a3dd3e0f64", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718227, "uuid": "8c2d19f0-7fd5-40fd-96a3-5315eb724eec", "comment": "Malware payload", "value": "567ff6990f47b44c18eeea730d87e50b8866ff6c7f4d59057c2ff299115047aaf8f89d5a978fa5e1ec4432a3c462db1f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718227, "uuid": "35ab3f7a-1bbd-4c63-b8be-b37935f7f924", "value": "T1F9B2BF32EA436062C39637B44605069DF7BEB262E036961A2C8D27EC6C11AFD5D67C0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718227, "uuid": "29f88b84-4478-4b82-86cc-4f07c4f22f39", "value": "384:vCkkdLE3G4le0lVPfQ0nGkZkOnhF1BPd+I+sYyVn0Rec/YzUU8fLkpLIbtI1k85X:qbADPxnGkZkOhFvEXyZc/YsfLkpUIk8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662718227, "uuid": "29ab2fca-2fca-4030-af45-eb9904423338", "value": 24118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662718227, "uuid": "b6c54122-182b-4dc8-a220-b71289da3a3e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718227, "uuid": "dc440200-8b26-4415-946b-8f134d9c3c7c", "value": "Untitled attachment 00008.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b9745c-3011-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1662708657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662708657, "uuid": "d946aa11-a30e-4e16-be68-b75d3ec235a9", "comment": "Malware payload (Tofsee)", "value": "a3c1b18c3d8071ce0a26deb2a2b5c43d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662708657, "uuid": "78aa12e2-8f0b-4d2f-98b3-b925ae592aa3", "comment": "Malware payload (Tofsee)", "value": "02674a2f99ffa9649e3fa9b67d06138abb0fa6651a4f0a96c24a3575fa9075fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662708657, "uuid": "259dbefa-3e0b-4fd4-a2c0-fd8703c6df7d", "comment": "Malware payload (Tofsee)", "value": "a5c28ffe439ace47f2663bab8b80f391afe2add9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662708657, "uuid": "8dab47bb-f76b-4df4-9a3e-9f6d7923ebc3", "comment": "Malware payload (Tofsee)", "value": "e695d7b0b468c18fceab3cefa36a53ce26a8920857ebd11016c8abed3f20c22ae0c6404e1a8a20b27de017a627ab6523", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662708657, "uuid": "b155981a-86ba-4bc4-aec3-e45d4ca730f7", "value": "T1BA24BE11B5B0C432C4E695348030D7A46EFAF8725F78898B7768377E2E703D026B636A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662708657, "uuid": "b186d926-ecb7-48be-8616-7cded9080746", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662708657, "uuid": "0148686b-dc6d-4f36-bf12-982efa896b12", "value": "3072:kO4hwupuFqzG65ug37zy0/r3ZGSH3AIsKFhav10zE2:KMFaHrm0/4SH3fsKFhad0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662708657, "uuid": "f3c3eaf4-f112-4d8f-9d76-f625f6798c27", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662708657, "uuid": "0570260a-f175-43ba-a07b-8224d66bd4b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662708657, "uuid": "dd2be01c-8f34-4ce9-a8ed-1c57660a3338", "value": "a3c1b18c3d8071ce0a26deb2a2b5c43d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee70c34-2ffe-11ed-9266-42010a9c0072", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1662700749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700749, "uuid": "7960c30a-1d3e-49ba-9d96-b77adb7ddc11", "comment": "Malware payload (ErbiumStealer)", "value": "3d6def75b450a4c8f34d10e7759316f9", "object_relation": "md5", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700749, "uuid": "b3f0a51a-0cf7-4c27-94cb-1e74094ff088", "comment": "Malware payload (ErbiumStealer)", "value": "027a8ad0bc5e7e7460423eec9901b07922d83e40a48323bd36a3999aef9e6720", "object_relation": "sha256", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700749, "uuid": "af46aa93-f159-4707-9602-8c3c753713d8", "comment": "Malware payload (ErbiumStealer)", "value": "dcc2c121f46d17cc16b3dbb437d4e5ba8007b640", "object_relation": "sha1", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700749, "uuid": "09c9ee8c-c8c9-4cb3-8f4e-9cf7d02ad8aa", "comment": "Malware payload (ErbiumStealer)", "value": "b76b599857b167c743d689259ac39116cde94d2cbe9d59f367f451094795510c9045ddd01ae810fc62128222466128c6", "object_relation": "sha3-384", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700749, "uuid": "57b7746c-f722-4b60-b87b-767f2254b4b0", "value": "T194252929E70725F0DA175776818EEB77AB14BA188032AF7FFF5BDA08A4330127C49255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700749, "uuid": "a0ef0bfd-59f9-4638-82f0-73daccd7774e", "value": "1797ab721d550312b93ab992a1e04176", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700749, "uuid": "d2b01b9c-edc7-4e96-be88-7f7fc5ba48ec", "value": "24576:nDfzYXYBG5yvrMtVoZ4rkj/439jdMu4+:nDBCRjZ4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662700749, "uuid": "e1ee5a04-aa2e-4643-a392-59c38ba7fa10", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662700749, "uuid": "ee94a6e5-e83e-46c7-8ece-4a3ca39b57fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700749, "uuid": "8c9b63f9-7280-4ab9-89cd-1cc96addcb31", "value": "3d6def75b450a4c8f34d10e7759316f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b6725c-3051-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662736301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736301, "uuid": "d0aaaa6f-5585-4948-9443-676b9120e26d", "comment": "Malware payload", "value": "c25b44fac10fef4f7a400548810f4335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736301, "uuid": "01c2e2fc-2731-49b9-bf5a-11cb2ab575ea", "comment": "Malware payload", "value": "046cd8b525c82f4db3b39d9a3f1b4f7dbad48dee24af3739c81e219ab56640db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736301, "uuid": "f47fa1a7-9924-4e88-861c-510c273e9cad", "comment": "Malware payload", "value": "b86cf34c56a92b14acb59c4280e144b64a9d4c7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736301, "uuid": "054aa74e-b5db-4953-a457-29218393c1fe", "comment": "Malware payload", "value": "53fbc580dddb24c87a76bdd8bb04575c62cfe59e1269b23dc41efa12510480a4680f43103025c3d6fb7c1dec35581f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736301, "uuid": "9cde6116-7b6e-4cf7-943c-c88a13ee8323", "value": "T114B4BF05B9A3C0B3C5635A72946D835E653A7A141F2249EBAFC46DB86FB03C12870F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736301, "uuid": "01f4cf06-6ca9-46d0-b236-435ee8be39ea", "value": "49080033381428e3a131ff5659276d1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736301, "uuid": "772b7948-e813-46f9-9dd5-b7698a50753f", "value": "12288:o9WaQa6g2K0Gds+ALpMAm/tSeG5+ry4WBGh+sI:C3Qa6g2K0GKpc/45+rgGVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662736301, "uuid": "514a445f-863d-44cb-96d9-39150b143ecf", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662736301, "uuid": "efb18813-5c0c-40bc-b654-5a61ae7a5356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736301, "uuid": "be23e520-41ec-4bae-9fdc-121dd87bddf9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3544dcea-304c-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662733938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733938, "uuid": "2fbcda2f-414b-4233-9fcc-e32923d7afd1", "comment": "Malware payload (Smoke Loader)", "value": "32b1e51c781b9be1b4483277496c7854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733938, "uuid": "6f724e36-2e84-429f-9ff9-4e72f95c9028", "comment": "Malware payload (Smoke Loader)", "value": "0485d7d8c374c5ee5277a7a1ede2c8791d6e615faa39ee89485f039489c7e9a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733938, "uuid": "0fbc35ee-c356-4e1b-a111-7bc193555a9f", "comment": "Malware payload (Smoke Loader)", "value": "a7e9fd70625b51f09e71280f193c9dcff9e40ba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733938, "uuid": "4181ea77-ce94-44d5-81d1-202fe6f500f0", "comment": "Malware payload (Smoke Loader)", "value": "564ef6683cc85a354143c9cf31a5aef91f1924805a3b7fb73bca2e7eb78f5af7f51f09949dfc4b9fc77d2d5f1df6d978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733938, "uuid": "0e72bc0b-833d-47d9-94f2-33584e1dfbae", "value": "T1D424AE22F591D433D4E609388830D6A56B7ABC622A7C884BF764376F2E703F16775326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733938, "uuid": "8cae3313-be5d-4144-b66f-ff7d98e1f066", "value": "8214eaa7808ae504d4e701b905d3948e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733938, "uuid": "3be88d76-d8fc-461a-bd98-3e8986c00f34", "value": "3072:4aDPsIRk/s+c5GSRdS1O4Sj8MX8Aqkf6ODr6MSjSZRJvzcNArPj:wUfN8w8AqkyODrdAWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662733938, "uuid": "300f676d-5c79-4db1-895a-7cba02537e83", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662733938, "uuid": "1dfb0ca5-462d-40e6-b282-debe9d4704fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733938, "uuid": "b38bcaae-b6bb-4c83-afce-372bbfb8b714", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a0a047-3016-11ed-9266-42010a9c0072", "comment": "Malware payload (DeadBolt)", "timestamp": 1662711048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711048, "uuid": "3b2d7931-ea2e-4fe2-a89a-edd7ec443506", "comment": "Malware payload (DeadBolt)", "value": "4484cbbb8b84035272ee72dc2fba1e7c", "object_relation": "md5", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711048, "uuid": "26233218-d454-4436-a977-443e6f868f53", "comment": "Malware payload (DeadBolt)", "value": "05451bb9b9c298b3bb4f006e7219a80264d01de63b7f703d2cad42e3a1b9b328", "object_relation": "sha256", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711048, "uuid": "c1814c24-cfe2-4ecc-86b2-9986e8a19192", "comment": "Malware payload (DeadBolt)", "value": "e28017e07705ff507e05c7c56a6bc811a445e3a5", "object_relation": "sha1", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711048, "uuid": "b1e8a342-05cc-4164-9cb6-f1b36fd628ee", "comment": "Malware payload (DeadBolt)", "value": "054012acf66defbbe5f5a998d46b6a12bf1c0102a36153c3686ef6b4bff350ca2e8ccd81fcc24dacd64c3a131d89812d", "object_relation": "sha3-384", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711048, "uuid": "bd8ea099-953e-48e1-bdef-18af515beea7", "value": "T148D52843FC89A2E4C1ABA6798E6152A1BB30748D173573D73660A7BA1F237F04E79710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711048, "uuid": "a2bf6a46-ef91-4eef-812b-e934d14efe78", "value": "49152:e9SJKUHYY91nB4OxeciVwBKfgY7PFsVE22a1:cS2k2BN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662711048, "uuid": "29ce9cd6-76db-4d1a-acc0-a646896b15fe", "value": 2998272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662711048, "uuid": "ae3abf54-9c55-460b-b516-983e23a3fd24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711048, "uuid": "6b5b7757-03c9-41cc-bc5d-f563fb854578", "value": "05451bb9b9c298b3bb4f006e7219a80264d01de63b7f703d2cad42e3a1b9b328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41464fa-2ffe-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662700677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700677, "uuid": "c27f2d5a-da21-4a4f-98da-c2a4d32746a2", "comment": "Malware payload (SnakeKeylogger)", "value": "91b3d221a12906f6bad3742bd83f9174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700677, "uuid": "21991ff6-ca3f-4da5-951f-5ed792f2ca31", "comment": "Malware payload (SnakeKeylogger)", "value": "056b3bdaff87121d75b29608344b8a56283669dd7b7398496c5c107bf9e8f119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700677, "uuid": "b917bdbd-0a42-4324-a4a3-2a6bda099705", "comment": "Malware payload (SnakeKeylogger)", "value": "4f568570cdf28d705955da2d3d0345eeea616213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700677, "uuid": "3859cc69-3d73-4af3-8008-fb075e404d21", "comment": "Malware payload (SnakeKeylogger)", "value": "b12a12a2c8bfb692282f0817f40c33a16e602087167cd9a6ce841e67b186df3fe08bf3aa01f2e550880167592e1b1fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700677, "uuid": "fa52c8e1-5cdb-45c1-a346-6764ff0872d1", "value": "T1B345729D725076DFC86BC872DAA81C68EB90747B530B9603A06316EDEE0C997DF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700677, "uuid": "3edec8ea-cc89-42f0-bfc7-4c8c47c43dd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700677, "uuid": "3d307a31-00be-4126-9883-218a8e57ae34", "value": "12288:ltdMqiYj4SBpTInbx7Bt7ennPZbijw3AphgB1d9UBkZqNj6AWifOGXWICY2hsp3u:3dMqtpTUbJBaPwjdpid9skQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662700677, "uuid": "d92a3fc5-d4e0-4f16-9428-0fa59436e268", "value": 1180672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662700677, "uuid": "decfb2f3-e549-45ab-8b12-f1435e124f64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700677, "uuid": "38ee27e0-8c10-4367-8795-1643e2c92c48", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef79e2a-307c-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1662754517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754517, "uuid": "8e55e137-4ffb-44e1-a657-28bab53da9e6", "comment": "Malware payload (NetSupport)", "value": "dbf6e8a3dd083a0145d14f47ed1f89a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754517, "uuid": "06a37288-0d89-4b10-966b-dcfd36a5bd01", "comment": "Malware payload (NetSupport)", "value": "05bb07f3dfae2584a5f6382f23ba58bbea9feeea01509c446a1c75e47a9dfa13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754517, "uuid": "e42b790b-981b-4548-b8a2-bbf098065da9", "comment": "Malware payload (NetSupport)", "value": "5bb368eb964a477bf29d58bb5f456b811fea19f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754517, "uuid": "21935b8f-d02c-4852-8744-3a720db76f01", "comment": "Malware payload (NetSupport)", "value": "3a11859a5f4599edc976890dcb0b7243964ca56e627b0f166eb04176f8827325f117bb175f1972030e81d9026b467cec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754517, "uuid": "db4ff85d-f61a-4a6c-bf92-595d8fe4b93c", "value": "T15324CF22B9D3C431C4F285308472D6956ABBBF625A7F884B77543BAF2E302D066B5316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754517, "uuid": "ee54d2b1-216d-475b-919c-f1d0d658797f", "value": "8810f6e62f35f47a0de1abe73f5a664d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754517, "uuid": "296d8f09-f62b-4d83-a493-e5ff56c1d5f2", "value": "3072:9aA+f6AOJ+6WdmEk6wW35lqOfiRPa7PWiM9uVJiFE7m9SYuAtM2Uq:9iXQsNkP4hMgkFECYDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662754517, "uuid": "f6f68339-fa68-4f45-804e-0e49549faa3a", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662754517, "uuid": "452c54c7-a1bb-454f-95d9-8943005a0278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754517, "uuid": "e1989e7f-0fde-4adc-879d-d33291aaced1", "value": "dbf6e8a3dd083a0145d14f47ed1f89a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae7dfa7-300f-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1662707936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707936, "uuid": "0a90d354-c82f-4b15-8fd8-47325f516c7a", "comment": "Malware payload (Formbook)", "value": "e11e1d8543bc997e2fe9835dd6ae5488", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707936, "uuid": "50993a53-2e27-4b23-86e0-4585d6cfe57f", "comment": "Malware payload (Formbook)", "value": "098ffd461615734bfd5dbf239b55879a23d7a4b79665fbeca75d1bd01ca9f0e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707936, "uuid": "558fcc36-accb-4c54-8161-ecc4983e8617", "comment": "Malware payload (Formbook)", "value": "24ad467421e905004f182dcfebaba1dfdf9a990d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707936, "uuid": "75e0a62a-0590-409e-acca-dc02a3ecf325", "comment": "Malware payload (Formbook)", "value": "934e27c551604b4c989a51a783ecdb1e30484dc712ea22eac621ef74a2c363d19a187a4d98908821f73edcc541d8f0bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707936, "uuid": "fd2407b2-3dda-4948-8d06-5651f95eea44", "value": "T1A115290721D508A5C47250BC24CCC5B79BAADE45E63BD946BFC9DCAFF582F2846D22B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707936, "uuid": "123d52f1-43ad-4ee6-bd87-89f12c6e4975", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707936, "uuid": "9d00b32c-3a5b-4da7-82ad-bc0b660da139", "value": "12288:N5dgx1a7kFdsXTLBwUAYozkHIq94xT4PcfrUdeVT7E8r:Zgi7kFd+HBnABzuZ4GYrwQQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662707936, "uuid": "5f2ec0da-dcd5-4236-bd2a-4b7904509fd4", "value": 936960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662707936, "uuid": "368143e2-2002-4e0d-8581-a598064536d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707936, "uuid": "fb47490d-9210-421e-9a94-7c1dc0db1b8e", "value": "kchMXjTrvowZDcH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8e0f43-303f-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662728612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728612, "uuid": "2fea7ec6-543d-4f33-a132-2bf2c8d0507b", "comment": "Malware payload (SnakeKeylogger)", "value": "ad4778d8a83f942bdb2743c2b5470fe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728612, "uuid": "92fd15e9-9bf9-44cc-8032-a2149bb29678", "comment": "Malware payload (SnakeKeylogger)", "value": "09a476b31272d7aa3ba1e7f0a5ed54dda6834819fb360de18cd883fdb177686d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728612, "uuid": "f12ae91b-b2fe-45cc-9086-4376058eb8ed", "comment": "Malware payload (SnakeKeylogger)", "value": "330267b3c1b66359f5d99196953e468b948c4bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728612, "uuid": "ca1abf40-825a-4d23-b6a8-e897c60b08ec", "comment": "Malware payload (SnakeKeylogger)", "value": "2f92c7266b8d31e540853c06bd9009328127d1465c79f69660474dfb04195092bd8b98f57b13e858581c18345be09b03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728612, "uuid": "aed9b27f-2b85-4dd6-ba8a-77c42b0b8816", "value": "T12E25043F31EE2A10E7EF573279C8878C0E959B4088999D3A263324B2552DFBDF055D1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728612, "uuid": "09bf4a15-3e39-4de1-91bb-222ce332fb3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728612, "uuid": "a1284645-650f-4d73-b318-5d2a674fdfcd", "value": "12288:DI+riEc2QHj60QPTUbfdJRsbWkFHgjeRYd/86eeAMjtSaXleVaXhTw:DxrX/QHO0iULfkFHy/ZehMljXh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662728612, "uuid": "44e44cc1-a152-46c5-95e1-5da26299c0ca", "value": 1034752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662728612, "uuid": "d8e32358-b6dd-4e67-8ed7-f0c4a270a97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728612, "uuid": "55a1080c-98bc-4a6e-802d-80cf02a26c0e", "value": "SecuriteInfo.com.Win32.CrypterX-gen.17384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f8e51d-3016-11ed-9266-42010a9c0072", "comment": "Malware payload (DeadBolt)", "timestamp": 1662711069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711069, "uuid": "680608bc-1f53-4410-a35c-9707814483ce", "comment": "Malware payload (DeadBolt)", "value": "a77aff03b497af0f3c282d019022df14", "object_relation": "md5", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711069, "uuid": "c8dc9167-9d2f-4c32-b7cf-253a38717b88", "comment": "Malware payload (DeadBolt)", "value": "0a07c056fec72668d3f05863f103987cc1aaec92e72148bf16db6cfd58308617", "object_relation": "sha256", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711069, "uuid": "c89ea7e0-cd8c-43a3-a98e-131231ee3020", "comment": "Malware payload (DeadBolt)", "value": "49dfb9c1c92044386fabe90797373dd3e20ac0fb", "object_relation": "sha1", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711069, "uuid": "9ad62cc9-6ddb-45a0-9d0d-112ce339eb7f", "comment": "Malware payload (DeadBolt)", "value": "d58507a502d90dc4d5f51e1536793b31119a7960e12f17b37c4a4ba5438d55d6b28d2c6e1c0184b69f9da8ab3a5b7277", "object_relation": "sha3-384", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711069, "uuid": "7f1742bd-e811-46b5-8e68-84bcbe00806c", "value": "T1323533D5EF03091963081290C3E492E182474F9E75CED223C7C9E5F616B3F61FAA9A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711069, "uuid": "65ae1c73-2dbe-47f0-ae8e-3b55c60105c1", "value": "24576:UKzLOC3vcFF/vEUv8iRfjA4+WPRJgU7XoO2/ZuZq0u9:U2LyFEBGchWPRb7Xon/Cq0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662711069, "uuid": "28963e8f-1bbb-46a8-8226-22a667405167", "value": 1096436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662711069, "uuid": "3feafbcc-5691-41fb-b531-e536ad3045cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711069, "uuid": "345b513b-54aa-4a58-804f-7fdc0ae4b3a6", "value": "0a07c056fec72668d3f05863f103987cc1aaec92e72148bf16db6cfd58308617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3bb167-3047-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662731881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731881, "uuid": "57713bab-efad-4f5c-ab65-72c13529fcb7", "comment": "Malware payload", "value": "69749a593246627ca3db8d178008be33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731881, "uuid": "d8cd8e82-35bc-4a69-978f-660029aeed26", "comment": "Malware payload", "value": "0ae55be26ceb1a1b09b3504a77e8d7df5c1293c3ea7af3c1dcb88ae8a645c4fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731881, "uuid": "1c5639f4-e7ac-4728-8647-67acb3f50d9b", "comment": "Malware payload", "value": "a3ac32396ccc9d914c990df4ab4df07b177d63be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731881, "uuid": "f1fa5f3d-6c66-4850-9bf9-59d803b0a73b", "comment": "Malware payload", "value": "21809bfbeb1abd820a52f54900e6767d4febb89e6f85e51c51e57e94edf115df288343579fd98ec78c05bef5d066c9c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731881, "uuid": "d165a65d-6ecb-4a8f-b4dd-d1bc664bcf68", "value": "T1FC24CF22B5D0C472D5E605308430D7D61B7ABC62AA74948FB7A33B6F7EB03D12676722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731881, "uuid": "e68ef6a9-64b2-4199-af48-d3e1cd57555e", "value": "8214eaa7808ae504d4e701b905d3948e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731881, "uuid": "393cb1a3-f091-4d09-ac3a-ced735b729a2", "value": "3072:uVnqVni+rSH3c5nnLnaFTDRCwAmlIjcnFTeMtM50EoPj:hr++2nCN0FTTeOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662731881, "uuid": "0a9d2560-5779-4310-a4ad-746dca0658b2", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662731881, "uuid": "89b89088-9607-43cd-8924-a32def6c175d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731881, "uuid": "a3310efb-0df8-4dbc-b958-aff0c6e2fcd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b61f60e-3025-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662717225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717225, "uuid": "f3926ba1-8a30-4d5b-b2bf-ad33a18efd1e", "comment": "Malware payload", "value": "dbdf12ff440c34350235a131dccbd2fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717225, "uuid": "53d62159-8a1f-464b-812e-a503352b68dc", "comment": "Malware payload", "value": "0cca0bbeb38310bde6f3585ef3d5aa0d45f750851182590231fb7f7d85d2eee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717225, "uuid": "b54b749d-7fff-4218-b4bf-fd0b1398b1e2", "comment": "Malware payload", "value": "278d50dce8feb6afd48ee4ef7cd75eb6bfd76235", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717225, "uuid": "0bd67cae-0c7f-4123-a747-449c50ec8046", "comment": "Malware payload", "value": "59c206235373384576d5e452bc9850b0599da9fa4b20fd533b2cc4880dafd917d0accab3a79cd2f5954950536cbfbfc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717225, "uuid": "002596ca-9a76-4999-8425-34c69c1bc336", "value": "T18315ADE879E5A278F602DF7AB6D108B04F461FDD7F85ADD4114A354A227702AF283C4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717225, "uuid": "df2058b1-9d0f-4468-8c48-43807e9527c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717225, "uuid": "bbd0f64b-aa45-4775-9e3f-5e8d715c6027", "value": "24576:Bo16ho7R27vjolJGZs6QLrtYgPeJXGGJSkyB6SZO++08u2XqZ6T+NHvMAEL5k+tE:1o7QrjolJ6s6QLrtYgPeJXGGJSkyB6S1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662717225, "uuid": "ef48f279-a074-4f63-b66f-c906c7a3fc2f", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662717225, "uuid": "98e1783d-f236-47bc-abcc-9aeeb35ff1fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717225, "uuid": "eb691481-0115-4c31-ab87-afb94cdbb9c5", "value": "SecuriteInfo.com.Win32.CrypterX-gen.25978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67bff54d-2fdb-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662685490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685490, "uuid": "87437b5a-df61-4075-9a97-d33594b417b8", "comment": "Malware payload (Mirai)", "value": "84c7f74c253bbdbbe45c911f87ea040e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685490, "uuid": "c87e2123-fec3-43f0-829d-7a3df3d0f477", "comment": "Malware payload (Mirai)", "value": "0e48033e7bbfced8762df8e7b01ec258c23f2861ef2e2a969027f26b0a374a51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685490, "uuid": "5815a4bb-7232-492e-a595-2f83ea56285b", "comment": "Malware payload (Mirai)", "value": "360c05571f736d914b45fda4c07834a653855246", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685490, "uuid": "ba2f166f-058c-49be-9f8a-5d50e601af7d", "comment": "Malware payload (Mirai)", "value": "30432090a47ef5dbeab76c40736523c48f4cc2709a9f78a28db84cc33a6e6c142af9fea766dafdd6a40277e5b1536f71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685490, "uuid": "2d20ced0-880f-4186-9dda-001d4f958c91", "value": "T17653AF71E47A5CD4C2990534B2E6DE3D2763B800E5232EF58D0B47FAA40BAECB1593B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685490, "uuid": "6766ae63-b3f2-4002-885f-0738281a1b34", "value": "1536:CQahjoA/ksfC56eRYGvd3Pz0ppoubi8H0uhwWCzPUIBd3nSr:NGJo6nGl7008H0uhwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662685490, "uuid": "8b1b8bf4-acd2-460e-83ab-951892f68054", "value": 66660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662685490, "uuid": "a98f23f6-62b7-4c95-b28e-02d97a51dbca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685490, "uuid": "437261c0-fad9-432c-8f04-9893add72456", "value": "84c7f74c253bbdbbe45c911f87ea040e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692fa1f2-308a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662760654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760654, "uuid": "1eb5349a-d45c-449d-ab2a-4e4000fac9eb", "comment": "Malware payload", "value": "1842cc4cc3b59d8e0402d3368d89d85b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760654, "uuid": "f989b1e2-eeb9-498c-b7a9-b62e896a72f5", "comment": "Malware payload", "value": "0ed2159ed4662f752c670411fcb67303acb3a81354e9b2bf9c2fe87804475489", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760654, "uuid": "d58957bc-44f4-4f1d-8786-b2b38f826099", "comment": "Malware payload", "value": "3caaef02252ed43ae96db08c1ff2f3487c8f974f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760654, "uuid": "75be77a8-11bc-47b6-a67f-030746bdddb4", "comment": "Malware payload", "value": "010559625c8977e96f7358d6308c87ec1ead9c359a47bcf3a6e3d58b6b996783adecf4c61b73f72a37d2cc899981c974", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760654, "uuid": "261b4aa4-f5d3-4ae5-a0c9-b76808002ed9", "value": "T14BD2D02168C69EA2DBB01C35C1F80E232A9D5FB571803540126593AC8BE3A4F7E6BCD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760654, "uuid": "698baa03-75c8-440a-b5b8-7505c1b90c85", "value": "768:cDvWKkR5VD7XHiqAz7sesx0tAtynW8/N1eHlq3UIsC:c7WKg5VqqOtY8/gCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662760654, "uuid": "6b40c7c6-bd4e-43f9-927f-2c179241e936", "value": 29832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662760654, "uuid": "592d4b90-9239-40c9-966f-745da8f96141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760654, "uuid": "4bb7041a-117f-465d-b0fd-454a95a149c0", "value": "yakuza.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eddf1b8-2fd8-11ed-9266-42010a9c0072", "comment": "Malware payload (a310Logger)", "timestamp": 1662684294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684294, "uuid": "780a51f4-e3c4-42cc-a0a0-9754e17e5c2a", "comment": "Malware payload (a310Logger)", "value": "8cd3c408dbd87894a290c93b12dce3e1", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684294, "uuid": "13326daf-0078-4d14-8b1f-bfb3f8d1aceb", "comment": "Malware payload (a310Logger)", "value": "0f896e5abb5bed9dc6f294e16d438e144cfee438659de1d98fee565218007be3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684294, "uuid": "bc2d825b-0110-4807-b46b-b73677d995d3", "comment": "Malware payload (a310Logger)", "value": "4533184218003ac6dbc6c3f96be401f5628e8179", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684294, "uuid": "d8374942-e3bd-4a2d-9400-6b3e06e71dd6", "comment": "Malware payload (a310Logger)", "value": "2fdc63d8616a7b2f4d27b06099ce1b683ca7a43a27eadc07fa4dc2eca8d484d563137c9706efbc1e507840b8305f0576", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684294, "uuid": "1da1717f-11f3-42f3-9308-6039bcf6249b", "value": "T1C8159C7920FC57CAF96EBB3143BCB405A9812D7B2F136286F9B3B47D417435198806EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684294, "uuid": "48d5169d-034e-42f9-9c6b-918e709d0dbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684294, "uuid": "d5208ab9-e327-426e-bd93-4f49552bbf31", "value": "12288:kpYfwJH4IGqlyHQ/wUg1pVL7lYMGdR/bm1fgIawQIa92vs+O7LPc+CqoCg4S7hK:wYobiwxKfgnwzaEvsJjf84S7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662684294, "uuid": "ad11c6c2-628d-4167-8b54-dcb99279cfdb", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662684294, "uuid": "1dbc9a3e-1e26-4d45-a824-c61cc6ca613c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684294, "uuid": "4ae2b678-c181-49d0-8dc8-f080e14c068f", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1232158.25080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ee4d41-2fff-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1662700954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700954, "uuid": "5ecf5723-4c00-448b-918b-0c91e5a4da52", "comment": "Malware payload (Formbook)", "value": "b3ca9cf9577c0e5017f469c2f685559e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700954, "uuid": "bec3f521-b32a-415e-b918-4c6050be11d3", "comment": "Malware payload (Formbook)", "value": "0f8f203e0b21e34ad21c3e762dbae4c4c7b158624a5f805ebf19e8ba05c76e5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700954, "uuid": "b86dba02-6342-497c-a046-5d11700a2a04", "comment": "Malware payload (Formbook)", "value": "c16ef4ceee9c450225c29ef355500032f318b2a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700954, "uuid": "235d2b3a-c62b-4c54-bc6f-a368f3cb8b10", "comment": "Malware payload (Formbook)", "value": "353445ed8ca03b14ecd1f3703e7bc3c4a33173094baf7209af1b5ae8e1346258f7cee9981782ecc72c9eda135c5c167d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700954, "uuid": "abc4e664-509c-47f9-bb8d-756d76f5b208", "value": "T1F8152A0721C50DA5C47290FC24CCC5B75BAA9E85E63BC945BFC99CAFF592F2846D22B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700954, "uuid": "20834ca5-9ae7-4f11-9c73-54784ae1d07d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700954, "uuid": "ef07cba6-91f0-4bed-8c56-b036bbe8b277", "value": "12288:ZRNd8x5nrx3ZniTkS2Z88VsXF0WrfN2671Mxf89YJRVo:Dn8zrxVCkfFGNj71sCYJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662700954, "uuid": "a9345036-14b9-4839-8526-db4589cb3625", "value": 916992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662700954, "uuid": "0d3e45aa-9011-4e66-81d5-74f57769052d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700954, "uuid": "6be318e4-9789-4a78-84a2-babcc1a4b23e", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480b6939-2fd4-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662682430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682430, "uuid": "7da7ccb3-4318-4ded-95f4-9c79c9b56d47", "comment": "Malware payload (Mirai)", "value": "89758623a0e5e11b6ed3e1b7c8ffb99e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682430, "uuid": "f132d4f3-1021-4b44-ab90-da06caa30510", "comment": "Malware payload (Mirai)", "value": "10cae20574471a23f29815ee64cf513e64ac66af55c04ac81ea7b0e794cd2a31", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682430, "uuid": "a2b09499-a133-4e03-b93c-059c71e6d8ae", "comment": "Malware payload (Mirai)", "value": "9015cc733b439da00d5ee1f3651d9d38c8d44578", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682430, "uuid": "b27b8cd5-8cf8-4b8b-8d0e-e67af14b25a4", "comment": "Malware payload (Mirai)", "value": "a742ee9568afafa5f38eebd7f992da67aecc181d2db5bc16ebd569ed5c33a8dfb1178db8c7783e7c29097836efa244e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682430, "uuid": "6d806337-6bff-4d27-a03f-b525398ceb70", "value": "T1CDD2D0A0991A39A3C9813EF3A87D058A204E177626C3377C3F6005FDEAE164B70B65D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682430, "uuid": "adbe91a7-99f1-4d39-890f-4b3736dd8279", "value": "768:nBXUg8ImHEBoQEFIygUgcQnjdBgtJVFaJh1h1YT5v3U6:nu5QUAHIJVoh1h1YT53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662682430, "uuid": "40cafa17-8051-4cfc-a748-220a640738b7", "value": 30488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662682430, "uuid": "4619734f-35d1-420d-a6ce-da30c5de8249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682430, "uuid": "38377c1e-a32b-4c8a-9580-977db3e83c1e", "value": "meihao.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b168a711-307c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662754762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754762, "uuid": "adc1d4a4-6528-4e50-ae33-a0711d9cdc36", "comment": "Malware payload", "value": "e6ff38b329bcb39008077366e4957c92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754762, "uuid": "96d1f0c7-402b-484c-9505-2fd8854c8773", "comment": "Malware payload", "value": "10df0ef277c2371fa904773d11c431664570eaca0e6c4e482383fe28979cb401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754762, "uuid": "74aa544d-20d8-4a20-baaa-323649b33c05", "comment": "Malware payload", "value": "c4e2a9aa87f25f498086100d6f0eaa21d565ccf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754762, "uuid": "8a09878e-1478-40b1-ad14-91e808c6f7a9", "comment": "Malware payload", "value": "a04ab7b84e8e3757d9526b2c9299b29a86040aa30a437c4fbe8250eb0053d8eda8e878288f29043468b704e543953c21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754762, "uuid": "97b9fe5d-fd15-406d-9310-8c0c3a0c9c55", "value": "T1F074729D766072EFC857C876CA681C64FA6074BB930BD203A06316ED9E0D99BDF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754762, "uuid": "d08dd470-4e02-4ddd-b3ed-b5faa6dae6c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754762, "uuid": "a4306174-c4aa-433e-adf7-ab2c6f64937a", "value": "6144:kKclFxYMceDJd2xqR2IBoSd4awfSBx4wzbr6VT3Rgk3fQibWXcHO79I:kBcw7H5CtfSBx4wzbr6VT3Rgk3fQibWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662754762, "uuid": "95a54f9b-09ff-4616-874b-9a4a62f80dd1", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662754762, "uuid": "9cd92f28-b5a0-43bf-babe-b90949e97482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754762, "uuid": "856d5e2b-8ca4-4217-82e4-1a9f6deb1418", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c8d373-3030-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662721985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721985, "uuid": "328ed0e7-d039-4416-986e-5147be2e4117", "comment": "Malware payload", "value": "c42c2f158ef06ab0c38b2c8f4b2917fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721985, "uuid": "e84fa092-4046-4ef4-aed2-9990417220fe", "comment": "Malware payload", "value": "1104365a0a5624fa86c169814eac4b2e11c4816e284bc46df9b19e5d2b184aeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721985, "uuid": "66cadccc-0cf5-4075-97c0-c3dfea0314ae", "comment": "Malware payload", "value": "213e0a78fdd99da3f27f5ef625ef260b28eb5bb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721985, "uuid": "55f91d6b-f74a-4b2f-bd77-dddc3fd4841e", "comment": "Malware payload", "value": "979f2e067184cbae5beb20378f706c438e4aac5a1851b76f40a03b1dcb0e9b39ee68019890598e2dde54aa8669a20963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721985, "uuid": "8f9d9216-a829-4b41-9f81-5767acfe3bf2", "value": "T16D24CF11B6D0CC72C8E249344470E7E42EBAFC216AF8958B7B943B6F2E742E17675316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721985, "uuid": "d00719ee-824d-4ee7-91c6-f157918dd783", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721985, "uuid": "16e58d61-bba2-4ec6-9e24-ec2486db3feb", "value": "3072:aOS8kYzl7Jlyvn65LwhffqglKoRKg5jDlDKHJHx5AxEEbrV:F19l+kwhJKg5/leHJL0EEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662721985, "uuid": "f004290a-e37e-4c05-8e25-06812f393887", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662721985, "uuid": "58e9538f-e7a0-43e7-98d0-d9646be9843b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721985, "uuid": "22ee5e29-75ea-4745-8369-f6172f29294c", "value": "SecuriteInfo.com.Win32.RansomX-gen.32635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b10eb1e-308a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662760657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760657, "uuid": "96e91276-095e-411c-8650-203f74d6814d", "comment": "Malware payload", "value": "d8da65533c72b7a84f9f51d62b2d38d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760657, "uuid": "e41d1950-f98d-4ad5-a75a-34446df6c797", "comment": "Malware payload", "value": "110cad9aa1201d7cd8cd1f98112fc207e4447cebc8ef724c9d6c5eda575f1216", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760657, "uuid": "3cf51929-419b-4703-9f90-1653d87f0ad5", "comment": "Malware payload", "value": "83802f2f5b259db98ac1ba10e8489d6c6d2b31fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760657, "uuid": "a7b1522f-7d88-4246-a4d6-bd16ad259353", "comment": "Malware payload", "value": "a59332514e448848bd506ef41a37d7efba4f94cb21fe64032d3dee6df52db3fd78a6c9e381d812a5de6a409ceff224ae", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760657, "uuid": "f1bbff58-f946-4837-9521-9c6b363da2fb", "value": "T197D2D19EDF203E87C5DE3D3E41EE17B15EC550C1798E668C5A0898096119CD7B87A0A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760657, "uuid": "00f5408e-d320-4ea6-88b2-db55b0658a18", "value": "384:g5aVWWVzbXl542LhGa4xkkXB1lmDyxAbUtr7CqNthLdn1jkduj/c09RWGVCzhMhT:gGW0zbXrLwD+kXnlVAQ9LdJTc0LWMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662760657, "uuid": "599b8b24-20f9-4ab7-a253-e354e44f5286", "value": 28568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662760657, "uuid": "c5bbf364-f39c-4483-ae96-83f252f6d9c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760657, "uuid": "81179160-a718-4c4b-ab50-f286e070ce27", "value": "yakuza.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f4acf9-3040-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662728703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728703, "uuid": "41f2b47a-adcd-4b00-a78c-ed9a47ae4701", "comment": "Malware payload", "value": "08cac56b75979c1f3bfc2e83e123a2fc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728703, "uuid": "1ae85a5c-fbab-480c-85ef-ff15855517f6", "comment": "Malware payload", "value": "11731e8a97c3ced6e50ffa011b04bc6b54cc5e4ee1ccf2c4fc70247b7ae4528b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728703, "uuid": "a4298507-7acc-45b8-b68d-c5d7fcb39d7a", "comment": "Malware payload", "value": "56227c920783d547a673e0de919f438dba846c01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728703, "uuid": "54f3993b-c068-44cf-a9f3-b81ef577afc2", "comment": "Malware payload", "value": "2db5dbcb83c36e5c90fe7716c21e3e81414524d2d6b25a6cdc62c8ea1cb6bc13dc5ed257072d4ef550b5a6d24e50e4ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728703, "uuid": "5485009d-dd26-4575-8dfc-88462100b934", "value": "T12D526C5177501A25D2998B3FF2D8B6A4BE3C6940CCA060AE2566D04C1AF9F1D6F60C67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728703, "uuid": "09631f8f-24b8-4725-8f43-71453e413087", "value": "192:tyBAu4E8Y/p6efAPaiQ4nggjClAgLZkByk0GAN:tyauqYR8s4ggjCb5k0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662728703, "uuid": "885e076d-ac11-4334-b654-f071b1a408ff", "value": 14226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662728703, "uuid": "9665a180-2fe6-4938-ad06-9665769b65fe", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728703, "uuid": "1fff9c11-425a-4b4d-8335-34430eca367e", "value": "Ordine CA-nr acquisto 4507506396.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfa57af-3047-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1662732018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662732018, "uuid": "680b08f6-e27a-4f49-bfdf-a27e63675f98", "comment": "Malware payload (NetSupport)", "value": "18c95130c7c68690377b5689fb7e6b79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662732018, "uuid": "a1c50b07-2dc9-4abf-af8e-35e86592d990", "comment": "Malware payload (NetSupport)", "value": "133d64f6ee01377be8697b09749f5c989206a86e5e06243561376bfa8a31dcb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662732018, "uuid": "37b53ed3-1eec-4302-93be-bf25739362ba", "comment": "Malware payload (NetSupport)", "value": "69f8ef1a67bb693847485d200242fd2b12b68550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662732018, "uuid": "68e8b1f7-3195-4260-884b-65cb38a9cbd1", "comment": "Malware payload (NetSupport)", "value": "1528a907dbc86453cca03d80473e29f724a5b34729946e8c6e68ab454a80b8b2f73c46ba82df1101c5f3b2c31c01988f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662732018, "uuid": "c340e7c0-8835-4870-9217-a9b6d3e96f6d", "value": "T1F524CFD2B5A0C83EE5E285309431E6E46ABABCA25A64C94F3754376F1E303D126FC357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662732018, "uuid": "10c9c788-e0b8-41c1-a865-55f918d2d987", "value": "5d5b8d072fdd778d9ba9ec0c36bae15d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662732018, "uuid": "1bbad387-b377-4620-a768-ff2252c35f39", "value": "3072:ZT4OKiL0Bgjr5DNYlCF9OTATozIWFE5m2wscVhtB+2:YW79OTATozIWFfVh3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662732018, "uuid": "f8a93c0d-d383-4d60-8cb3-a592a16a5b19", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662732018, "uuid": "24b507f4-2f1d-4e5f-a906-53cc05fa99f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662732018, "uuid": "8de844a7-756d-4fc3-8159-7feaf4356538", "value": "18c95130c7c68690377b5689fb7e6b79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f062d7b-2fdd-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662686415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662686415, "uuid": "cf4eb874-e507-47a5-8940-ed70ea9dd7c0", "comment": "Malware payload (RedLineStealer)", "value": "0b09e40776c61ed3551e5cd614ecc330", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662686415, "uuid": "d0d8dc3d-efed-40a9-b38f-41869648bf91", "comment": "Malware payload (RedLineStealer)", "value": "143cc96bb7cc94891832423c6bf30adca296ddcc5c8bddea14d2a7b0acb26d18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662686415, "uuid": "69115e4a-1a5e-4cfa-9f68-930f5f27c392", "comment": "Malware payload (RedLineStealer)", "value": "b9991efe0ee4c575865b2251c48116e77f2e5d1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662686415, "uuid": "4134ee20-34c0-454e-a6dc-1a1e4fd367eb", "comment": "Malware payload (RedLineStealer)", "value": "8d5f6f474dd2bd743f4a5e5c76e134c8fed8c5bdd3203ebc4f5afdd8aa08882528d3748ff608cbb83f19b54dc2433175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662686415, "uuid": "876df089-1cec-4387-b31d-cfb79b17e448", "value": "T19B548E00BB90D434F5B313F449B69369B93A7AA06B6454CF63D52AEE5734AE0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662686415, "uuid": "6a595faa-0815-492c-affa-ce6350aa4791", "value": "12603c2b84412546b1e88d58246986ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662686415, "uuid": "510cc322-60b5-4386-bad6-b295f43066b1", "value": "6144:g9hqILAB6Ph5ur4rc5gfEyOYlwN5RP9SD3zUhDwHZ:gVLfh5uUgifEyOYcPP4iD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662686415, "uuid": "2a915014-f8d7-4e35-95a0-0b7ac674e768", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662686415, "uuid": "fd33a58c-e3ed-4b7b-aab8-b39dc89d478d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662686415, "uuid": "8adcd62c-094b-4ada-b2a5-907448294e7a", "value": "0b09e40776c61ed3551e5cd614ecc330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e461ad-2ff7-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662697514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662697514, "uuid": "b8478739-8e08-44be-8cc0-fd8fa5e72a31", "comment": "Malware payload (RedLineStealer)", "value": "30e61733570a1762a38ab51ee5ec020d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662697514, "uuid": "3157c310-f846-43e0-a39d-302e9cfbb447", "comment": "Malware payload (RedLineStealer)", "value": "147ba9bb2401d21ef70c88da52ed8d161fbb4cecfc4e20a76854d0202bfbcd63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662697514, "uuid": "4d1967f0-acd9-49c4-93eb-d16dd733801f", "comment": "Malware payload (RedLineStealer)", "value": "47ea103617a07e2fc73780fc2edae24a870232d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662697514, "uuid": "7bf7e597-e466-4e57-9156-7b9d415fd1bf", "comment": "Malware payload (RedLineStealer)", "value": "da3e31f8de367ddb63d610e124c7836da39e18691284fd1b1c6ec1928f345093cd70e651a0874f79b86fbb3516d3b2fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662697514, "uuid": "1df377a6-9a02-4995-9d0b-920edbc04560", "value": "T15B355D29EB0739F0DA175772865EDB7B9718B9158022EF3FFF4BDA18A4330163885162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662697514, "uuid": "63ca85ef-bb15-4caf-b45f-877a22cffdea", "value": "1797ab721d550312b93ab992a1e04176", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662697514, "uuid": "f2ae6d08-74d5-402b-855a-97a4766f2aa8", "value": "24576:Xf7aEgYHYyW+7eOJ/Mtd3YqTjhKl+ifRlM5Fs4Sk43bi5:DaqBB+GS5sD3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662697514, "uuid": "cecd4d8b-6af2-40b9-84ea-a7bec49a92e6", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662697514, "uuid": "5dbee875-8927-498d-a4f2-f77c58d07ca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662697514, "uuid": "ec3bff3a-d0a9-456f-b203-25bed072a7bc", "value": "30e61733570a1762a38ab51ee5ec020d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c349e7-3055-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662738044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738044, "uuid": "874c81f2-a30d-4b5d-ba9a-ccd43e1fceb6", "comment": "Malware payload (Mirai)", "value": "eb279b0bb1e035e41ef278a5de87185c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738044, "uuid": "e12f75bd-1127-4314-9ccb-3f791d091380", "comment": "Malware payload (Mirai)", "value": "1538e674031f7b535577bda31bc5ddfbd8a9ee0ed14f4db03fa1c1b03b8bd86f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738044, "uuid": "e8e1888a-5aa0-4ddb-be18-9bd85736cc0b", "comment": "Malware payload (Mirai)", "value": "34cf28324eb8a277757392f9558fe1650e65e06d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738044, "uuid": "fb2ec17a-349c-473b-876a-f6b2dfbf0750", "comment": "Malware payload (Mirai)", "value": "2dc6410ca3b203a9f9bd489a7cb346e440a22aafe4d84463b971bc4051bccd5e8351f00821bf389536dfb882adff04d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738044, "uuid": "4eaba06e-399e-4985-b3ec-2be68e012349", "value": "T165E2D073B2065CB1CFE1197969B6850762A134BDB4AAF4766F34403A6DC30352AB82DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738044, "uuid": "6bb95fa9-02c7-4fe5-95bf-1b6e38ebecb4", "value": "768:uno26qotB/fUWAfqniz9lOpa7ehphG3LIWeiwOpNEpES3UHK:+t6P/cfqg9lOp7ThuZpwOp2iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662738044, "uuid": "003c9c8e-fb75-4702-91e6-667d671574cd", "value": 33404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662738044, "uuid": "2e7e6c66-933f-4b51-8d5b-a9ee6751b809", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738044, "uuid": "e1835a85-9f4a-4385-8f5a-f66e85423cae", "value": "eb279b0bb1e035e41ef278a5de87185c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5544d1f9-301f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662714665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714665, "uuid": "ee9721dd-9020-4d70-9a8f-77d12376bb9b", "comment": "Malware payload (Mirai)", "value": "f05b8f965a5538d05dc33f659b9d914a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714665, "uuid": "13950b2b-5fa8-4448-8e85-c1e96c5edd19", "comment": "Malware payload (Mirai)", "value": "1585ef16b74b3c80b4728d57db1bd6f31f773090a92cd1c8af3c2535ec1f136a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714665, "uuid": "ae10f262-1e1d-4dbe-b441-60facde33c88", "comment": "Malware payload (Mirai)", "value": "42767185659f9dcbc1b5b5eb2d4c23a62c5989ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714665, "uuid": "695567bf-0365-4cdc-be71-58762abed332", "comment": "Malware payload (Mirai)", "value": "256e6debde9ca5502da521c2ce2cb637209a8c93aeb806389248956810ec13941389c41f308505cef80efc99f093daec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714665, "uuid": "cfcaabe3-f50d-490d-a608-4d1340bbb25a", "value": "T11FB3B40E7E219FBDFBAD823447B78E255658339A27E1C1C4D1ACE9011E7028D741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714665, "uuid": "275e391d-a591-43d2-8bf6-9e83d5853849", "value": "3072:6YoWanVlyEJSyRQRHBM4z5wqzr7Q+rh4tgIPx:6d5rziRnz5wqzr7B1AZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662714665, "uuid": "4e6838ff-c642-430d-a88b-1a0866e6a930", "value": 107880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662714665, "uuid": "9e0f8927-dfea-4686-8bfa-4468eab32781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714665, "uuid": "2c169e67-2ccf-45e5-a2ad-260c8f586901", "value": "f05b8f965a5538d05dc33f659b9d914a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67560f6-3092-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662764193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662764193, "uuid": "52c9f298-969b-4a58-ac19-02c0e2e94d01", "comment": "Malware payload", "value": "22bf154c005ca0f160034140c4d4750a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662764193, "uuid": "328245ef-d32b-40f2-8b49-d805ba77210a", "comment": "Malware payload", "value": "178df16580dfe1def2f58365b88e97587d64dad0c1b0a3b3bcd1e88286273dee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662764193, "uuid": "bd2f16ba-b59b-4613-819e-38c2f6c0c3cd", "comment": "Malware payload", "value": "f29c30d26e01239f514fe56f2b013ef99e7335b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662764193, "uuid": "bcb2d7ee-960f-4f89-ac97-5225912a4592", "comment": "Malware payload", "value": "76f84d66b6b5fa0a2f0940936814a15c3c12c67ecc7291f900076cca215afb4f21f5a946be1296c84c48c26aff8a0902", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662764193, "uuid": "1969312a-fe47-4992-ba65-e8f8db58152d", "value": "T163C2E092F0D4DAA1E62F03B48C79F7D2FBE953A722B5D291269C5E09AC2F1132700DD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662764193, "uuid": "1e804cfc-b488-47fc-82d1-166afe35d666", "value": "768:5RGqDAlOtvEi8Wr/FULLHtbGtB3Dc5PWt4uVcqgw0RNWXJ:ElOtvEhKaHIDc1Wt4u+qgw0bWXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662764193, "uuid": "376bb721-1e4c-4271-9d33-8db245ca1d8b", "value": 25864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662764193, "uuid": "068a0fd1-8361-41ed-b74a-961f8962dc5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662764193, "uuid": "4e775567-1620-417b-aad9-2c010d1cac2d", "value": "22bf154c005ca0f160034140c4d4750a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26a5471-3042-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662729961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729961, "uuid": "aa05596b-b5d1-4340-b927-4412391f015e", "comment": "Malware payload", "value": "2eb17caa422a2097364e6fcb9c4251dd", "object_relation": "md5", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729961, "uuid": "44ee9f60-b1a2-42ce-a0c8-4de435ac5288", "comment": "Malware payload", "value": "182bb1afe6562279ccb29e3ec6e1aa15caf7ac62c1b25a75f6981887637550a7", "object_relation": "sha256", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729961, "uuid": "e8383271-d651-4cdf-bf8f-4724cba58648", "comment": "Malware payload", "value": "fba2528723a42314600bf4a10496ae840fa475e2", "object_relation": "sha1", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729961, "uuid": "0cb47eb2-24b6-4b79-a141-c54283d95f84", "comment": "Malware payload", "value": "14c46bdd1fc1fd01f2977906e4f83463f0312c44e5406290b62704e79273dc11fb8a8217e6e75352d06ab650ba849ece", "object_relation": "sha3-384", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729961, "uuid": "a8be334d-f35d-43b7-b5d8-ec82642e6fc5", "value": "T18CC37381B7C2BC81D28B5B76771BB1E6F53A4CD87199088FF004BCA4F9AD915EAD4930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729961, "uuid": "778bd046-78a1-4d1c-804f-66c7ee93d0bd", "value": "3072:DYAInlJ7Mb5z4Wh5q8RHzgaDFc2PeJjt:DYAIlJolz4W/bJDWWeJjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662729961, "uuid": "9da35f84-943f-4823-b927-af9d10336ff4", "value": 121818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662729961, "uuid": "27068ae7-d92e-4a9f-a51c-8b990c89cd72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729961, "uuid": "8a5d4176-cb30-4e24-977d-c3977d17cde8", "value": "MXoye8l.z2Xb.i8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5e839c-2fdb-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662685422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685422, "uuid": "1247bd8f-c2ab-43fc-af09-ef4cfc367014", "comment": "Malware payload (RedLineStealer)", "value": "23b72f054ccc71fa256aa4dcfbff274b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685422, "uuid": "0c22209a-eb4b-4a34-a456-2df0d6146a46", "comment": "Malware payload (RedLineStealer)", "value": "18426a7fce363e473c0200934a007bc1e3a832f1793236fcca179d734d1a5e1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685422, "uuid": "b739d831-9ffb-4645-9711-2979961639cf", "comment": "Malware payload (RedLineStealer)", "value": "76468272609998bf85ece205ce5cb063d9fd0aed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685422, "uuid": "70fe83b8-136e-4d70-b8f7-73664d821725", "comment": "Malware payload (RedLineStealer)", "value": "7e1810952040f6ae9d2ceabdaa86787b81d07fa66a698c4ee6e249bbf87ba4d69db738380a07398296d30bed7485e16d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685422, "uuid": "d27f0215-1bb9-4ee9-a3d0-cb26bb191b0b", "value": "T15BB329A477CCD514E6BF8F7168B1119543F4E2236801EB5F4EC520F91EA6B80FA21AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685422, "uuid": "1c85401e-a66f-4e37-8383-dc390e7c9a70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685422, "uuid": "a807ddcf-74c0-4481-a9f2-98e2f327d45c", "value": "3072:hcvFBcCYcpiwI9gZFsSiuHE8QcN4qsDHhv4EASNs:hcvafWiukVcNgHhv4jS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662685422, "uuid": "ed527bd4-34c0-42aa-9fbf-dd5128ac5b26", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662685422, "uuid": "72e5ad06-c5e8-42b3-9bd8-57a52e10aa04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685422, "uuid": "6089019c-5079-450f-86c7-9adebc0c5d66", "value": "23b72f054ccc71fa256aa4dcfbff274b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa3d06d-3016-11ed-9266-42010a9c0072", "comment": "Malware payload (DeadBolt)", "timestamp": 1662711058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711058, "uuid": "dc9ea044-1458-43e3-a360-11a7091a116a", "comment": "Malware payload (DeadBolt)", "value": "79666eddbc38ddaa4b3d6a5b8a44161f", "object_relation": "md5", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711058, "uuid": "6ea47f3f-2d97-4b75-ba03-6fd52a238fca", "comment": "Malware payload (DeadBolt)", "value": "184747ba1f080561ceea7f0b96dd0a8c1de2b7b2bdc2fea39954949d29aeaca9", "object_relation": "sha256", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711058, "uuid": "84d82517-1140-40f4-9342-9219871444a8", "comment": "Malware payload (DeadBolt)", "value": "81063e161a55e3e802356ff45cb4ac8131e6ab4d", "object_relation": "sha1", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711058, "uuid": "815d15b5-ac3f-4740-958d-0c7ed4bcc5a1", "comment": "Malware payload (DeadBolt)", "value": "5a01367868ddcbc95682caae463df684731729cd01a805f60152b47a3ac6b60e164f6d719934d5b5e6e93ce0e5492d6c", "object_relation": "sha3-384", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711058, "uuid": "b37cc961-6d16-43ae-80dc-83aa67fef306", "value": "T1A5D51887B8964183E5E13ABA78BDC0C4336216BD978723567D05DF353E7A88D0E3AB11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711058, "uuid": "d6e3db9f-e612-4c27-8759-d236cd31f7b2", "value": "49152:MwoI9tsN4k2b5xJXAzkItbJENW4V5F76I8cs1KAc61:MwP9tsN52NxJQzvYWsH7psg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662711058, "uuid": "f01dd2e9-9849-4beb-81cd-92b90b7626c2", "value": 2949120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662711058, "uuid": "77a4601e-86bb-4ddb-b3a1-8110bbbb1c43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711058, "uuid": "45d0d7f1-8044-4a99-a7c4-08823b60bd67", "value": "184747ba1f080561ceea7f0b96dd0a8c1de2b7b2bdc2fea39954949d29aeaca9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffee0542-306f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662749311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749311, "uuid": "8fd87529-1936-4dd3-a2e9-52073d6c0d63", "comment": "Malware payload (Mirai)", "value": "fe0632a1c20dac97d9f268f355bf4aec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749311, "uuid": "119cde86-6756-4cb1-a1b0-1625cc1d2276", "comment": "Malware payload (Mirai)", "value": "19b518db2b8e612f6b5f20e247aed3d431133b385d9f627e1b78b0f7afac5149", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749311, "uuid": "ff75e45f-bc46-45fe-8483-8480a4098369", "comment": "Malware payload (Mirai)", "value": "08ff9dd047e35a01b0b35fb198a54779d35d9556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749311, "uuid": "093cebb7-7d6a-449b-890a-2cd695143c00", "comment": "Malware payload (Mirai)", "value": "0386826403aec473333ee11b42ea11e4935552d5cc8a5be9a504c8fdbd2bd5e6da349261b74ef8d256fb95a9d27e37ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749311, "uuid": "f1e578e8-9670-4ce2-a6fa-d7af81d8f59e", "value": "T128F2E13C21052938E8B9C8BA09DF0790DD300FFB70D39D4675A149B2DED56D67627E28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749311, "uuid": "5d17d4de-4455-48e7-a379-a3a568974569", "value": "768:5ine/EAD5pp+7u2M6TM31qNv4P3DE6wncvdaJgGlzDpUYsI:5inEEAD5ppI6MNeE6wncvkVqYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662749311, "uuid": "12a9e619-3c1d-4d9b-8500-e6ef2e84bb5b", "value": 34988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662749311, "uuid": "64e057fd-52b0-41a7-86a0-eee174e92583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749311, "uuid": "065e5b3b-e8ef-45ba-a0b5-7e4623d88430", "value": "SecuriteInfo.com.Linux.Siggen.9999.14570.19070", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f303893d-3016-11ed-9266-42010a9c0072", "comment": "Malware payload (DeadBolt)", "timestamp": 1662711064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711064, "uuid": "ea27a2aa-dbe5-4052-ae87-960ac7e3df5e", "comment": "Malware payload (DeadBolt)", "value": "4fdf83e0f0fcb12626f3d97173b0b66e", "object_relation": "md5", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711064, "uuid": "7aaba076-3e85-4b85-8ef3-d4b5a1c38b25", "comment": "Malware payload (DeadBolt)", "value": "1ac1f9f9c519c7e141dcb1aa8157feca7943fd85db3d0a31f01e0fb44d239890", "object_relation": "sha256", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711064, "uuid": "dba600ba-abac-4e10-8850-eb9b758a02be", "comment": "Malware payload (DeadBolt)", "value": "eded69db67a11a94266e900540f879f2078c32a1", "object_relation": "sha1", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711064, "uuid": "2cf24bcc-5a4d-4b2c-a7c9-7c844d8016c6", "comment": "Malware payload (DeadBolt)", "value": "1c3e536df7f9a72b6fda0f4b571814e8451cde603c5250f89ff0e942f3868c8aca80ebfde7f618af85b61559f767359f", "object_relation": "sha3-384", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711064, "uuid": "6569011b-44b7-4956-a829-c9a290a1636a", "value": "T1ECE54C547D3D7843EA9DA33437B043D9322EF689CB91423B4E619DBC4EE53AA8F12512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711064, "uuid": "eff00a5b-f7bb-4333-a3a8-274ae5b9a8b7", "value": "98304:6p/QJU+e2MP2wmdraHl9xtA6o9oOVxl4rHqrZ/C/ccuyQ0f6ZEr:v6yp2uyP6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662711064, "uuid": "779d838e-9050-437e-bb3e-bf5e6ab26c72", "value": 3211264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662711064, "uuid": "bfcbdd28-86ce-46ab-b1a7-d5e6ee0b6c47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711064, "uuid": "9b9de821-3244-49c6-9604-b0706c12a419", "value": "1ac1f9f9c519c7e141dcb1aa8157feca7943fd85db3d0a31f01e0fb44d239890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09aa91a2-2fdf-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662687050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687050, "uuid": "c54e48d6-141a-48ca-ac68-f4686f6b134c", "comment": "Malware payload (RedLineStealer)", "value": "c94a24d49cf95633feb08e1b13e2a77e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687050, "uuid": "d5cc6629-fb4d-461f-9e9a-d1f858e35bde", "comment": "Malware payload (RedLineStealer)", "value": "1aecbc3d57c7f81ce0fa2f346c06f6672d13edc36474933266f9d3406e341afb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687050, "uuid": "1f0083d5-41e8-46c0-bef5-e743c2f97e77", "comment": "Malware payload (RedLineStealer)", "value": "79185a81a76dbfdd76418ee0af53c5fa68904bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687050, "uuid": "699627bc-251c-4a61-bb45-d4e7cd478395", "comment": "Malware payload (RedLineStealer)", "value": "3af882fe55f5df583b27beecd2953a5a3995901e22739d02429591c55df10cc7a6967f39559631c02057099aec507a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687050, "uuid": "e4942deb-61ae-436b-9ccb-8eba427f73b6", "value": "T15724CF31B590D872C7A646308434E6A53AFEB8A25A38894F7B543F5E2E313D12777327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687050, "uuid": "bd231280-b47a-49a4-900d-f2f9fda081f5", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687050, "uuid": "54b2a73d-fc77-4e52-920c-736b73d6aab4", "value": "3072:+AbY55vNYmrG2YeJccZlXEFZr6bhDv2xzLrEaIyp:dovzaxcZlXEFZ+hv2xzcav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662687050, "uuid": "cf5bd782-6a6d-498c-917e-0c5a8e91f9a1", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662687050, "uuid": "8ba7ad2c-6a3a-4dad-b751-8da0685ebc5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687050, "uuid": "ac3b51d0-8504-4e60-ac3f-7afbf7a4ca4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91353d1f-300a-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662705746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705746, "uuid": "cda72802-d6a7-413b-be1c-2113c3181245", "comment": "Malware payload (Smoke Loader)", "value": "e308af5e71a524d74fc812bb57f3eac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705746, "uuid": "5f9cc5ce-ea26-4f9d-815c-5b133f7608f0", "comment": "Malware payload (Smoke Loader)", "value": "1bc07c72f6b1be3d757308d85ee5a1dabf02fc66078f0178175f501342541900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705746, "uuid": "a6505c93-7d03-4c74-85c0-abb64deb83d5", "comment": "Malware payload (Smoke Loader)", "value": "38d6eec6209490b2355533d9468605070594c6fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705746, "uuid": "cb6308d6-f693-4944-833b-e2ad25cebea9", "comment": "Malware payload (Smoke Loader)", "value": "4ce0d42153aef6fe30d5354c740381357ef09d837b6897af5f06709d243679e67eaa2ef6923efa2c8ce0c5e15786140d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705746, "uuid": "1a79dd7d-46e8-4a98-b61e-70caa039820e", "value": "T19224BE22B990C931C4E356308474DBE56EBBBC611A64998F7BE43B6E6F702D03636317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705746, "uuid": "c6a57c9f-6f4a-464e-99e1-7c0ef9e4cd35", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705746, "uuid": "8b990400-40c7-4861-8515-95df70ddd7cc", "value": "3072:UXrqqvx8vuPsd65mD9fMeWHcPgXNuXAS67wIuQXREqXcXsgXqfexcv:QwvSsvDZMvcPg9cAJ7wIZXKJIexc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662705746, "uuid": "ef55317b-ca93-4cef-85de-af9b1cd03359", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662705746, "uuid": "565f5d1a-5862-4980-9597-eb09c298a861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705746, "uuid": "e0ea9b81-6cbf-486a-b69e-4956dfefda9f", "value": "SecuriteInfo.com.W32.Ransom.QS.gen.Eldorado.25713", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5a496a-306f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662749308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749308, "uuid": "29244bfe-ec17-46d1-9804-f63791e19faa", "comment": "Malware payload", "value": "a05ea65ba02eb7162e361837cd67bdf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749308, "uuid": "3758d031-92f5-4de0-aaf1-2ba88850b587", "comment": "Malware payload", "value": "1c2ed8e471b06a7dd81de32ff5d02284fe83e37f94beb4e6e033ba06b93c0729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749308, "uuid": "945dd10d-719e-4a45-a064-feceede10a9a", "comment": "Malware payload", "value": "f1f9d2fbc6180f2dcd2da132f8a2e97251e921ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749308, "uuid": "92c6f134-2f54-4947-befd-3e364f33bbcb", "comment": "Malware payload", "value": "0d3cd7afe1a80f06396d228b10605d92012d485fa49ca8c249301862ec742fabcc127bd8aba110a657c4ac5e5eb62d17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749308, "uuid": "9a722655-65bc-4623-8cd2-6464ffbf5085", "value": "T12D7240105B916F6BE8138FB446123282C3F86DEBEF86D61F5ECE101A2B761D07C89D64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749308, "uuid": "db83edd9-400f-41b8-ab0a-143c2d0c7c2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749308, "uuid": "eeb44786-4409-4efd-89f0-cb8bbfbfaec6", "value": "192:OG9sq5v9DDDDZCEHeK347Ljhgqwo2/Daryr13kQfwvxk4Hkqmwt:OGjCk/34PmqwX/D2yrlffkxttma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662749308, "uuid": "5ab1dafc-11d7-407d-92da-db97f1d93338", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662749308, "uuid": "85e5c9bd-62c9-4613-ba1d-b1e0824b8d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749308, "uuid": "16e5a28b-cbd5-4544-9809-5d2f7de9d917", "value": "SecuriteInfo.com.Win32.PWSX-gen.29299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9258b4c-2fdc-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662686163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662686163, "uuid": "4a354ed8-f933-4372-b2d8-6c6fac4002c5", "comment": "Malware payload", "value": "a79e9aff885b5aa305517c3836d10be1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662686163, "uuid": "4ccd9229-97bb-4163-b318-a8b465487cc3", "comment": "Malware payload", "value": "1c5bf7e3edbccd4fe44d97baba8529438169f346769e109b2b660d1b45b2a02b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662686163, "uuid": "aa43ec00-4c1a-4c52-841d-ec196e72c878", "comment": "Malware payload", "value": "a71d4faf5b3d863144d361129c4f52b6e66de27d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662686163, "uuid": "f6274d5c-36a0-4efa-890b-7202feb12701", "comment": "Malware payload", "value": "2cce52156b7ba2f9395bc02f858130fcbc3bce78f7d464c167a6cfb51f4126a84d616e8b19cdbbcbf96fd155e2a4b15d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662686163, "uuid": "4a712ae1-2828-4206-89e6-39c7717bc56e", "value": "T1DFA4011127B6F315D2148BB513FB835801A0FB315EA34D0FBB0C6B5AA636D96D2BA317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662686163, "uuid": "a8d49396-7f55-4d8a-ab1d-59783f3ac334", "value": "df8fbcbe90e1e305a660f0ac2aa4fae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662686163, "uuid": "6d20fac0-1144-4074-ba18-02a23f5b315c", "value": "12288:d8WnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:dnxgsRftD0C2nKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662686163, "uuid": "b47c559a-0bf4-4fa8-8f64-23b2a20bae5e", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662686163, "uuid": "fe6f2943-fbfa-445c-8f96-43dfd5a841a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662686163, "uuid": "3be942ad-58c6-4b28-9903-660946ce06c7", "value": "a79e9aff885b5aa305517c3836d10be1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebde344-3046-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662731485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731485, "uuid": "af2274d5-e9ab-4dbf-8717-8e00c5309c26", "comment": "Malware payload", "value": "41b753aac59cfcc10c8e502f07bb34db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731485, "uuid": "9ad06649-2513-4b3b-9ae6-85a15aef4337", "comment": "Malware payload", "value": "1ca770c569104d9eb3ddb63c3993362563f978dab73e929aa746446536eb34b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731485, "uuid": "c0553462-2811-4d81-9aee-34d13e53baa9", "comment": "Malware payload", "value": "499ca4ca00d6ae0d1cdc384b94b76e9513be461f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731485, "uuid": "5f599f34-544c-4159-8e18-8b88ead556de", "comment": "Malware payload", "value": "467525edd4b04930e8936db61584f307ea69e2c513e778d35251c5cec4fef457e9ec58b24d2c39e3b12d943c31b4e83a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731485, "uuid": "0dceafcb-9ea5-4ae2-b168-25120af4bc9d", "value": "T1DFA4AFD568AF8046E884BCF05096B7735BDDBDBB2F09CAE71B541D2BE8312C191264EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731485, "uuid": "77274bea-fdb9-46b5-a069-3b2e86749b71", "value": "84df75911ee4a4dc00765ff38f6b934c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731485, "uuid": "618f7f67-8f65-4fcb-8ec7-b71120862793", "value": "12288:nDFhSg4nkx/LMw27kcmgexU51plXKixdvKXsmR:nD3S1T6YhxlNqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662731485, "uuid": "89ecddd9-9e2c-4059-bcce-4a9e6d519a12", "value": 459676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662731485, "uuid": "9a151189-2037-4b08-8a3d-8b98d29d021b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731485, "uuid": "28319436-c433-4a81-ac0e-90b5ff2d1b18", "value": "41b753aac59cfcc10c8e502f07bb34db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb6e0b2-3030-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662721979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721979, "uuid": "a9d6657b-2281-4274-8ee7-76b8c4ad5e73", "comment": "Malware payload (Mirai)", "value": "82f0dcb4329e5679d8c8784a852c8fe2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721979, "uuid": "99b4dfed-54aa-4d78-8745-9672e538700c", "comment": "Malware payload (Mirai)", "value": "1d7151b5ccc5b6edd0499d416f6d514693da56192121ca406cf77981b7433126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721979, "uuid": "a517ad99-27a4-4001-a7b6-878040257a31", "comment": "Malware payload (Mirai)", "value": "2d27d50de91c7bc7343aa4ae09252b64f4bfb32f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721979, "uuid": "ec8a4c30-0771-4b87-88f3-0479c3987111", "comment": "Malware payload (Mirai)", "value": "9daad428d65bb8884a6f6a6c485681b305ad9283b8a8036cd996fc0cdf3138202e21de7a0248c66079055b5206894882", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721979, "uuid": "9ebf0c5d-e4ab-484d-a9c0-1b3e83dc59c9", "value": "T1A4E2D072B302249BE994C1B732D0039C2AB55DB168A7D146E401F1CADE974B7ECE3ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721979, "uuid": "b6123cec-b537-417f-bcd0-835520327202", "value": "768:5sBByhHYRC/njNGwssMUrWku87wExlGJgGlzDpuW8:jhHHv1kExlyVEW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662721979, "uuid": "c78d2fc6-507f-4cb6-b804-f69049157cba", "value": 31820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662721979, "uuid": "9a055020-923e-4a9d-bf20-3da3942073d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721979, "uuid": "7538ccd9-abe9-4d66-b0a3-0f8f35e3c12d", "value": "SecuriteInfo.com.Linux.Mirai.2130.18527.24508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1508d80-3039-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1662726013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726013, "uuid": "b44e9087-1971-445a-922b-8d4884ac4ea2", "comment": "Malware payload (GuLoader)", "value": "7a6b79cdd5459cbc8489bee38c284c61", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726013, "uuid": "0bfb00c5-f772-4640-8f42-bde43af14e54", "comment": "Malware payload (GuLoader)", "value": "1ec9c4f108f6ce4efa9de2883f56eb67e0320a76785b9bd84065dc492b0b3edd", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726013, "uuid": "cf2a8dbe-905d-498b-948d-a1cebf5679d4", "comment": "Malware payload (GuLoader)", "value": "b00e548ba5897071cb4ebd32742625ecd37f0ef2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726013, "uuid": "3e0d6f28-2248-4a01-8bdd-6540c6b286d7", "comment": "Malware payload (GuLoader)", "value": "a6a9c39ae5729bdf7e7606059c896dde1c9d8a907a1a2312561cb766f88f8326c5514f6be165450886bf0b96f831a907", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726013, "uuid": "483cdc6b-fe34-4b15-aaeb-a513fa0910ef", "value": "T15B630271AA1E6B437A9A4958B3A46097BED9742EC4D13F29E0473F01B9C778011B6B08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726013, "uuid": "541b4c1e-6b85-467a-9e0c-c63c7420e5ec", "value": "1536:6VbF8Ky+mblkgerQoi/ebWQf+YtNw4BtfUCX/gBz:6Vx8Khmbl723f+sPBKCX/Ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662726013, "uuid": "c623aae1-552b-496a-a3e8-7d505c82d7a1", "value": 69100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662726013, "uuid": "bac32913-b57a-4622-852a-fc362a53919c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726013, "uuid": "1a088ff7-a0e1-493a-9c91-375640e7e287", "value": "Powiadomienie.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c942335-2ff2-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1662695269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662695269, "uuid": "0746c5e8-6079-4893-a930-6d6bcc006fe1", "comment": "Malware payload (AgentTesla)", "value": "5ba704879a8877ce21de26f6d54abd78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662695269, "uuid": "0ffb5781-224b-44c8-8572-84bb8c738d5a", "comment": "Malware payload (AgentTesla)", "value": "1f1fd45c3e5560960e07e8480bf9a692c92a50f3a4b173e13fa0b673204d84d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662695269, "uuid": "c6b00aa9-947c-4ca4-8e99-d66e2dcc6f84", "comment": "Malware payload (AgentTesla)", "value": "34b9c513786e92020f9c1ad7027e6aee17286d7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662695269, "uuid": "a3fe8746-85d8-4c8e-b26a-140dd5d82d55", "comment": "Malware payload (AgentTesla)", "value": "fcd6f22d9429a56eede73d60416be4d22b393adae84d80deeec22d36997afccc918436207037a0b1dbae10fe0da63227", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662695269, "uuid": "391dba5c-5818-4313-a903-d3a3dd2250b0", "value": "T189253B0721D509A9C07250BC24CCC5B35BAADE55E63BC946BFC9DCAFF592F2846D22B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662695269, "uuid": "05b38f2b-ed6c-4f1d-ab9f-462f99d7e2f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662695269, "uuid": "eeb3990b-270c-4010-8a34-d94b2acaa1b7", "value": "12288:Hkd1x1/QNpF9Y9AQJ1VwGeH2cxOWbjYmdbn1CjI3pN7l714WOt07:e1gQJ1VvpcwWy83p7ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662695269, "uuid": "d13c1e73-7a6d-466d-8cc4-56b70eeef77f", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662695269, "uuid": "16b3a8a5-e2ed-42c0-a1e0-714380f1dcfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662695269, "uuid": "3a9d3cdc-7cab-463a-927e-58670815b65d", "value": "SecuriteInfo.com.Win32.CrypterX-gen.10284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bd22a2-3069-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662746633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746633, "uuid": "9543ba12-317e-488b-b87b-cee5000999d0", "comment": "Malware payload (Mirai)", "value": "844762b459f097a7383900cc7ab2981e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746633, "uuid": "ed0b32fa-cacf-40ff-af77-a1f746e62027", "comment": "Malware payload (Mirai)", "value": "201facf932109775246902884d5ba0016bb6336e3cc9004be66ced40f08162c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746633, "uuid": "9aad16c2-5606-4970-9104-8084c3b5cf4c", "comment": "Malware payload (Mirai)", "value": "19889ee453531b001b561c387c5a36b9850c14bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746633, "uuid": "14b4ffbe-ba10-40d5-a14f-ab857ea7eb2f", "comment": "Malware payload (Mirai)", "value": "b8198feae33dcfe6f477285bd79265b50045fe31cea3f3f8af334e279b61ae7d5f1133f9f896a87e827dd3d593e2a14a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746633, "uuid": "347dc47c-d717-4edc-a3a5-e69f3325f885", "value": "T16C338EB5E42A5E90C15602746428DF341F23A6C4E3436EF607A5C3E24457BADBA0EFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746633, "uuid": "4ca2c222-0c94-4652-a0da-8f246f7095b5", "value": "1536:lak4Fo5dqwX4DrqTHIK5pkCCS0ob+10m7:lr4mejrGIK5pkCFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662746633, "uuid": "dd587bb9-059d-482e-a8bb-b609ef1d3284", "value": 51588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662746633, "uuid": "da7a456a-fa45-4934-8377-5a93d2d6acd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746633, "uuid": "f7816d43-be73-41c6-9a1f-fd02bc04e631", "value": "844762b459f097a7383900cc7ab2981e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc13a6a0-2ffe-11ed-9266-42010a9c0072", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1662700691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700691, "uuid": "c3fd3ee8-7463-4957-9dea-f24917dd49f1", "comment": "Malware payload (ErbiumStealer)", "value": "174775a5a69df7d2ef9d27535d54e728", "object_relation": "md5", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700691, "uuid": "42191f65-7a2c-4d6a-b3eb-19c9f23b1793", "comment": "Malware payload (ErbiumStealer)", "value": "2100937b91f7602953e8cd2095c8d4a0a752aec9c7eab27a0537e363e717f260", "object_relation": "sha256", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700691, "uuid": "7019bb1c-aa72-49ba-b6e0-3b10e6a66061", "comment": "Malware payload (ErbiumStealer)", "value": "a5ea0e6da9c1e37eebe4ed59c03b4ce5572b5031", "object_relation": "sha1", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700691, "uuid": "6702a1e1-d9e0-47f6-bb48-e60e2d1797af", "comment": "Malware payload (ErbiumStealer)", "value": "50425089a857c3dd04bd782c7ba18585539cb8cd0a3ad51cba1bca00ef9673b7ff663ffbbad2ad7cea5ec6dd5b789e9e", "object_relation": "sha3-384", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700691, "uuid": "df6ad28a-e190-4c5b-9453-53d7edbf5b07", "value": "T10D253B29EB0729F0DA175772855EDB7B9B18BA158032AF7FFF4FDA18A4330123845162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700691, "uuid": "54579294-c796-4f04-b66b-24f079ecf4c6", "value": "1797ab721d550312b93ab992a1e04176", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700691, "uuid": "f935d887-c758-4175-9c70-07a8eb39fa2e", "value": "12288:/1NAYFt7YHYXn/t72LSzQ6MIg/JWYHsHlAPBQxeCZJ6ZDZkZPL7+m78Mor:9NNt7YHYX/t72LGMR/kYUlAPBpwdor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662700691, "uuid": "eab9dada-8144-4620-a910-2fb5260214a4", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662700691, "uuid": "b3608b73-1ed5-46ec-b293-f9f31dc4fdfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700691, "uuid": "078ce91d-97dc-4a2c-9944-b163c41e7614", "value": "174775a5a69df7d2ef9d27535d54e728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50681a8c-3052-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662736561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736561, "uuid": "330ca3db-300b-4f8c-be04-78a8026760c7", "comment": "Malware payload (RedLineStealer)", "value": "8fb9d15ec2ea5b6977408c7e810057a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736561, "uuid": "0c4b22d3-481a-4df0-be19-d0fbb5f4b5b3", "comment": "Malware payload (RedLineStealer)", "value": "21665567315ac5983cee460bae1e45fb69b71c1ea809fd56bcd9357c1adc632d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736561, "uuid": "b1fb9973-e919-4af0-8767-d244c43c3b01", "comment": "Malware payload (RedLineStealer)", "value": "c40a1b70d32a7e298b1acd9b98c65d9b51a4d819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736561, "uuid": "50cf48c7-a2fc-432c-9846-7856f0eeba2d", "comment": "Malware payload (RedLineStealer)", "value": "49e0a4f6cc346a34a87f2321b98b40da0dd95ff2387d5034839731ca06bca5c61098fefd5f2366ad77881d7aece5b7b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736561, "uuid": "c52e4f45-db0d-4882-9fec-9445b24ec555", "value": "T179453343BE3C4ED4D9705EBA7C74C26481B7A778CF968358EA681B71330438D14A5F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736561, "uuid": "3fedc1fc-a182-43d5-91ae-a0db11db95c8", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736561, "uuid": "bddafdb2-d810-404b-b650-ef600a50d3b9", "value": "24576:3CkfhDjfBGrBi7Hsc5XvjJ82tPmuacs/OkQ21IVIADvLLuZNmIb:39hH171fdFxDzGOhVIAzPaNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662736561, "uuid": "8d9349e0-7ed6-4739-a922-fd9044440d28", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662736561, "uuid": "08037cde-b21b-497c-ac3b-b8039beebfcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736561, "uuid": "b6c0753e-38a1-4036-a287-86ef2942d728", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb9d816-3016-11ed-9266-42010a9c0072", "comment": "Malware payload (DeadBolt)", "timestamp": 1662711053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711053, "uuid": "106b0ff5-7620-4636-ba81-735e8af33d43", "comment": "Malware payload (DeadBolt)", "value": "6529899160b1a80c362ba4fa7b049dfa", "object_relation": "md5", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711053, "uuid": "1376ad73-1cb0-4674-bc0d-486193ad6bae", "comment": "Malware payload (DeadBolt)", "value": "218c40018af065a010943beb9c14eca1ef7e4a1e5cf8d8ceff075c877c1c1513", "object_relation": "sha256", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711053, "uuid": "a957aa53-9d1b-4b67-892d-3711ca1c69e4", "comment": "Malware payload (DeadBolt)", "value": "4c8bf9c273019fe4c5f528a5cb75021994ec7d54", "object_relation": "sha1", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711053, "uuid": "ebf290c5-5dc1-46ab-8470-0b24afaf132e", "comment": "Malware payload (DeadBolt)", "value": "ab17bc775c3c91f62ffa2a48be9af97b3a99d95b5a98ac80ca6804ff140c360e6ae8d0df4c5bfd4100a7acc3825bb632", "object_relation": "sha3-384", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711053, "uuid": "f46686d8-be0e-48c9-8716-fa8c83044c2b", "value": "T10F25334F2044873089A61F6CA871BFD7005B73F5EC9AFE4544ACD149FBF69B8A99C860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711053, "uuid": "c5725672-2e40-4fb7-8da1-bcd1b9e1e74e", "value": "24576:A6Yy7EvX4cialBRPfb2C1KW2mvGbbNkPH3w6ueDWtY/L6yW:Au7EvXgalBNfbHHvGbbw38Y/L6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662711053, "uuid": "4122192e-c420-4bdb-9ad7-32ab03d34ea2", "value": 1010024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662711053, "uuid": "bb09502e-99e7-49b3-a97d-fdca4eb6c70a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711053, "uuid": "39f88c59-bde7-4407-9d8f-3010be1b960c", "value": "218c40018af065a010943beb9c14eca1ef7e4a1e5cf8d8ceff075c877c1c1513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae51183-300c-11ed-9266-42010a9c0072", "comment": "Malware payload (PrivateLoader)", "timestamp": 1662706514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662706514, "uuid": "a68744bf-d7ac-4bea-8817-423870150a34", "comment": "Malware payload (PrivateLoader)", "value": "154d362591590cd7de1fa3ee1c0e0989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662706514, "uuid": "f28b4d3b-35c1-4f3a-8e50-4c2154ce3479", "comment": "Malware payload (PrivateLoader)", "value": "21ce471527c051d26da04e96c2829f450b031767399ea401920ab8b43018e421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662706514, "uuid": "c0eed78e-ba66-450a-b4b5-4a5b91237458", "comment": "Malware payload (PrivateLoader)", "value": "58f4f9222e359a99e4faa9589d4fdb5dab7e9272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662706514, "uuid": "b7d84cec-64c7-434e-b150-3964b70c745b", "comment": "Malware payload (PrivateLoader)", "value": "117d9498e2e57f12b1d3c770593c674f14b80dea8b10aef519d09ef9b3f52869c06ad7348db8bff97f1c0f80866067cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662706514, "uuid": "79371500-7228-4264-9d5a-f5fbcf10c18a", "value": "T1D036233372E66248D4E9DC3AC523BDE936F1933B8683A8B904C97DC139761A1D643B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662706514, "uuid": "cebb19c1-a8b8-460f-8154-d21a614cdff6", "value": "225327f56d1256bcc0bf99d2ebb0a8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662706514, "uuid": "8bfe013d-4dbf-4bc5-8b53-a6656cd542a8", "value": "98304:SoQYqKFaaj9oTAsEqMxBEKt/DGOUqd1j1/Isz3epgEf7Q/NBdsr:Pu4wAX90caOUqFIsKpR7IBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662706514, "uuid": "1fc18967-7089-4edb-9a28-f20d97932444", "value": 5003200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662706514, "uuid": "38254ead-a1b8-4e6f-81ab-96ee389c2b52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662706514, "uuid": "0fb13b43-2282-4923-bc2b-15f1e05f83df", "value": "154d362591590cd7de1fa3ee1c0e0989.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e093ec-303a-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662726254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726254, "uuid": "00c236f0-73f6-4bc0-abb8-41180b3a58de", "comment": "Malware payload (SnakeKeylogger)", "value": "691b361a8ddae9e2ad8498afb816e6d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726254, "uuid": "7f69884d-3703-4a13-b0a5-7a662d371a25", "comment": "Malware payload (SnakeKeylogger)", "value": "2201eda7898979f08187156740f0e2b9012da6d51f0905c3122b95c39bade49f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726254, "uuid": "244e3213-4bfe-4d1d-806e-1c2185906d69", "comment": "Malware payload (SnakeKeylogger)", "value": "813f3f93c3aaea67090b080d82c4c05207fec17d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726254, "uuid": "bfe29b8b-afd0-4e71-b40a-a8d013d87ad3", "comment": "Malware payload (SnakeKeylogger)", "value": "672b97c9c29262c1b0278d6ab7682c7cd0d8af6e4adac7f3a3c5d1addf398515b500ec09f2b56466408800ac03564682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726254, "uuid": "73db6c26-6bba-426e-8f08-eae41bed9345", "value": "T1DC622969D60CDF30D329C73E9982C983CEE2D6E29417C77E600527422AD3F8EC971690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726254, "uuid": "b6074d11-4217-4eac-87ce-3b98ff7a301d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726254, "uuid": "a0e3d71c-8369-4ca7-8ae7-b51c90b27658", "value": "192:Wx330e7z5Fuwsg4rNGUB8bGrHDpUL0qLxVU2RqBVE7ucswQPMCX5C:Q3iwstNG48Ky0qLxVUFzEScswQPM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662726254, "uuid": "c1f37c04-d84d-4da9-b78e-bbb3dba1e0c1", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662726254, "uuid": "abf14e13-9561-423c-9223-382f02482612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726254, "uuid": "2af1a32e-0b39-4633-b884-bd1b0bf6f5f5", "value": "6104961.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156a6d1c-301c-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662713269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662713269, "uuid": "2ba42fab-7689-4f8e-9a19-6c84a1062b08", "comment": "Malware payload (Smoke Loader)", "value": "7192a6e239a310a28e0f25413d854833", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662713269, "uuid": "88640800-07c2-4b62-bcf3-1dd3499c70a5", "comment": "Malware payload (Smoke Loader)", "value": "22f0df4d8b5de178f8620270a4b3c0b4856a53f2f4b2194350523065639e4950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662713269, "uuid": "af4eba88-5d38-400b-86e1-355abb8598a7", "comment": "Malware payload (Smoke Loader)", "value": "47ef31c8bff3c3bd7465fcc56b57d6a5491fd10e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662713269, "uuid": "e6f92c6f-e3b3-408e-9221-b2fe6dbd84bb", "comment": "Malware payload (Smoke Loader)", "value": "03cf18c4bfea409cd76a66b550bd036d33ad449592a3b5939edff780be34d898db362d4126fac19d3ab79deb6868395a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662713269, "uuid": "12a9a6ab-5431-443a-98af-357097028819", "value": "T10524CF22F6D1C470C1E645708834D7E46ABBBC625A384A4FB7983B6E3F313D06679366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662713269, "uuid": "14ca7fc7-8f9c-41ba-a5ca-a4a59df1bab6", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662713269, "uuid": "ebd303ae-9c92-42ae-ab24-221f2a117aea", "value": "3072:N/cUDmIrzBSUN+65IzNVzYAQfqxTKLx/JU6BlxNZWwiDe4y4NbWwGWs:qiRSeehR9LTKLx/3lD4eWxWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662713269, "uuid": "32b84760-797d-432a-a08f-d102e2d4e688", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662713269, "uuid": "83302229-9506-4c22-9f8c-fcea852e0445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662713269, "uuid": "a18df753-8b79-4ffd-a60b-a3a307b5078e", "value": "SecuriteInfo.com.Win32.Evo-gen.7129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f499839a-3040-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1662729105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729105, "uuid": "39a0884d-9523-4e76-b0da-3b75f37f87d0", "comment": "Malware payload (ArkeiStealer)", "value": "fc7d69b09c01c0b04274c8580f54d2e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729105, "uuid": "1318f6e0-aada-4359-8cc1-d3e278e01880", "comment": "Malware payload (ArkeiStealer)", "value": "248755caac15d22ead0ec7146322f12adb6fda31370a18aa2bbf0e131b59d373", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729105, "uuid": "8ab12f4f-1a2b-4fbc-81bd-de19221e3130", "comment": "Malware payload (ArkeiStealer)", "value": "18fef00e6606f4b57e2b9aa150b47aedb1520301", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729105, "uuid": "64cd1df8-d05e-401d-8e6e-9933a0fc15af", "comment": "Malware payload (ArkeiStealer)", "value": "1a0c230a45eb12912187c9f51b49e6f7cf380b0ccdf484adeefdb545abfd7b231d7196f3439532ee6fea59e510652384", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729105, "uuid": "9b70eae4-434f-45ab-b9c1-4e0c2d514278", "value": "T1FC54951BB8961406EA10FCB2D952C608C9776B27424A663FD5ED6F37E0C16FE8F38815", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729105, "uuid": "0fad0383-f925-48fc-b31c-a32cbf2657b7", "value": "a490e3ca20f57194cb1f4b473b3242c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729105, "uuid": "09c503b9-fae0-41ec-9cf2-6f648a5407c7", "value": "3072:rsDylUVlBjzyfAdp+7jnffor+QbwV2ZhQ8h6Wrj1he0bjRwjuuglkfpxij:wW+VlBjzyfKUnffE+QbwV2ZzelCkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662729105, "uuid": "ade1cee6-8133-45d7-acb1-1b8834cac2c1", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662729105, "uuid": "c00b08b0-8d3b-4db9-8b14-03b3174068e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729105, "uuid": "a12f45d0-8902-4200-99aa-7a5f9bb29230", "value": "fc7d69b09c01c0b04274c8580f54d2e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1237d2f7-3074-11ed-9266-42010a9c0072", "comment": "Malware payload (ModiLoader)", "timestamp": 1662751059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662751059, "uuid": "75976c03-4600-4431-ba38-dfae514350b4", "comment": "Malware payload (ModiLoader)", "value": "f7be6ab1521e627e3c6c0ab083e944ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662751059, "uuid": "33751812-fbcc-4e3f-914e-10b876c3e843", "comment": "Malware payload (ModiLoader)", "value": "2544e32eff5f95ae34427b3557e1e0bbf04b8bda6a0675313f9898e7708df7f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662751059, "uuid": "30c0772f-4c18-4cdf-9e93-f8a2ead6e503", "comment": "Malware payload (ModiLoader)", "value": "d85fde48836edc3575eb4034a5cb3a7ea4e66d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662751059, "uuid": "442a0bc5-aee7-475d-87bb-04e356fb28ed", "comment": "Malware payload (ModiLoader)", "value": "da9f50272f89f96f7be8d9962b017859bfff89b4ed75293e93bd1467392e4144b98980743b9f894dd550f31852443f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662751059, "uuid": "262c5ba1-3fa3-4d96-b8d9-6cc4fd3b864a", "value": "T1C035AE13E1A18476C4322B749C1B59547DB9FE006A28A4CA7AF43D8C9F797A13C3B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662751059, "uuid": "034f6335-6699-4002-89f0-51f3fe86d55c", "value": "a3acdbd252ab47c25fe9e8ae6640d53a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662751059, "uuid": "4708d3ca-5ea8-4920-83f5-2619ed07bb0a", "value": "24576:nxbknLD2BBo8jpnJdAjlVBLle0xmUcIYW:nxYnLJ8bsd5fxmkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662751059, "uuid": "fead137b-4363-4b40-936f-a827c3f1a22c", "value": 1076226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662751059, "uuid": "e9a3ef74-ea1e-4050-9f8e-761287ff52b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662751059, "uuid": "ea833047-17fa-4693-94e2-a6ca253ecb14", "value": "SoA & Invoice .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1da984-2fea-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1662691918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662691918, "uuid": "6b401221-8de1-449f-aa54-14fe2abea00f", "comment": "Malware payload (Formbook)", "value": "0b909b5733aa3a6672709bbfa4b3238c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662691918, "uuid": "b366e4ce-ea1a-40e2-90c9-498a691841ee", "comment": "Malware payload (Formbook)", "value": "2548c04db4ea5f38623e33475254f4429f0278f86da3326d742746a46dfb5d85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662691918, "uuid": "ff43440a-cc74-4f8b-9689-0d54eaf82b57", "comment": "Malware payload (Formbook)", "value": "162695c6ebbfb5ae34b3bc8eb0ac25f034697033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662691918, "uuid": "574118dd-366c-4412-91bb-877e4cda4465", "comment": "Malware payload (Formbook)", "value": "50980279aa73d9e27e0a78ffd07371f1601241ce62891e39b12a8566ff519cfcae39ffbe01d4bc9a8488e5607daace6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662691918, "uuid": "c48340dd-c21f-4657-b8ee-e2145b25f2ff", "value": "T11372E71573A4C7BDCEEA07756E67470206A7FE41B422CE2AD4E4719F6E722C109825D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662691918, "uuid": "d0dada23-0beb-4195-ba40-fd2be34395bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662691918, "uuid": "bdf829ce-00c1-48c1-95b3-b10936009088", "value": "192:Te45ILGZPBmwQpmd3YUziJ2hqyqyeyKyU0yD:T95ILGZrvqXDHj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662691918, "uuid": "01907844-d31c-4243-a3bc-c028b4c0014b", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662691918, "uuid": "fd111ebc-47a9-45fc-b273-4fc64fa7f8c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662691918, "uuid": "dcb393c9-256a-47c3-ba98-3d4f3990e3e5", "value": "SecuriteInfo.com.Trojan.Siggen18.44423.26941.4148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a18b27-309a-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1662767406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662767406, "uuid": "67adb29c-2670-4901-96ce-350fa6c2da83", "comment": "Malware payload (Loki)", "value": "057f78bc9119e78e98380aa1d0d2b207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662767406, "uuid": "805ce3c4-d1e8-49a0-b991-9ce9f60ef6f2", "comment": "Malware payload (Loki)", "value": "255703e38afe20fcac1dc5662458d52badebcf0634abac5dc2410c99b784469f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662767406, "uuid": "24290dae-2223-4e5e-91d4-ab508e45467f", "comment": "Malware payload (Loki)", "value": "8ec9088adbcaf3917c01d43397cb3f8f17462144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662767406, "uuid": "3b945111-28e2-4c05-b83a-ae12423fff1a", "comment": "Malware payload (Loki)", "value": "00cfd23c91e1aed14135899b8840eeffa6451be7c72c2d63cba0ed7a6784705792252926b73209b30c5c77479d29c7b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662767406, "uuid": "8a2b1705-99f8-479b-95da-711b0d06e5a8", "value": "T14173BF61E7956CE5F807067E9ABFF8152027BE9A84664C0E216F322DD97334290F7D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662767406, "uuid": "f966f901-e835-4c37-b786-fd38797fdbff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662767406, "uuid": "2d7d8591-acec-4e31-a3ed-6de370549748", "value": "1536:Zr1EswBBTZspN9/ERy9ynPgiaDx8FOqu+ZIJNa5dGKU9K90oajG2WbT37qWBzUu:zehdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662767406, "uuid": "36df03e2-0e51-43b5-853a-85c5bfb50f2f", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662767406, "uuid": "972ccaef-c83b-431a-b7fe-d7632271b257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662767406, "uuid": "10f73f4c-10f5-41e0-9899-c0ece06bb231", "value": "SWFTRNS00922PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4431dba7-301e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662714206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714206, "uuid": "a4bfbbab-e690-4701-9d54-407d04567ffa", "comment": "Malware payload (Mirai)", "value": "87d56e3e7f452f39c2227146c75d1a73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714206, "uuid": "9eb42a36-9c0d-4ab3-80de-0932b248cd15", "comment": "Malware payload (Mirai)", "value": "25d182db9f9028b7f0b11c55a2be7ccf4befc3b2ffaa6d5e8ade2b265890047a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714206, "uuid": "a22c7965-3860-4eee-b6a9-f25e081da625", "comment": "Malware payload (Mirai)", "value": "fbf77988806cbf0a455ff7a8000a28b7f20a97a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714206, "uuid": "748c0c2f-0090-49e9-a632-5fb80f58589a", "comment": "Malware payload (Mirai)", "value": "347a228ad65c00524b6a4cf754f31c41b3ad87e8f53597daa1a307388e05cd1fa50958ee73cdcbb672a1a87077703fbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714206, "uuid": "e751546c-6b68-438c-9197-508df1b6eb02", "value": "T105B3C60ABFA11FB7D8AFDC3749A91B4624CD551721A93B39B930D818F31A24F19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714206, "uuid": "892bd826-0b60-4f2a-9375-7f91ee007292", "value": "1536:B3jBRWZuNvrE1lE9oPiJhG3/mjNE9oPiJhG3fmjRjDryBL3A9t3L5t0JeSZ67nb3:B3tRWur8yE0JeSMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662714206, "uuid": "069f0b6f-d8c2-4672-aea4-388f83d03389", "value": 109080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662714206, "uuid": "6b2d7e30-7265-4004-831c-b4acc3bf1ae3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714206, "uuid": "61694fb7-8641-4b90-876d-894ae682bdc0", "value": "87d56e3e7f452f39c2227146c75d1a73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5615d2-3027-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662718216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718216, "uuid": "7253e42e-78d6-468f-830d-3aadf5c54121", "comment": "Malware payload", "value": "8edcac82cfce0d556cd62666f4b5771a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718216, "uuid": "8a419ed9-96ef-45b0-b5ac-ac5d89cb013e", "comment": "Malware payload", "value": "266a866266bb16ab40863bc93961c03b2556128aea19c94199f8313f8fa0902b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718216, "uuid": "cb98fdf2-7826-46e6-aa1a-96f7f3f9db62", "comment": "Malware payload", "value": "383453bd9f838ac0d7c9e50c67ca9769257c9569", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718216, "uuid": "78efff0e-88bf-43b8-8e31-8368465708a6", "comment": "Malware payload", "value": "9c2590df9326e7da4349ee275bf19e24bc390c3a6f94d665284a572992d5857104879928a213dfbc40fdd8a0c98b283b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718216, "uuid": "de450673-d20d-43cc-ae1c-fa9e5e07307d", "value": "T11F828D31C96DC277D602A7B493A41A5BF72EB06E916B166B2C8C76CCA9415FC0F43E0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718216, "uuid": "5e01ff74-cd2e-4762-8941-f4025e409ad6", "value": "384:Pcoz+q7G5rn4xIEZkORVBEL3gF1BPd+I+pjrOwG41d0jMOX8cdWPGpyS:PBJ7en4xIEZkORTEL3gFvEZrxGs/bc6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662718216, "uuid": "8ec40138-259c-4528-acae-3ffcda6cf263", "value": 18738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662718216, "uuid": "5f280a10-a996-44ae-9f82-6b90c26a7ea6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718216, "uuid": "a85238aa-b76a-4798-bcaf-9f280424170b", "value": "Untitled attachment 00002.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1a3045-3052-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662736666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736666, "uuid": "ef667026-6bb4-4a38-b743-ddf44ec252d5", "comment": "Malware payload", "value": "f9bf035d10d5e165260e82a58f820b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736666, "uuid": "431e5832-c127-46de-95e3-94ad60fdb9a8", "comment": "Malware payload", "value": "26809236fa3db2204c9a400efb77b5351b002daeb6db92267265ea4d05fb4801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736666, "uuid": "edaa3431-403c-4db4-9963-b135966e59b0", "comment": "Malware payload", "value": "fdd43322943b029bb4be14b778468155579850e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736666, "uuid": "2aefe34a-2966-482f-aec8-2e18974ce704", "comment": "Malware payload", "value": "36c823a765f9685368e52b267302343ab234d5988034bfe06c42020f1003ff1889bfb45795b05a6ad270d636f473c387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736666, "uuid": "4f83b790-f81f-4ec3-b286-d1fc7f438901", "value": "T12D64E006BE80D527C8A14B714E26D2726F78BD56AEA0831737C1BF9F3D7E182598E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736666, "uuid": "4b5246e5-0fd1-494c-bca9-756f31a16d79", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736666, "uuid": "4f252810-bbfe-4ef5-8df7-093085c8ed9e", "value": "6144:YB+pgUHj4qtMtsSoaqeV4rakx2gX9BcQGQ:YgP0q6WSoqHkxNtVGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662736666, "uuid": "f954ecd6-5ebf-4bcb-bc4c-9d5bb9b6f8e3", "value": 309624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662736666, "uuid": "c42173d4-3070-4ae2-b063-a5557368dc2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736666, "uuid": "5a463552-ed37-4f72-a3db-7416b0b3c46c", "value": "06 crypt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd94563a-2fe0-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662687889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687889, "uuid": "3d0ea4ec-1b41-4e03-aca8-c5e062897f48", "comment": "Malware payload (Smoke Loader)", "value": "d8e2c8c8b7e44e32dbfc49034917e5ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687889, "uuid": "a3cd3984-fb5f-436c-a41b-29bb51456757", "comment": "Malware payload (Smoke Loader)", "value": "27a04c537819dc2c01cb89012bd39e0ccb159ffb65a98cc68eb5ea517265f8bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687889, "uuid": "17252452-68f8-43a0-95a9-07650c924eb6", "comment": "Malware payload (Smoke Loader)", "value": "b3a20c7c6f4a04b11485f84c6fd1f0f0bc73a609", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687889, "uuid": "1b65e1d9-7185-456a-9c58-842ae2c2f35b", "comment": "Malware payload (Smoke Loader)", "value": "550b43519e81deee1c39a2074888a56ec79885b1b176227450d0ea93a010f59adb879dd68d6d862e71140a9a433e7d69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687889, "uuid": "15c5b389-96f9-4cca-ac49-ef72beb819d8", "value": "T17D24CF12B590C833C7E24430447CD7943ABBB85A5B68595B7B543B6E2E303D276BE33A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687889, "uuid": "7b4fd7ea-43ad-4fac-ab2c-154aa83cc0bd", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687889, "uuid": "694ba076-10da-4247-a3d9-72689cd98227", "value": "3072:k4MoEZBl9R7b1eBJcgWxpPL3wAQxAdjw58rzDVS8J1Ig8W7tg+p:kZlRn1eexpD3wHxIbrX2gTKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662687889, "uuid": "e6ced622-8801-4bd1-b1cc-ec12e84805d4", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662687889, "uuid": "405029b4-b1b5-493d-87d6-2fe5980f1d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687889, "uuid": "3977f1fa-f228-4f87-8de7-878c28dbc95e", "value": "d8e2c8c8b7e44e32dbfc49034917e5ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a04455-3012-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1662709214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709214, "uuid": "4e7d8a66-99bc-4cec-a222-feb44eb74ebe", "comment": "Malware payload (Loki)", "value": "179abc9c09c244ad4c17cd71084a12d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709214, "uuid": "f9621ec7-92c3-44f4-a8f6-485a667ca636", "comment": "Malware payload (Loki)", "value": "27e73b1508f3d4e114390a25e11c201bfa2a66d8cab4e385d9bce54fc2df206f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709214, "uuid": "2c76c22a-a6c2-4082-a507-2a32ebe4ea94", "comment": "Malware payload (Loki)", "value": "2b07788e2e415529ec30d06c96fbccb58ce8f1fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709214, "uuid": "d6a25817-6740-4b08-b236-55169795d7cb", "comment": "Malware payload (Loki)", "value": "4b64c395eeaedeef2304d8e177be1de76e11207b32e740c93fb9c7edd4e2e8f7f69332fcc1b5e9af3b3ec3d422b258ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709214, "uuid": "f92d847e-d8a0-4f18-896b-75b11b692b44", "value": "T1CE83CF61E7556CA9E807067E99BFF8152023BE9A84764D0D317E322DDB7334290F6E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709214, "uuid": "6be7129c-53b1-4a83-8854-e51ee855ffa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709214, "uuid": "1f19c91e-aaed-4a44-a38a-3edff1036f55", "value": "1536:DBpBp41EswBBTZspN9/ERy9ynPgiaDx8FOqu+ZIJNa5dGKU9K90oajG2WbT37qWj:9pBqehd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662709214, "uuid": "db4e8a57-8046-4b93-b2b0-6bff33b96a3a", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662709214, "uuid": "23c0bb5b-5703-4613-b8cf-5dc155a78cb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709214, "uuid": "89f2a6c2-1352-4b78-96dd-af9a621540a5", "value": "SWFTRNS000183PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46a9c45-3070-11ed-9266-42010a9c0072", "comment": "Malware payload (QuasarRAT)", "timestamp": 1662749640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749640, "uuid": "f4925252-7ef7-42e7-8300-33480ac7b8d2", "comment": "Malware payload (QuasarRAT)", "value": "be3c44fc58d14526f1f88ad0e6835290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749640, "uuid": "30c29ff7-7e03-44c4-85aa-60761f785d95", "comment": "Malware payload (QuasarRAT)", "value": "2a530c0ce9e28ccef15ab536554c6e1174f33564d823e1cfcdb720c9771bb1cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749640, "uuid": "e342be1b-771e-42fd-85c5-e1c086696669", "comment": "Malware payload (QuasarRAT)", "value": "072e7ab36bfa2773361320d32a442172437357e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749640, "uuid": "f698193d-4e28-475e-98e0-17f0a67bdf0d", "comment": "Malware payload (QuasarRAT)", "value": "554cfbae451e475f767aa699ccdae1dc28e86370ebb73d39168c66fb48f1ac252eb76d585c8048a2d78df2a2cc6ca35f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749640, "uuid": "e08c6342-b9e2-4828-b455-9da3445a91f5", "value": "T1C8B47C402BE8861BE1AE577AECB144209FF5E407B267EB8F4544B1F82C66742DE507B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749640, "uuid": "4b29b897-75aa-4020-b252-264d72365e27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749640, "uuid": "22a8e5af-27b1-42a1-83d4-7940dc342b55", "value": "6144:wTEgdc0YOXO0l6HeR9icuoucwtoflOwcEgZvb8F9MQ8ppBQChcTR3/:wTEgdfYol62OwUs+Q8LBQChcd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662749640, "uuid": "cd385a27-28ff-4406-8619-dd20cddc4cc1", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662749640, "uuid": "2bf4f749-f95c-4581-a67c-76c5bae7d809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749640, "uuid": "e199fa8d-e69e-4ea3-9cc2-8580b9f590b3", "value": "ClientVia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3b85b6-3014-11ed-9266-42010a9c0072", "comment": "Malware payload (IRATA)", "timestamp": 1662710007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710007, "uuid": "5090abf3-378f-49ea-8f68-3a89410eeeab", "comment": "Malware payload (IRATA)", "value": "aafe4fad8535f7310d323733530c13a0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710007, "uuid": "5e3b6b35-4331-448d-bd12-68c73a4a3e1d", "comment": "Malware payload (IRATA)", "value": "2b0f04eb6dbaec0535595ed94dfc4d2fa23d1c83d9aa39fb3274e3129a5b7b0d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710007, "uuid": "f89038ca-b2b3-4f43-a2a3-839dda9f2a41", "comment": "Malware payload (IRATA)", "value": "f6df7e4210164d747ae1c4baf765dcb0dbdffa7e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710007, "uuid": "0b84b17c-03c1-4457-abf8-1f26dc7de73d", "comment": "Malware payload (IRATA)", "value": "c50035bab225b2ff690209ad243509c5f2a25ce4f5319268452bcf2002cbb28dc8414a939eae3a3a9f66d855b8b12d8c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710007, "uuid": "311d21dc-818c-4b2f-a8fe-c1bf19701da6", "value": "T19EF52313F626995BC8F2D33622741635907A8D18EB03BB5A2C54B7BD28FBDC84F856D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710007, "uuid": "69aea927-234b-403d-b3d8-025fd8282702", "value": "49152:N/1UsSHe5UQtHy1fffEcy317sc1x7B3l0ZL7ZhJqo18qn7Yz/0j4PSokjEHGP9aP:FiF6efffnRcj7jGPJqgfEwj4PkomPcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662710007, "uuid": "458a837f-aa32-4edf-83b0-fee55ee4dd5e", "value": 3564453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662710007, "uuid": "a6a621f1-87b3-43a5-a2ba-6cdc0c0ecdd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710007, "uuid": "57288189-cb95-4e5f-bef2-b022f2f5c59c", "value": "Live Sexiy_signed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c32eed3-3025-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662717226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717226, "uuid": "39d0b0c2-1378-4e66-92bf-525978e9a26f", "comment": "Malware payload (SnakeKeylogger)", "value": "8ea9c8dbfc4aa7910fb2204c12e57720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717226, "uuid": "8c9f4173-3134-47e0-be6a-f951bb7d4ac8", "comment": "Malware payload (SnakeKeylogger)", "value": "2bf3189c9ee98121b1a5b2746f3a46a141990a68ddfa8145ab08b347c6d66502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717226, "uuid": "76fd8aaa-2109-4bcb-aee7-a8d1aa9a50d8", "comment": "Malware payload (SnakeKeylogger)", "value": "104734f599b15d792f93eaad6ec3196d7abacd3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717226, "uuid": "2f373d30-b8e7-4e86-b55d-1c354972dfd9", "comment": "Malware payload (SnakeKeylogger)", "value": "4513ac895703c164afd5fae5d1220f2b94fff8671f1ab2829f8e50fb18af0165e331d76dc5e434ae10cba92f21892813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717226, "uuid": "e70f9fa3-94bc-42ba-8115-8e108317f77a", "value": "T1D2159CA53186685BF4D4D178E8C772702FCE7D4CC5FA82C710E03B1BB936A8355A8A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717226, "uuid": "d60d30b3-305f-43bd-8e12-2f18ae16c7ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717226, "uuid": "0fc93c44-0e56-4d40-aeab-b8d9b823f365", "value": "24576:JS5xoeho+hZmavctLiD5SntGUkY7QJ3H4dh3q:+xouZ7izQYkJ63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662717226, "uuid": "cc8f6451-4e02-4df0-9bf2-83d48977773e", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662717226, "uuid": "d2fe7afd-26d6-422e-a62f-1dfde04a1627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717226, "uuid": "07f05e35-0aaf-4164-b88c-845cf54cfe0a", "value": "SecuriteInfo.com.Win32.CrypterX-gen.32699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53cd6ae-3027-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662718235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718235, "uuid": "87269349-841e-4ffe-a228-976c4623b953", "comment": "Malware payload", "value": "16f9b28f5b792947ddf63f5d521d829e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718235, "uuid": "e7d448b6-2bee-4ff9-a34e-21a9efdbd5d2", "comment": "Malware payload", "value": "2d6749b1c9c91a9c4873309a785440da39eb8f3a93fc0b75b61b47283207e739", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718235, "uuid": "a681d7f8-d5e7-41a8-b989-5fe12f2f64d2", "comment": "Malware payload", "value": "a9549d1f565e396c45db52d919c7269343051827", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718235, "uuid": "f4945839-7381-461e-8ee9-a39902917a1b", "comment": "Malware payload", "value": "d2b3a956dc6d59b3cd109aa0a7ab0e1bc974af64c97c4495a7e6c5731a4edd9d4db971e030471f1b86373fc8d9621123", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718235, "uuid": "cff3ec85-ae2f-4b4c-98f9-622f7d652d5c", "value": "T17FD2CF29C3B6202DD82B5CB9C11D40F3E51A8446F94A6D0FAE20F9FD6D80A4B4B137CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718235, "uuid": "8d82d1c3-ae27-4a65-ab43-b866ce17bb5d", "value": "768:MnZZnflzda7OWNQIToRTlbT5a99CtoTI3VPd:SZZn9zda738pTzCTI3VPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662718235, "uuid": "a9513126-7947-4807-a6d3-70d2ac7e6444", "value": 29027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662718235, "uuid": "4336d3d3-cf2d-4ae7-9634-bbbb1bd28960", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718235, "uuid": "17d233b0-4b6b-4b44-a8a1-0277df10f526", "value": "Untitled attachment 00020.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b368442-3016-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1662710890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710890, "uuid": "9f9d36e4-05c7-40e8-b60b-b4aa52f3eeb7", "comment": "Malware payload (AgentTesla)", "value": "519546d1948e6a9b175de49c9d802efe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710890, "uuid": "145f6bdc-b85e-47ae-bcd4-81b703f57a01", "comment": "Malware payload (AgentTesla)", "value": "2e59872a2d3fbed958f7e576b8b5f769d08eb45fcfd0dbb661847c9c6c7016fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710890, "uuid": "4c3b4d81-b9cc-41c7-b68d-1a78c9f2b6a2", "comment": "Malware payload (AgentTesla)", "value": "43c0f9bbb62f00dd9c8f10e8eecc0c72ef25aeb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710890, "uuid": "ba52a719-7f64-46bd-8868-a7a8b7894153", "comment": "Malware payload (AgentTesla)", "value": "9af635a9a5226c65ca133b3f730a69361a42f739c666a341612857814a7bba5314c0a6a6325639354d0a088afe9f6e1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710890, "uuid": "091b6f09-2b6d-4554-81c6-fac956bc2ae5", "value": "T10F453A0621941BA5D07253FC20CCC1B28BBA9E45E53FD545BFC99CEFF592F2846D22A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710890, "uuid": "9f6a2560-81ed-47ae-a333-0df6642bfbeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710890, "uuid": "6fd209e9-d31d-4740-8115-7d514bf0c487", "value": "12288:4kNjmHx175CFyHhi8q1YLL4Y+lUrJU0OTEnARmPT6ICIommv55:4kxmHDcohiB16L4rUtUPTEAgGICz5B5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662710890, "uuid": "aab81665-5584-4f6b-8e8f-3515ed1bd899", "value": 1197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662710890, "uuid": "c0be23d9-02ec-4a1d-b31c-76cd9f8ca6d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710890, "uuid": "2b7b7f04-43af-44f9-a447-68e2dea13de5", "value": "pay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b3b476-3038-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1662725505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725505, "uuid": "ccded433-f6e3-4376-a4fc-20d2c96ed4b4", "comment": "Malware payload (Stop)", "value": "3a696280d5a7822cadf601658622aac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725505, "uuid": "2154da3b-e530-479c-858e-ccf9c4d73f26", "comment": "Malware payload (Stop)", "value": "2eead7300ef128f57b8d581d8c77af8306791628c54f0f3d61758f896cb2d9d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725505, "uuid": "b2ecda31-3b8f-4484-b662-69d5bb84c8bc", "comment": "Malware payload (Stop)", "value": "d84ae1e403981187ec1aed3080fc6de60c22c097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725505, "uuid": "285e0404-178f-49c8-8e2a-d3f9e5b23c77", "comment": "Malware payload (Stop)", "value": "e0ada5811b3919f52bae36c0304b9d40df9d9642468d5ac4c70a232304db673f0125ceed25de09d6a4d1f1b3c42e33fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725505, "uuid": "c276f764-877d-4ca4-a46a-ab97e8140426", "value": "T1F2F422527A90E031D0538930C839E6D12A767DF29A64888FA725335F5EF11E2BB7B353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725505, "uuid": "8e300b31-6f8e-485a-82ad-f81233611da5", "value": "5d5b8d072fdd778d9ba9ec0c36bae15d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725505, "uuid": "d382d692-3058-4073-883a-1ba558a184e5", "value": "12288:uSBR3L9Ow7pzkTRt3onVxAc+3flNRYwkQLfpp6ZpWRmqGNkZwNTRiNQKyjNN:uSBR3foTRtQVec+PrBhP6ZpW6a2RiNQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662725505, "uuid": "09547928-d9b2-4018-8e02-507e34a8f70f", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662725505, "uuid": "4aea09d5-98fa-46f7-8f96-a14eb7e91513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725505, "uuid": "6f9b85c3-2d3c-4151-887c-acf0720c5013", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db403c27-2ffe-11ed-9266-42010a9c0072", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1662700716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700716, "uuid": "ca9a1887-6c70-4ce8-9c4f-d3bf409f2cba", "comment": "Malware payload (ErbiumStealer)", "value": "0b0bf4dd60094b618d073c594e7c098b", "object_relation": "md5", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700716, "uuid": "a0f03cad-1b0c-43a4-a5bb-a1bf00255554", "comment": "Malware payload (ErbiumStealer)", "value": "30dacaf0c280ac6aa7c0fe4dcb89658c66132226e960bd01194e5f5614edd0b8", "object_relation": "sha256", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700716, "uuid": "f3ae687f-7a34-4756-b972-27eebcf558d4", "comment": "Malware payload (ErbiumStealer)", "value": "39b6af59e331bb0f62df5d9624d2f0b7d8bda277", "object_relation": "sha1", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700716, "uuid": "24bb79cb-1d42-47f9-8ace-e71a3fd93b15", "comment": "Malware payload (ErbiumStealer)", "value": "f7c3b34f253fb8d19391da3fe1fae25182f089b91ba8d617058768780088556db637871dc5134e222fb2b31cb0fee023", "object_relation": "sha3-384", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700716, "uuid": "ba726ff0-c74f-4328-b5a2-a559053c1dc8", "value": "T1CF252929EB0729F0DA1757B6855EEB779B18BA188032EE7FFF4BDA08A0330123C55155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700716, "uuid": "2f3b8581-3fe5-454b-accf-703a023dd44b", "value": "1797ab721d550312b93ab992a1e04176", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700716, "uuid": "5feaae0a-9b16-4838-b633-2f0a4e44dbac", "value": "12288:bLEgrQkhXY3Ypc82SdWu5zMWkvoUqW7r1mxTLQF92UZJ6ZeZhZ76X5ymJGjCLT:bIXkBY3YG82SdlMWcoO7r1mxTLS2CQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662700716, "uuid": "247c8add-5fd1-409c-885d-273719d17a1c", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662700716, "uuid": "90147fed-0d97-4771-80b9-56ac3ceee7e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700716, "uuid": "ed15a5e7-d3af-422f-84e4-2aff5f313b6e", "value": "0b0bf4dd60094b618d073c594e7c098b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7de9ed-301e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662714244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714244, "uuid": "ead79f9e-0a14-479a-807b-f2172300428b", "comment": "Malware payload (Mirai)", "value": "292307cf200d113d914ca1501840c86e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714244, "uuid": "8cb3ba0a-ba3b-47ba-9f84-48f91958410f", "comment": "Malware payload (Mirai)", "value": "35e9162f731010346ca311aee2e903d1f568c4eb77574c8dc14ff626a8f90ac6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714244, "uuid": "81bb7cc3-1e20-4390-8004-d5efd8c04739", "comment": "Malware payload (Mirai)", "value": "1864b28a65f8292b18f26d58d721ec3b2881bbb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714244, "uuid": "ab56aa30-12c1-46e2-87c2-910f0dde37f5", "comment": "Malware payload (Mirai)", "value": "02d25c1d7f914c556800d32be7f0e511dfd487cf69854b4d2488a5c253b65fbd31f6cb2f7672f214122d0f0c290e0baa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714244, "uuid": "7ce4d610-9a01-47c1-a5f7-596a9f950c50", "value": "T16D2339D6B4019D3DF98BEBBE84074A09B270775844930B3763A7FE936D732945D22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714244, "uuid": "0f1c2938-2feb-4726-a58e-b25767b4f071", "value": "768:/jeUYXeslyMk0+CFLBI2UZBl2xRf9I9NuLJHkyCCjLOoqB7Y0Bp18ZllQ:7dYPyMhFLBhklYf9q89HkylLO9B7YObh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662714244, "uuid": "d3b90c23-1004-465b-8ff3-675fabb65f3b", "value": 47672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662714244, "uuid": "e837ce0f-4c49-4261-8103-dbff46d1c998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714244, "uuid": "c7c582b5-8ea5-46da-a937-a475e91d36b2", "value": "292307cf200d113d914ca1501840c86e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4581c02a-2fd4-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662682426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682426, "uuid": "e6bf9cf6-419c-44fd-b7ae-c20819895475", "comment": "Malware payload (Mirai)", "value": "120f55e7e86298725b7ac6b9c06e5a85", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682426, "uuid": "b960a31b-e632-44ab-8209-8c3e661f7f05", "comment": "Malware payload (Mirai)", "value": "370d0a9c001d47b14219c76594c8aa7fa22a3d378e6242f4c2442440ad27404c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682426, "uuid": "916d5809-f2a5-421e-88fe-4263b541246e", "comment": "Malware payload (Mirai)", "value": "ae93a84f2d588336541c98bed65e16f58983178b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682426, "uuid": "0a7b5f17-b3f3-4645-818f-76fac6aedc26", "comment": "Malware payload (Mirai)", "value": "f1587d549625358fdd54d6b18ee70b07e4ca8c7e68909c5831bbe239fca3101b638d491ec40f3920b5926ef58ad8711a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682426, "uuid": "024ca540-c352-4c52-917e-f7e9607bf079", "value": "T120C2E030B29BBCB5CA741EB2BD6AD9496B0904F8D8C3B1F21A5401BDF2C696A587D580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682426, "uuid": "9f4d19d0-3b2e-46be-bddc-ca2e5d15d52d", "value": "384:QEZxuh52M/G/yfgYz+dcrpc6DyYlrnExnHO/F5swnwEjzFLDmdGU5E0b:QK6G/ypyCrpvVgO/FLnwEjhLD3U3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662682426, "uuid": "1e1ec3ae-9ced-45e5-9ae0-a3d45586b799", "value": 26608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662682426, "uuid": "492aea30-5125-4bd9-82e8-00dccb1d4a55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682426, "uuid": "93dcb05c-4d62-4691-9fe0-2fb5639ec551", "value": "meihao.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e331c3-3021-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662715677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715677, "uuid": "0489f6af-8ce0-4147-ae24-ee2a1edca0df", "comment": "Malware payload (Smoke Loader)", "value": "a72a33f6cec78bd4e58cb3bf379c0b56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715677, "uuid": "591f7a8b-93ee-4fc2-a75e-ace27077843a", "comment": "Malware payload (Smoke Loader)", "value": "394a7b1776167c159d8372ab8af7f4a90f0fe3674fe5061bb982032e5da8b141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715677, "uuid": "12f0401a-3a31-4723-9453-d70ad2a7304d", "comment": "Malware payload (Smoke Loader)", "value": "de89715f5a20643dcf90f7ceed473e1085e9aee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715677, "uuid": "e7587bb7-1a25-4f4d-8b40-2ba7b78378fc", "comment": "Malware payload (Smoke Loader)", "value": "595f84ec9ea89601351d2515675713f3a45e8673dc4af4f8020b6bd58cbaad2a1eb0aef9428ea1decc7637562bd689ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715677, "uuid": "39ea5614-f165-4cbb-bdd9-392c0fe7e8e3", "value": "T19924CF22B690C472F7E645308474D6E4EE7ABC625A24554F77643B6E2E737F023B031A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715677, "uuid": "ac021610-4dd5-4537-8f56-d34a11ecd7d8", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715677, "uuid": "79e1175b-7711-4587-9f7a-2a57e0f032e9", "value": "3072:FArtyzn9bcbfAi65z+dPMmRYYgax7PSNlqQLO4lNzPaYiFD:GtqcjAopRp9n47D4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662715677, "uuid": "6d69ac65-5c43-443a-b8e9-183325c170b7", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662715677, "uuid": "b2c8ecc0-cef3-4e03-a4de-5bc74e963d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715677, "uuid": "7ddeeefe-f7b3-4e53-8e44-1e2c10241bfc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f89425-306d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662748274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662748274, "uuid": "b2e41f50-e272-4679-b788-aa711d4cdb53", "comment": "Malware payload", "value": "194e3b3f4e29eb351060f9a8093f429c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662748274, "uuid": "5742e5b5-9e01-4c02-98a6-0425e3490579", "comment": "Malware payload", "value": "3a043b858db3620dbe31f2da6562c75d79ff692afd6d5577fb019f58e2fcdfb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662748274, "uuid": "28ee3901-99bc-4fb9-871f-629df85092d8", "comment": "Malware payload", "value": "ed997af11406663374b67c1ceeb0c7624214c200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662748274, "uuid": "ae56110c-350c-49d6-b720-81f53dbbdcf7", "comment": "Malware payload", "value": "c34ed3cc6db98567fe21dd8570ba635fa2b273966254b261f26091639dbfd4c58d82fc9aa43ae96c58aa7ce13b4163df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662748274, "uuid": "b40c6df8-a9ce-4f9f-991e-00331f5951a5", "value": "T1CD6623B312B40145E4D5CC399423BDB632FA126B8BD1DC3DB8DAAEC12913AE5D703667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662748274, "uuid": "752d91c9-fbd7-44bc-ba4b-83becff26cc4", "value": "8f1a9288bae20d24c92d3d27d642d92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662748274, "uuid": "5812ff9a-580d-4af7-b287-b2fdc822ce76", "value": "98304:3pNr1JfjIBSZkqX9H1a8Q8bjnhxIv5WR+u2tQjul6FDHNuZeg3gQo4Z68oImQkeO:3pJp7X/a8/bjhIs+uZyY0eg3U468+QM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662748274, "uuid": "ebeb5f19-f42d-454a-806e-d4c8869be9cb", "value": 6543360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662748274, "uuid": "557a3006-a965-4df1-8212-86a0e7f3ca61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662748274, "uuid": "01fdf98b-114b-436e-b332-2d2b3c875e6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4261b11e-2fd4-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662682421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682421, "uuid": "fb2d8134-ba43-4fcb-a6d1-339d7a0a6467", "comment": "Malware payload (Mirai)", "value": "f9dcf1cd97846e62e88c69da5f256e44", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682421, "uuid": "71e18b99-1acd-4aa2-8ac9-3e8279ddb727", "comment": "Malware payload (Mirai)", "value": "3b7d35f818f2fc0465f31141e1abe7aef8ca59738ffe313b28778cda3bef58e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682421, "uuid": "0c10f797-8e50-4f7d-8913-2fd67fa26d1e", "comment": "Malware payload (Mirai)", "value": "084c68a60f6b29b9228be450d3658331cd5d5756", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682421, "uuid": "362a8017-b340-451d-b41c-0097bf8acf5a", "comment": "Malware payload (Mirai)", "value": "2a42b06bcb8ee2bd31498fcced76d7bd0c0f18144ba1e27c19e984ef434475e86d0b50490ac5f7f9af5bdbcf60576751", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682421, "uuid": "02023b56-5037-4b8f-947b-0b9817fe6ae0", "value": "T1A8E2E09DA30E84DFD87AE0B761A783109F710FF16817E71A6E9248E36E43474B416F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682421, "uuid": "9683a2e3-5992-4279-85a7-6fe820403d1f", "value": "768:1O4PYGbIKLzb6G+hABdDxxHFioL8i3xW2is8JgGlzDpUYsi5:wGNbTMAPx5gW/i1VqY95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662682421, "uuid": "ede9c2e5-7b59-49b1-ac88-7506e99fe6dd", "value": 32012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662682421, "uuid": "9f93238d-91f5-4372-a08d-3973c2c96f21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682421, "uuid": "64f58a24-53da-45b8-a340-bad0e90ba33e", "value": "meihao.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4e70f2-305a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662739938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739938, "uuid": "a1663c0f-9980-40d7-ba83-f08a8544d986", "comment": "Malware payload", "value": "854bd2ce5c997872a03927abcb048e56", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739938, "uuid": "6dd31740-115c-4292-9ddc-a9936d099bfb", "comment": "Malware payload", "value": "3cf954003a8aec7e0a08fb5926975cfb45a0bda948e75603fb570d6b89fc538a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739938, "uuid": "b0fe5de5-4993-4512-87e4-10f29087e8a0", "comment": "Malware payload", "value": "603bfe50c21a2911de573d639c5bb85e1b0714d5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739938, "uuid": "135affe4-bd9f-447c-afeb-e5eaa322c761", "comment": "Malware payload", "value": "f5f09b92c1692941bdd4cb21be668d74e40fbd1089d85263e4da16254542a51c3a6855f2bf91428149b825ff89e97d9a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739938, "uuid": "85a56f37-e43f-4035-bebd-ad2d9d6ed39c", "value": "T102F52313F222966BC9F6D33622741635617B8D288B13FB4A3D5877BD28B7DC84B916C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739938, "uuid": "6b213aa0-b122-4e91-82f2-04dd0977d19a", "value": "49152://1U8SHe5UQtHy1fffEcy317sc1x7B3l0ZL7ZhJqOdNlSx7i3CrgzwMmePm8D8pm:XiV6efffnRcj7jGPJqOd7rCrgtm8OEl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662739938, "uuid": "66181edc-5ccc-4124-aed6-24db21f21abd", "value": 3564453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662739938, "uuid": "c96ab81b-1805-457c-9dc8-c487ec912788", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739938, "uuid": "f13ccdb1-b7fa-411c-9f07-9be308a89115", "value": "[\u0644\u0627\u06cc\u0648 \u0633\u06a9\u0633\u06cc].apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942bf21c-2fd9-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1662684705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684705, "uuid": "a50e3f8b-9c9d-413b-8a03-7d620085d85e", "comment": "Malware payload (AveMariaRAT)", "value": "42d6e06daf63a374b41990e729fdfb21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684705, "uuid": "7dba5be7-2282-4315-b663-0df9f1d2e991", "comment": "Malware payload (AveMariaRAT)", "value": "3eaf9b1988ad1983591b49b12dfa7590c2906491421d9e544c75388cbca2353c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684705, "uuid": "ebb5ce72-a540-4d8d-9367-db82a3349539", "comment": "Malware payload (AveMariaRAT)", "value": "1f29f25f628d79946619c29943e392623855b1f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684705, "uuid": "cc491d75-556f-4254-addc-0e04ac05a980", "comment": "Malware payload (AveMariaRAT)", "value": "ac70646515613958d7727d3661b7de8c2568ace36bb639aa661f52cf4a0f71e1a3315d6b0b3d0adcc690559849e1b4da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684705, "uuid": "2d5f29ce-bab9-47ef-843e-5c20aa9a543d", "value": "T1EAD38D13BBE64436E6F202B02DB97E7597BCF9341A25C68BA3945446AC32C44FE36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684705, "uuid": "53b3283d-93ef-4b5b-aa6a-58803ac9686a", "value": "56fc94e02d7bc310030753938e49a91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684705, "uuid": "6da6fba0-0b8f-4028-9057-318ac5012c26", "value": "3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662684705, "uuid": "c2cfcaa0-9148-4fc0-a4b4-dd8b9bd83a3b", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662684705, "uuid": "10acd978-97ea-47ce-98ca-4a379fdbd5e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684705, "uuid": "06b29aa6-f208-4ca2-93f5-3bc16950b6c1", "value": "42d6e06daf63a374b41990e729fdfb21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419e04d4-2fd4-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662682419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682419, "uuid": "17793e2c-8727-4425-81ab-bce98a619284", "comment": "Malware payload (Mirai)", "value": "1f0958fc7710bca7a6e0680515164725", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682419, "uuid": "25192f6b-49b0-4ee6-b72f-abb37c739bb5", "comment": "Malware payload (Mirai)", "value": "3eed96b3c6393f015aff9e5def41711bc8359774910156331329b77b48b3a304", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682419, "uuid": "ec72aff0-a671-49ff-af45-63eb4f1758ce", "comment": "Malware payload (Mirai)", "value": "e983b5b9928086378cf0c9e4cf5df9581a706210", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682419, "uuid": "bf400d36-159a-4b99-81c5-480fa3fa6e78", "comment": "Malware payload (Mirai)", "value": "2276cd595af85db092570eba15ef9c103bd341290b6f47d014e61b42e31c17e07ce9e900d188807d3ff5104e2f1f07fe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682419, "uuid": "ff9881ab-e140-457f-81fe-cc82470948e7", "value": "T14ED2E1C53222116EDE76C3B9431B473621A6B6A8EF4023E2EC4B643774754994AB8EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682419, "uuid": "27b596b8-8cf4-403d-a6a6-e973fafe480b", "value": "768:vwVjfdYFi4JOGGDg6Ijqcai+/9whMt2PDeywThMxo2X:viSFi/GTbphMXyPo2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662682419, "uuid": "48641c1e-d8d9-44f3-9d07-ac43ac4ac534", "value": 30344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662682419, "uuid": "f2556ec8-22d0-488b-bb43-c4850dc54022", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682419, "uuid": "a68c077b-9565-4db1-b265-dad411d02eba", "value": "meihao.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cff54e0-3025-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1662717228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717228, "uuid": "47b3cc8f-d98a-4083-8ba0-4db5f1a5196a", "comment": "Malware payload (RecordBreaker)", "value": "113a4f64143678f3b14176ff1a1d8f04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717228, "uuid": "4cc41fa4-19ae-4aaf-8897-3bd7adff2e4b", "comment": "Malware payload (RecordBreaker)", "value": "405db51f613093a46aa99bcd59b42c35871ee28ff9acc10dcd2dd050b5398ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717228, "uuid": "185e5c68-29c5-4bb7-8993-2fdff68c078d", "comment": "Malware payload (RecordBreaker)", "value": "0fe10127479ae63683a909dd2b1b080ff29761ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717228, "uuid": "3d488424-c281-4425-a3bd-9a00838d349c", "comment": "Malware payload (RecordBreaker)", "value": "56b4cb77be97acdcc65ef5998e57e414563165928bf962fe6c8407b16645cae67ddd42a1a8553468019e33e70b14efe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717228, "uuid": "e0392a1d-e351-465b-a7f1-4408637a7fac", "value": "T1CF24D022B990DC31E7E66530C430EBA17A7AFC616638594FB7603B6E6E303D066B5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717228, "uuid": "4e656907-9ef0-497f-b557-4efb0872f72f", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717228, "uuid": "bddc2c97-34c3-4813-9c7f-fddf1f321043", "value": "3072:xp4ksufMhClfwX65Ct/74yU8zRXzaqzM7bG/DE9Aa5iy:kGqCmftUyU8zRu7SJa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662717228, "uuid": "1a184ae2-23a7-4dd0-8e20-9f622eaf4b30", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662717228, "uuid": "57ee0451-3896-425a-8802-2d6480a8ae71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717228, "uuid": "635ead7a-4421-4ad3-bf8a-740cd0043f29", "value": "SecuriteInfo.com.Win32.Evo-gen.31267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1796ce8d-302c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662720145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662720145, "uuid": "5d2eaa08-cc13-4e28-9dbb-b2c0ca0e42c4", "comment": "Malware payload", "value": "13b94d96bec2b723448301a08c960ef3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662720145, "uuid": "5d4435d5-e57a-4641-8c89-e79f997014a8", "comment": "Malware payload", "value": "41212525387db779c41f209912f8d0fa4c6e02ebcfa58bfeb150bb1354beb814", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662720145, "uuid": "8cc1dcf2-44d6-44fd-9258-0cf018a01464", "comment": "Malware payload", "value": "babbc97e2d5d836d82af70e4a64c1e2746224515", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662720145, "uuid": "d6fc8d57-5b41-425c-bb4b-b1d19078b5e4", "comment": "Malware payload", "value": "24ed0d078c843db7354874224b4495749f210c158d774f06a23b54b013ca7c958188b2f1982527528f7b1c04f293b0b3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662720145, "uuid": "0bd5afc0-c6b7-4900-8b41-1ca81564d275", "value": "T150226D7CE552BC0AD121487CE05582F1E71A4167AA21B92F2019F2EC06A1BD34BDEDAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662720145, "uuid": "78e8e453-7945-4631-baf0-ea55e23e7e87", "value": "192:ScIMmtPf+CUG/bA3/w2Ou3rdlJFmQDZ7rhhap30Lp:SPXumAOu3jJFmIZfhMFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662720145, "uuid": "480880a2-d660-4096-b3d0-c58a2525fb31", "value": 10347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662720145, "uuid": "641f95c8-70d7-4455-9e28-f081cf1c521d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662720145, "uuid": "e28f58d1-e4f9-4fb7-bafa-db3c677cf161", "value": "smok.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a041a4-3018-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1662711582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711582, "uuid": "1c646711-ffdf-4cad-ae1e-3f6a20f9759e", "comment": "Malware payload (Tofsee)", "value": "c7ccc0106e042fb84bb9a30d14239d88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711582, "uuid": "e171fc5e-20a5-44db-a4fc-6d363b5a8143", "comment": "Malware payload (Tofsee)", "value": "429223f2374f630c661714caef8e3247bbb6cfd6b0354bf4529233a66f46c228", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711582, "uuid": "4de5c851-5e65-43aa-b0bc-212d9d5a7aaa", "comment": "Malware payload (Tofsee)", "value": "688d6637b1f49fe27983d7799d385b8b25b91e0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711582, "uuid": "9cc91275-84bc-4766-b736-03ad00831813", "comment": "Malware payload (Tofsee)", "value": "6d120cbb26d7e7260294d6959cd677fde44d887f5bebb08faf39093b3ce4331dce2bd8b624dd1f0d8e57719271487502", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711582, "uuid": "a2600341-1c53-4bdf-b3f5-771b6ebc4b0a", "value": "T13C24BE11B5F0D4B1E4B249384030DBD46EFABC612A28D94B37A4FB6E6E703D166B6317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711582, "uuid": "6082199b-e159-4d2a-9747-ba2a013904d7", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711582, "uuid": "7c66dbb1-1bd8-462c-ab08-ad5cd5e32739", "value": "3072:II4C5+VZNNA7P65ymfeBY2SXry2YipLh/E/CfsnzvUSN/rgRA:w/Nm7DLBJSXry2dpLWTnzUSN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662711582, "uuid": "eb9fe9f0-5fca-46a9-87e2-caa6563c90c6", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662711582, "uuid": "2c8fc14c-cd8e-4a06-8eb2-7aa46cc539fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711582, "uuid": "815627a1-01ac-47f3-a893-314ebfa48a85", "value": "c7ccc0106e042fb84bb9a30d14239d88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ccc871-3053-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662737216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662737216, "uuid": "36f5b93e-ee99-4ca1-b613-b46e4efb5669", "comment": "Malware payload (Mirai)", "value": "fdf9642e2f99e4b2384df82f5276275c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662737216, "uuid": "54cccdf8-7895-4bfb-ae73-a2f25e06db17", "comment": "Malware payload (Mirai)", "value": "432db59bbdd8229f42954467f91d2cab4a0da998fe87587ef157814987ec3c3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662737216, "uuid": "0e8cc218-fed2-43a0-bd05-d83005361e7f", "comment": "Malware payload (Mirai)", "value": "c4493a32aa4d0e899f90464082e07230861c761b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662737216, "uuid": "de0a84cf-9242-4297-8ce1-528313a97381", "comment": "Malware payload (Mirai)", "value": "04a3d76183bc66c4ab28dbfa0ae29ad73848969d6b053d9c37d9ed4bc762ca5babeed58d27c335327ad3740ff839308c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662737216, "uuid": "9459dfa6-4554-4917-8d4e-364d361e9d5c", "value": "T180833A46FD809A17C6C0227AFB2E219D371613DCE2EB7203AD259F2437DA55E0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662737216, "uuid": "3836e2c3-5039-46a6-bf6a-665ab5209624", "value": "1536:09knhPA4Mje8CarBY63x6CUDbxcmulQdAzMEKdSwbbFRaa2WOJ/L:09FooHUo6GMFdSwb3h2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662737216, "uuid": "44be3386-808f-4637-8194-ce7e7e870766", "value": 83300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662737216, "uuid": "7eac3a71-1740-4e5c-9ea1-0d3dc04e5858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662737216, "uuid": "bc2a66db-7823-4c8c-a683-ba9a66dd8ac9", "value": "fdf9642e2f99e4b2384df82f5276275c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed548ca7-3042-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662729952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729952, "uuid": "f9d6444f-5d5d-45fd-9616-c461ce8c3c12", "comment": "Malware payload", "value": "8f2e5396f1162cc885fa17abde21977b", "object_relation": "md5", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729952, "uuid": "8ff3e3c6-fcf7-4e04-b48e-1ebd3d0a0e46", "comment": "Malware payload", "value": "43fba22a16a3482e24625d6ecb54f11635885c1fdc6dc43d132918ec396942df", "object_relation": "sha256", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729952, "uuid": "c1f7158a-25b4-4409-af67-28e761eb0165", "comment": "Malware payload", "value": "74be8966e5bc5d13bde0cb6306ef0d96d9201c74", "object_relation": "sha1", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729952, "uuid": "4f383eac-5621-4e4a-9234-b7ad1d06acec", "comment": "Malware payload", "value": "7e50dc86954fa245e09889aca16b747dcd5ab083eb8165bdeb808bd0cafdd91db5e232715f0e86230e2436b03c62b559", "object_relation": "sha3-384", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729952, "uuid": "f28c114a-09e2-46c6-aeca-3bd98364ac84", "value": "T11B61097882ED4480DA1EF5711C6E038C37A36F091512261F7F122E42FF0E29676AA5E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729952, "uuid": "f732511a-11a9-4917-a237-e8050e04e941", "value": "48:sDi1HRL3OazTBbwsGmQwN2WzwEXDj9xdoV0P6brQz6SJgJMBtb+Pg78lQVPFP8d1:sQL+apf1ZzBHoeP6b9T6DbCgUQzUd5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662729952, "uuid": "55079505-3aea-4a96-be69-b1ffce114e28", "value": 3374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662729952, "uuid": "049e44bb-5683-40a9-bce1-5e15acbb2989", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729952, "uuid": "c67371d3-14c2-4695-84fd-4978a79aa2c3", "value": "Data1728.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf08ea5-302e-11ed-9266-42010a9c0072", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1662721011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721011, "uuid": "e7ad3c8f-c056-46df-b5a2-baafa698ca7d", "comment": "Malware payload (Worm.Ramnit)", "value": "bcf5b5916c615b67161f6c0214ce78bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721011, "uuid": "2d16bbc1-ea77-40d6-ac6d-cb3c02d10179", "comment": "Malware payload (Worm.Ramnit)", "value": "444ccb4a0c24e38f61ba9722d095fc8487aeacf0d16b322f019b9547af2f423a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721011, "uuid": "a100e80e-4a7d-42ac-a518-d6a9badf1f79", "comment": "Malware payload (Worm.Ramnit)", "value": "065604690d419b886cce88d357f9dfc180873e25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721011, "uuid": "523ef92e-7120-4820-b9cc-f47062c31003", "comment": "Malware payload (Worm.Ramnit)", "value": "240fd7c105f00e156ea5f948bc618a445a1851612db5ccc34b8a61acdc864bc37df636a9b20eace0a1119d3651db91a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721011, "uuid": "ca3ff6a7-e487-4251-b3b4-97cc192fbc79", "value": "T1ABE3AE23BBE64436E6F602B02DB97E66D7BDF9301A25C19BA3944446AC32C44FD36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721011, "uuid": "4bc42dd5-372a-492c-9ef5-917121cbd393", "value": "56fc94e02d7bc310030753938e49a91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721011, "uuid": "4df4f749-f7a0-40df-9eee-813b9ec3e11f", "value": "3072:07W9jps0Tx4azG6GweOTir5axbjNCz45LT7aqGCH:0wpsERzGKurEXCzeLT7a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662721011, "uuid": "2d39dd1c-5b54-4444-9645-600c29882e30", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662721011, "uuid": "5bc31e37-ff27-44d9-b15b-ec859571af18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721011, "uuid": "82973001-71b0-4d17-8c9f-aa92594a1e5a", "value": "bcf5b5916c615b67161f6c0214ce78bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921b0580-300a-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1662705747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705747, "uuid": "19b3ebb1-5210-491d-b174-cbd0d4ff5e94", "comment": "Malware payload (AveMariaRAT)", "value": "47e3d48dfc05cfb1d7a78218e23d13cd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705747, "uuid": "0a7ca4f0-d8ff-4887-8bf0-a6677b93644c", "comment": "Malware payload (AveMariaRAT)", "value": "449d68f816f777220922b061ddd7b58a5ad931b7fed71a7e8aa0e31ffa8c004a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705747, "uuid": "923811d4-3dce-439a-bf88-cab0c1f782a9", "comment": "Malware payload (AveMariaRAT)", "value": "3d39250ee31b1f90864285843c6c8c91bea18a8d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705747, "uuid": "a84cde1e-4b0e-4615-aa26-f64ae96ba551", "comment": "Malware payload (AveMariaRAT)", "value": "9c5433ed8f0e190cfbf661e18ce7373eafcbef305ea15a5a0589adf4b9cd1f3d70eee4f5348111047fde1c5ed0f83c41", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705747, "uuid": "d190a527-dcda-4d98-a713-7efe713fd7f7", "value": "T1E2552AA0F4ED2A45CCF6E1FE06065CD094E36E764039A05181FE6616863F94E3A377EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705747, "uuid": "1a079b85-2f85-4856-b4e3-8bcf45251bf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705747, "uuid": "81366ee6-e753-4a4f-9835-84233080e155", "value": "12288:L7PUb/8IVSzVM9i8M8FVlimMfonklozM+y608VmPz23Nx2wkTRYoAh/rfjp+Avl+:LfIVSzVM9imbJn6UdUBAh/7jNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662705747, "uuid": "9b53d322-6d0e-4c87-a5c4-44073030eea7", "value": 1385472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662705747, "uuid": "bcd76e54-ddd8-42b7-8259-64154eddd715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705747, "uuid": "5469904b-6163-41fa-b278-8cf280064333", "value": "SecuriteInfo.com.Variant.Barys.30112.3657.23804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ba47db-3075-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662751689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662751689, "uuid": "2ff8b908-8e9b-4cfc-a6de-1c31cc4e90a0", "comment": "Malware payload", "value": "284bdc3af49eb112f17eff1f5b6d5a0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662751689, "uuid": "4c84b04c-f578-48aa-b92e-19526a15974c", "comment": "Malware payload", "value": "468db25dd3329ea58c3494aac520bdebc92e9763309191d85e3e1d8d65285fa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662751689, "uuid": "d4382529-f370-4891-8abf-4a1b871695af", "comment": "Malware payload", "value": "4dce74a57fd71bd009be8b8b1e17243ca8a6530f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662751689, "uuid": "5869038b-286f-4a04-bd87-84731d4ccdb4", "comment": "Malware payload", "value": "85561639092ef7bb7023f20123fc35327a72a9a8e08dc24f120920f2770224a796d1302c32d8ab79c8cde55458408c4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662751689, "uuid": "d99b4a52-7388-48bb-8bba-58846d134cf3", "value": "T1A624CF61FA90C471F1E609348435D6A57A7AFC622A28A54F7F643B6F2F303D126B1336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662751689, "uuid": "225c45c5-a74d-4650-aef9-50f2dd3dab4c", "value": "1b356ecc92b2a52db834ffe06f790b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662751689, "uuid": "cc5a816d-366e-4db5-8d52-7ef8dc0c307d", "value": "3072:OUf8wALFR8LdRp5gUlDN9O6qSi9pBVrx2N919Hwi:HcLP8Ld/lngNTrxM9bp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662751689, "uuid": "df300060-73bb-445d-af31-8a16474077d6", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662751689, "uuid": "20459b61-8c55-42e7-8f73-d94e62a06d60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662751689, "uuid": "ba08c4f2-5400-479b-be2c-1cfb20e20854", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e74f72-304b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662733830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733830, "uuid": "58fb6289-07ca-4d47-a072-9cba4a7fea28", "comment": "Malware payload", "value": "9e260afbbcb63baa48e359ab6f6c224c", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733830, "uuid": "bf72d147-25f7-4f2e-a520-ec843d14e573", "comment": "Malware payload", "value": "4697617b68ae3730278079ed2a2c35eb5ba76cb66a4d5c9bbb821fa8c7c308b2", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733830, "uuid": "1ed331ed-ff8d-447a-9d97-6485e861bd49", "comment": "Malware payload", "value": "4061432ef0593768ed4d3409c7b2f1733676a8aa", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733830, "uuid": "f15f509c-c0b3-487a-9ea8-b7d811775b49", "comment": "Malware payload", "value": "eb369568a0a563d6ebfd066bba59dcb580b602abe968b2c9bd87457cb5d990c89c63e5f43fd489d0d39ccc70e6349bcb", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733830, "uuid": "5314f59f-333c-4201-bbe9-127077ba328f", "value": "T1F6119B669C0EB149A538880CD56B8034C37952034F601206FDFCA6B92F79658CA1487C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733830, "uuid": "8a13972c-9bbd-4351-9b54-f28696fbed7c", "value": "24:1X8duOqdx3FsJ4MADeER9g2yDwXOXsNXOXmpx:18duOqdxKJ4LJgFD/TWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662733830, "uuid": "dd5d5a8a-fdf7-4e81-898e-3f58bc937323", "value": 967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662733830, "uuid": "b248138f-414b-4cf0-a3c2-b15cb2a93dc5", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733830, "uuid": "215c3baa-c7b7-4f3d-b81f-b5b13dc5423e", "value": "main.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c904ebe7-3055-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662738052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738052, "uuid": "7863701f-b1a1-4d29-8b3d-4a6ee6eabfff", "comment": "Malware payload (Mirai)", "value": "66b27a1aefe6d1445016bb7fb48dcaa8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738052, "uuid": "be95a91d-2a49-481f-889f-66c98efc15c9", "comment": "Malware payload (Mirai)", "value": "471868a55460403854b5bede2d12ce3cb8157931f5033aa0c739837e0f581f95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738052, "uuid": "c6e7d383-5c66-44be-8e20-973086eaffee", "comment": "Malware payload (Mirai)", "value": "a5f2f562fcf566dfb6a0b97363d9a5c61ef3008a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738052, "uuid": "9fa38122-76e0-4ef3-8254-a00838d7da0f", "comment": "Malware payload (Mirai)", "value": "f4c0c760b3790fcb9d39107c92735080294d5d26b95ad256acbecadb4ae3306f81822680b7369f2ebeea31b85c0b2b2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738052, "uuid": "8c1b977b-4feb-488e-8f0f-bb86920ea390", "value": "T1C6F2F15D76202D87CCAD1DBED6FCE3959C10708074A98B4C07645C15EEEF98B258D0BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738052, "uuid": "aea32827-b9e3-4279-89bf-f362a03bf222", "value": "768:B1MnUVEttJGNgtkjqvP6NIcWWjUqsqpjtZWMr:BnFwPaIcNpjtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662738052, "uuid": "f5d21af4-7d58-4c90-8e96-8b6bc4668540", "value": 36280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662738052, "uuid": "81673afd-a8dd-430b-8e1f-4850f8062f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738052, "uuid": "7d840a22-0eeb-4f04-b95b-a666195f1591", "value": "66b27a1aefe6d1445016bb7fb48dcaa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce034e9-304a-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662733065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733065, "uuid": "fd210f22-aeb4-40ac-9aaa-726aa13cd870", "comment": "Malware payload (SnakeKeylogger)", "value": "877ba98c8e8ba6175b7bd2609adb9b44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733065, "uuid": "73bb7796-f3b4-41cd-92ef-932cd77cb9f4", "comment": "Malware payload (SnakeKeylogger)", "value": "4952a1b507d5779ad9e44e2976af3b6f890fb7d9f1bb685bea255300a70cf1bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733065, "uuid": "65a76244-d569-40b2-98a5-e8ca4e759a93", "comment": "Malware payload (SnakeKeylogger)", "value": "5d14a8b9ad7302bc2d695fa102c94e522da9d60e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733065, "uuid": "108f7f72-861a-4516-bf27-88e42320dddf", "comment": "Malware payload (SnakeKeylogger)", "value": "a14d6f71ba83cc441253674a70b90c5ab18c0a75be26bc0d9e2bba5577a1d5d92c0f76473ae6a5719074f0dd061456a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733065, "uuid": "0f1afe57-88ce-4321-95aa-3b6592dbe45b", "value": "T177F4E016F3434FB7A94496AE90835AC745E75E9FB000751BBFF74EEA102ED8E8721188", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733065, "uuid": "96f1f6b9-1fc5-43cd-8cad-2beaed16d122", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733065, "uuid": "39ba77df-d0e9-4347-81b4-c300bb475159", "value": "12288:wdDekOA5XZ7ITSZ2wd9fbA2YtsuKZj/pP+3Ub8FVBRKGkSoEp:aDBOap7VDjCbSpIJnmHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662733065, "uuid": "010f76e6-883f-452e-9eca-9789c7298a5c", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662733065, "uuid": "11811f5f-207c-47e0-8aeb-862ed85073a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733065, "uuid": "f169a417-05a1-41c9-b33d-7a34d0350f60", "value": "SHIPPING INVOICE DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaae6f91-3037-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1662725116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725116, "uuid": "2697a031-b142-4c44-853b-7b7eb187d450", "comment": "Malware payload (NetSupport)", "value": "07a8bc35ca1632555dd46a6867f22dd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725116, "uuid": "3992d9d2-a9c5-4f06-a85d-acd93400fbf8", "comment": "Malware payload (NetSupport)", "value": "496e0e9f8c0f4239f5ef32035a628fba3179722ae147e016ae72ae3a6d067433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725116, "uuid": "f9d6b216-952a-4393-b24b-d26ad3d6ec70", "comment": "Malware payload (NetSupport)", "value": "1feb0c4429e48bb877e9110c05a0a6022a3abacd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725116, "uuid": "2108f3a4-52f1-4ef2-9217-b40385263264", "comment": "Malware payload (NetSupport)", "value": "7c5433c5a5c2c009a1c92a142eecda1225c457c8a1a573530e54ee4199f1443bfd7864dc098baa5a3f97c0ac444198b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725116, "uuid": "4f18601d-b278-4259-b4ea-0eb831f6058c", "value": "T17024CF12BAD0C831C5E246344434E6EC2ABAF8666B68994F37503B6F6F303D16776397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725116, "uuid": "8128d5a0-6dc8-4ce0-bcb6-84077a30c452", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725116, "uuid": "066aea44-f457-4241-a144-a91f1de6ceb2", "value": "3072:FscRXAoChhLtLn65N7ed4mNv3Vj/4nptCpo5m+TtiIKifHm:xR0LZwe+sCCotiL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662725116, "uuid": "8e5eb178-316c-4a4a-84e9-979f404e4b83", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662725116, "uuid": "1917de26-21e2-426e-8532-246915c74c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725116, "uuid": "30b97894-9107-4fcd-9ec3-ca77fa9bb686", "value": "07a8bc35ca1632555dd46a6867f22dd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7929d6-308a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662760661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760661, "uuid": "2f0cbe2c-d408-4ec5-893f-9b5dff70ee34", "comment": "Malware payload", "value": "1252005b06b4de5df739cf0c603a6bb7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760661, "uuid": "2b8767ab-f0c6-443a-b058-7494d953fa52", "comment": "Malware payload", "value": "4aa8f3ce36fc8b8e5beacb689bdf4a839765af16b5478141d3bd0994d87f1775", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760661, "uuid": "c4ec9d77-fcdd-4f4d-bc96-5f8d2f7e90f1", "comment": "Malware payload", "value": "74146eb2fc9df060b55eeb7b7c60a15757f31d62", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760661, "uuid": "e14235c3-e6a8-4cc9-92ee-5da25e53c306", "comment": "Malware payload", "value": "d477ecb380cb98c1ef427678f33e21f47eb86ae3e34960b2d3c64685fa1026f9837242853b0eb3c7c6ccaf74f8b30ade", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760661, "uuid": "d724e274-8c54-49dd-869e-4ca2fa66ec59", "value": "T141B2E102ECAE54F8D6B05535D43E01409337337686E8B16B3628D039FB91457A9FEEA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760661, "uuid": "0ef13a1c-0e14-4f8d-9866-9e8595dd5a47", "value": "768:8x5ga3AxF7Zz84YmiSpn/y0pSMD0GLdm7e6TNl8O3UA6:8xaaMxkRq/HpDDNBm7tTT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662760661, "uuid": "226b2aa5-0829-4a14-89c9-2cc730c3a377", "value": 25328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662760661, "uuid": "bb982265-6e66-4d64-918a-9b30f978999d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760661, "uuid": "18e82777-933a-4302-82d9-d0d9c73ce591", "value": "yakuza.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1f2dcc-2fdf-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1662687220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687220, "uuid": "b4eabd5b-566c-4f5b-8e2a-7cab6b138b2a", "comment": "Malware payload (Stop)", "value": "01177fa5bba8bbb9c849af726fb592a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687220, "uuid": "293e050c-b9ab-4a56-8f19-c4b3eb8fc5f0", "comment": "Malware payload (Stop)", "value": "4d06c8d3c4fdf4deeea0a286fb758e3478de2b4969b7a21da686efe224a8536f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687220, "uuid": "7f7e3fe6-af2e-4219-8229-6618225e8a9e", "comment": "Malware payload (Stop)", "value": "5d836d114b79963e3b8376daee57355107860fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687220, "uuid": "c3071d8b-4fb6-4621-9084-1076428f6637", "comment": "Malware payload (Stop)", "value": "f8e786803f6ff5720dcbb5a445f9c4d388a04ce5f631a2343d05b83bef3cdb24518c71b78c37ebd089ae0ddc5e0ef640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687220, "uuid": "750d66f0-2ccb-47f6-a8b8-30c852e8aee1", "value": "T189F41291F8A1D430D5E6CD705871C7AA197EF8213B385A8B27507B2D6E713F92AB1323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687220, "uuid": "3c967f53-4182-446f-9d7b-4a992004fa38", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687220, "uuid": "d56ec26a-3d14-4696-9aa8-9af5b0dd9935", "value": "12288:BhhFneHIRw+iECxtHZFKYS93rcXL1dTuQcvdat+CMq2etQTW7FIQpj6:BHFeHIrvCxtz1U3rc7Lae+FetQTWBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662687220, "uuid": "97c0b3cd-bafc-4874-8565-3f6966c469ed", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662687220, "uuid": "54c401e9-d5d4-4e91-ba3c-5bd0a1cb4b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687220, "uuid": "34b48899-90f1-4f88-b671-cbde02075b27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789643fd-3033-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1662723314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723314, "uuid": "1d19a302-d05c-4b9d-a121-75141671a1cc", "comment": "Malware payload (NetSupport)", "value": "6d5250018e4c33352438f9f8db42c992", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723314, "uuid": "2f6b5ecf-b216-4e0e-9b2a-196abc7ee1b0", "comment": "Malware payload (NetSupport)", "value": "4ea78a76cc5d9246cef41b1f969023406069c176ccd85b756b81a2ff333e7de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723314, "uuid": "7e932e49-1e97-4cd0-8679-6a147455f959", "comment": "Malware payload (NetSupport)", "value": "8c579843f570f1e3defb41df8586b3851c154fdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723314, "uuid": "f5d85d59-0fee-40f7-b64a-cc3396c42974", "comment": "Malware payload (NetSupport)", "value": "0d4e2f9a26ba56a77bdde3fc6f67f33a926255b9190525827cacfdb4687f1c784fce9d290bd4df52f44caffcf2c38a7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723314, "uuid": "5df3ec1e-fe8f-488d-ba8b-13b91705433b", "value": "T15B24C062B9F4C872C1E789348030D6E42A7FFC626679994F7B94776E2E30AD02675313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723314, "uuid": "b3f614dc-4bb4-42ce-9378-d6e7e7cfbd56", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723314, "uuid": "e4927693-e1ff-4f16-ab18-1b4901f34215", "value": "3072:hndAGtTPpmeNKk65W+G3ZNWzhHfeNLH5vJfij:bdpZNKq+G+zh/gLZvJfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662723314, "uuid": "060a63a7-e71d-4534-883b-65fdbcdb130e", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662723314, "uuid": "b65200c0-85b1-4ac0-89b1-9e441722f1c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723314, "uuid": "f529095c-a5cf-430c-9863-d840e29c9582", "value": "6d5250018e4c33352438f9f8db42c992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910dee2f-2fe0-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1662687707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687707, "uuid": "7ec2b222-e8a4-4bc7-9ac1-819245c7eb53", "comment": "Malware payload (Formbook)", "value": "9c8c029b138e553acce66a81b8cc9504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687707, "uuid": "910086ed-f7cb-439c-acd6-968e4c321eda", "comment": "Malware payload (Formbook)", "value": "4eecf4c73d1d4ce4d43ecd6b4d1d3e9c5ea8a310b2cb45e9bf16847863febf4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687707, "uuid": "4058902e-db36-40a8-a3ec-52c8d9d0632c", "comment": "Malware payload (Formbook)", "value": "eb8caa83a32337e19abdbd32414c3b3bf8d2dc0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687707, "uuid": "d9da343d-00cd-48d8-84a0-a8e90277285a", "comment": "Malware payload (Formbook)", "value": "a8c0576d65d0cf11f46b153743ab050ffdbbf2a7929eb36e4c43fed72492152dcc3935024999eef0947930815659c437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687707, "uuid": "60cd3e04-9c7d-47e0-b208-f220f23188cf", "value": "T17D151A0721C50DA5C47290BC24CCC5B75BAADE45E63BC946BFC99CAFF592F2846D22B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687707, "uuid": "445727e9-635f-434a-9069-afc9e88c3b02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687707, "uuid": "55c57dd9-571c-4d06-9904-0cc3c1e35d5d", "value": "12288:EBNdYxD+wWAQXp6Fn5u9jJNteeCVxZSTC6T0smB9F7Q2:AnYJ+wWdgFn5u9jDl4x02GoB9ZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662687707, "uuid": "62179656-7aa3-4f83-a14d-32fedbc76fca", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662687707, "uuid": "0c1af2f5-8a33-4be2-8df5-c673463ae039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687707, "uuid": "ce3c2048-da83-4b09-a3be-fe99ea6f75a0", "value": "SecuriteInfo.com.Trojan.Inject4.42183.20502.1679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78dfb9e-3027-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662718373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718373, "uuid": "50bb1099-e1a4-4895-897a-9bb09af419c2", "comment": "Malware payload", "value": "504ba6e3e95fd094c17dd8d83c5cdc68", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718373, "uuid": "a1f99fbb-f877-47af-ac49-6340f663788d", "comment": "Malware payload", "value": "4f8f1c2baf0ebea0bb0b0c3e9146ca58db0d398e8962109f9a53e191ebb29610", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718373, "uuid": "4c2000d1-0e49-4916-963e-46bd02600e9d", "comment": "Malware payload", "value": "a1ec5b1d059246fa2128d5940b641e91ce8ee07c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718373, "uuid": "7f3a8aa0-17f9-4dc2-9947-c875ab5a96b8", "comment": "Malware payload", "value": "94e6a08bcd5daa8483474ca40ef328e3ac3e565ca8180d5df2286cde08b05c4a94b3be94ec99efe938df141d7825ea3f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718373, "uuid": "cd158662-d0f1-4231-b68f-9f4671826652", "value": "T1EA13D01EC049B839C99F3AFEA08DD484F64941C1501A5A5BB568F36E4F421CF276FBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718373, "uuid": "1a29837a-02c8-4adf-9d68-0aa799c7ba78", "value": "768:iimumPVz+b4z0i1JYL3c932Yg8T68gZoRTnZ0C9LuhwTwp78f:ih0qaY32BoqOnZ0AGh8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662718373, "uuid": "82c892dc-77a4-40cd-86f1-32fd0d7a71d7", "value": 42709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662718373, "uuid": "aeac71d3-ac92-4c22-9e57-21d2e373f2f8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718373, "uuid": "4befa291-a1ab-4917-9f53-5b61c522c35c", "value": "Untitled attachment 00017.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fad9e69-2fd4-11ed-9266-42010a9c0072", "comment": "Malware payload (IRATA)", "timestamp": 1662682416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682416, "uuid": "de463885-b861-4ce1-947f-cfb952bb2f3b", "comment": "Malware payload (IRATA)", "value": "4e287195cf3ceca08d3eadbfde44ba1a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682416, "uuid": "32ab4948-ec48-4fcb-a73a-6e10dd83dfad", "comment": "Malware payload (IRATA)", "value": "50abd8e28534d77ae9fa85c016a0fb180e372f0284fd84014dc7fc9d42692883", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682416, "uuid": "6d7c7bef-65f7-484e-9f8b-ad30b017afa6", "comment": "Malware payload (IRATA)", "value": "15a0e7906783dd2d4cffc00fa650e107eb277ef8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682416, "uuid": "5049ec07-7266-4d29-8450-d2fe9cff76cb", "comment": "Malware payload (IRATA)", "value": "8c66e89359bb5f2cde6d95fa8753edda1a62eab8b13c1245047ffc984bf32afc86f59aaa1b506cdd8d4f6f659e7c89cf", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682416, "uuid": "dea1e5fd-9ae7-4d79-a9f1-86e63dd86277", "value": "T14CA51253F226D92BC8F2D37222B5163660734D289B43EA8E3D0977BD24F7AE847546C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682416, "uuid": "29b635ae-ba5b-4c8c-b5dd-a66b1b541ce6", "value": "49152:nhiT1hXbMAIEa2kPdeCmyDR2//gZPr3ZC7ow2eR53q8:nATjIfEaTPkCdRyiYEARF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662682416, "uuid": "8d7c4472-deec-4ef0-9f0b-c2f279c82b87", "value": 2208554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662682416, "uuid": "547fe025-0928-4579-9589-0b45e7b4ba23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682416, "uuid": "2c2dd0cd-9cdf-46f6-a01c-f3abd843cf22", "value": "\u0645\u0634\u0627\u0647\u062f\u0647_\u0627\u0628\u0644\u0627\u063a\u06cc\u0647.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9926fff0-2fe3-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1662689009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662689009, "uuid": "e534282a-684d-4c4a-b274-41f410ed2e47", "comment": "Malware payload (Stop)", "value": "54baa187ef36c20673d01f57b6aacc47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662689009, "uuid": "371371d5-f7d4-444d-8bd6-3c506ed95c7e", "comment": "Malware payload (Stop)", "value": "53273f74d14d08f30b348131249213ed89cb9b9ec260245d2d5e6098a1f425ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662689009, "uuid": "09479f09-794d-4363-bec7-9b01fb48db10", "comment": "Malware payload (Stop)", "value": "135fffa91de3407632f5256b9fb2f8b3f481ea9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662689009, "uuid": "4171511b-b208-4aa4-a9f6-d1c282a367f3", "comment": "Malware payload (Stop)", "value": "5766fa0b39215e30b02f0e525c26780a5319d77f41edba0212143aba93dfad9d981a1671e0fa39f605e20ac8845221d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662689009, "uuid": "16811c7f-05d0-4cd2-a574-08f5e9dcb1db", "value": "T150F4235278A4C431C2D70034AC31F39526BFFAA26A24880F77947BAD2EB63D19B77355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662689009, "uuid": "9de251d8-672b-4ea8-8cfb-512911d543e9", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662689009, "uuid": "0225c592-735a-4fff-bf43-48f63533d727", "value": "12288:sYlWbIzWnqbTMTfvu/J4VL+T0Ldf6/CB9e50EILI4y+d6ZQgxQk:s+Ommq/J4Thi6B9ea/I4yBuNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662689009, "uuid": "dfb516d9-3c74-405c-9fc2-c368c2b884ec", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662689009, "uuid": "6f9035f0-9c20-4dc2-8f7b-b3b12ee04e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662689009, "uuid": "d7b5a042-dd33-42ce-b38d-51f44f8ff141", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc61537-3080-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662756551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662756551, "uuid": "7d65663c-439d-4d1e-8cef-caf591614205", "comment": "Malware payload", "value": "47ff1b959b5bf243a2f0778cd47eb928", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662756551, "uuid": "2270f791-db72-4b8e-b287-27f06703762f", "comment": "Malware payload", "value": "53304618643cdc79b032becca67d8f5b29e7202ec25e7bb724ce712a03ec6592", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662756551, "uuid": "56bf32b8-9890-4547-b818-05aef1c0e627", "comment": "Malware payload", "value": "420e96b4d5eae1383802b78865fa3becbb2b96f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662756551, "uuid": "47b4d0a5-082c-4c1c-8aa4-477651e1b44f", "comment": "Malware payload", "value": "f987ec7cba00b9a0683b7de969a0c9078f7169f29e0562e614730f5ff2e0ab5c4e32119d987ddcfd94a9d94335430478", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662756551, "uuid": "6383356c-8026-461c-9d3a-d12c092b36e3", "value": "T1B454F1C8F7D8480ACE1B9FB1489645D39530F5ABA143D37368C5E3A82D123FAA94D277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662756551, "uuid": "364d6d6a-353b-4265-b214-89b2c7375636", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662756551, "uuid": "f3f5322e-7a27-48d2-825b-5114cbacad08", "value": "6144:SL20R+LBtxb4bxS44FpQMNEdpFgGcgQ76iUuFYNuWGzSM4dDjMc:rwwBtAxxNMNEzU7f5P+M4dDjMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662756551, "uuid": "066cdf12-947d-4303-9c89-d42b39099e78", "value": 279984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662756551, "uuid": "1cbc150d-ee77-4075-a8a2-dc53f441e21f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662756551, "uuid": "5fb4f759-00e4-4ab8-afb7-324f6d4e8388", "value": "SecuriteInfo.com.Trojan.InjectNET.50.21259.11768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33ab665-3016-11ed-9266-42010a9c0072", "comment": "Malware payload (DeadBolt)", "timestamp": 1662711037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711037, "uuid": "58b526b1-ae65-4531-a7a0-cbc8098feafc", "comment": "Malware payload (DeadBolt)", "value": "c582985dc5a6973820e61b1e7ed09669", "object_relation": "md5", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711037, "uuid": "6d47f168-51bc-4fab-bae9-e7da1bdb2c82", "comment": "Malware payload (DeadBolt)", "value": "5367773256fb1932c569ffb80e7942926be2d4806b6a96a3af22d9ac624933cc", "object_relation": "sha256", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711037, "uuid": "4f78921d-cde5-4d47-ba2e-295616a7afc7", "comment": "Malware payload (DeadBolt)", "value": "5349cd7a3f471bf4559472245278d27c74fd0230", "object_relation": "sha1", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711037, "uuid": "9a5ed247-6899-48a8-85d8-d9f8e0b54caa", "comment": "Malware payload (DeadBolt)", "value": "732ed438adddc03a6705e5674154b79e9afb0595c668fe1159f39bef64e876fb43ad33daa83ef0633b0b639523b38143", "object_relation": "sha3-384", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711037, "uuid": "008347d3-5517-4954-bff3-cf6455d91eb0", "value": "T177E54A43F889A2E4C4ABB2388E6552A1BB30748E173573D33B6097BA1F367E44E75750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711037, "uuid": "233a19ca-107b-4435-9a93-f81da121eb11", "value": "49152:FS/rdtRc4Qmyfo/dQVwBKfgY7p4VmRGq1:c/N+/By", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662711037, "uuid": "57242247-17b7-4c6b-8542-e02a233226c3", "value": 3031040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662711037, "uuid": "320daba9-7f5e-4435-a18b-e518d7f0f636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711037, "uuid": "dc485d6d-bcad-42e6-ad60-824a23d35b4d", "value": "5367773256fb1932c569ffb80e7942926be2d4806b6a96a3af22d9ac624933cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1854a5da-301b-11ed-9266-42010a9c0072", "comment": "Malware payload (MassLogger)", "timestamp": 1662712844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662712844, "uuid": "50ef55d3-cff3-4780-80d3-e7943de066a3", "comment": "Malware payload (MassLogger)", "value": "da88b9d5a99843082b9258e087ae0ea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662712844, "uuid": "ee51a3bd-73cb-47c7-b839-5b416cacd74d", "comment": "Malware payload (MassLogger)", "value": "537eefdd89c53025ce3e521a0dde0d2dd99bcf94f6063fd6b0823e259c72a26d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662712844, "uuid": "819364dd-c533-45dc-b4d1-323fa46421ba", "comment": "Malware payload (MassLogger)", "value": "d425103a22463af1f8070f394a147b0e2d3ca8e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662712844, "uuid": "107e0d6d-ce18-4613-9cf7-7dc518097328", "comment": "Malware payload (MassLogger)", "value": "ef755ca7ef061a8f067a12ddd6a8b57e8ba8b87426092591e042c65ec39e773c4b0fe13e5e0c1e0b3ab94d22f5e7d393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662712844, "uuid": "728f95ed-c4bb-43e8-b953-3f17e3da892d", "value": "T1F8F3D0ECBBD80C46CA5B8E71489144C38530F8A7E593D3B664D5B22909867FFB90E5B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662712844, "uuid": "a9285362-fa75-438e-8015-a2bbdf6cdeb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662712844, "uuid": "d22b6b91-3bbf-4305-b3ce-5ec3e1a22ef4", "value": "3072:GspYocLKwD+MctFYFroOyKMPggSE9bdB4/tTc0owUdTZ5yMHHMc:YJN8FIWKzE9bdB4VTotMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662712844, "uuid": "975870ef-2712-4108-9b6c-3a6b78a69cbc", "value": 162224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662712844, "uuid": "a66de603-1482-49cd-9494-3a90e2a5f795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662712844, "uuid": "5d94d7de-808a-4741-b4a4-f7a624b41c27", "value": "DEMANDE DE PRODUITS_SEPT2022.xlxs(66kb).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e54c62f-2fdb-11ed-9266-42010a9c0072", "comment": "Malware payload (QuasarRAT)", "timestamp": 1662685447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685447, "uuid": "b08dfae5-ed38-4bc7-9465-f98311e17df2", "comment": "Malware payload (QuasarRAT)", "value": "289be5041440c4f1e1abeb0e3fb3eabc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685447, "uuid": "86ccd43e-40ae-4b1e-8846-738c2af8d74a", "comment": "Malware payload (QuasarRAT)", "value": "547679ede9037e0edceeaa3e10b5f9ba6b8af47e6a3fa38b825c769005f182ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685447, "uuid": "1c352e7e-6dc7-4742-8636-507f3ef9cb11", "comment": "Malware payload (QuasarRAT)", "value": "16411711b6d4ee7172294355fb17b5e2ecb79056", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685447, "uuid": "4342ef27-0053-4155-be1a-5bc43dc72a4d", "comment": "Malware payload (QuasarRAT)", "value": "4f7dcbafc32addfffddeeb26fa47f7c40c5dbf512ed630d591c89a588ab73cbf8527f95fc415be1efc5d4525a6405acb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685447, "uuid": "665fd1ba-2ee3-41d5-8176-0e656e4c1a3a", "value": "T1C8352914F7E855A5F06E7F3674B198050B38FE03693D974B2B9690991E2A380CCB2F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685447, "uuid": "23cabcb0-1962-4997-9474-a3f433b9c533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685447, "uuid": "18a15c86-78fb-459d-a2a3-79c247c69bac", "value": "24576:5Lynkc1ZzBvtrZHFjMKY270Nel0ooK+aRF:Jynkc1ZzBvtrZHFjMKY2wNel0E+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662685447, "uuid": "5985f760-9274-4384-8504-b66d39cf1bdb", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662685447, "uuid": "3757e506-0499-4040-98de-895bf1306c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685447, "uuid": "b25db79e-5837-4f9a-80d1-4d4aff7776fe", "value": "289be5041440c4f1e1abeb0e3fb3eabc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cf84a5-304c-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662734011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662734011, "uuid": "88e1286d-49a5-476b-90d4-88665f71a3e4", "comment": "Malware payload (Smoke Loader)", "value": "139d67c29554076e3ef6406ca4e9886b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662734011, "uuid": "f7e0abf3-9240-4fce-a4da-22533ea038cb", "comment": "Malware payload (Smoke Loader)", "value": "56abf3eae52dcbdcc1a477c9391030bfa1b297ddfa208e561d6a7ad0054b4b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662734011, "uuid": "2aacaa51-4bff-4fa7-84b0-8721ac47272e", "comment": "Malware payload (Smoke Loader)", "value": "e12e8e853c3934c3d23f309ea37f758593bdc3b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662734011, "uuid": "6bd5a7aa-f2c7-4b99-a97a-e8f399539060", "comment": "Malware payload (Smoke Loader)", "value": "026107ca89734b7a7195b0e8664b444a99939fa450008288db98e00f75854519457f83b343ae099b492a765aa26ffdac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662734011, "uuid": "b41c8f81-12f2-4ce5-9f2d-759a3b283626", "value": "T1E324BEE1B580C871D4F345384434E6E46ABBBC621F65488B37943BAF3E702D26AB9357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662734011, "uuid": "1c29e025-3b00-4822-be4f-88e29bae57bd", "value": "8214eaa7808ae504d4e701b905d3948e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662734011, "uuid": "97aa04a6-8318-4cc0-a4ea-8ae4c56ee8d3", "value": "3072:SaDs4Yp/1Vv8eac5G5Xca8sdKAaJsjyF7WBptzZLsrBOPj1:w1Vv56Xc3scHWRNE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662734011, "uuid": "5d07a7bf-eb8b-4511-b3c7-71653328f28e", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662734011, "uuid": "c328928c-1ded-406a-ac11-62421e6e21ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662734011, "uuid": "f9deb880-316a-478b-bb91-f88c1e175510", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e1e1eb-3021-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1662715689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715689, "uuid": "02ed5a75-013e-4385-8f1a-6fb7ba11c177", "comment": "Malware payload (Stop)", "value": "da2bd243d9b4d03f81edd0c339031299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715689, "uuid": "881c96c5-abd0-4f0f-b327-cef6a761d115", "comment": "Malware payload (Stop)", "value": "5718efcc7fbdfdc203bcdc098b56aaeba9131f7fe59fe2f1f78685a899840ac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715689, "uuid": "aac3db03-b372-420b-bb96-edfe38edfff2", "comment": "Malware payload (Stop)", "value": "57d45114484ce1f8801bbbd3ae1b4ebdeb20c1dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715689, "uuid": "cba94c78-c6bd-45ad-b02c-bc4ae996fcd7", "comment": "Malware payload (Stop)", "value": "c92ffb3bb3153b9c8282e5cfe4c075d8d6d08614486ec52eb9da8de0e8f854cf8362e84481e2e72844cf9fffb16ea679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715689, "uuid": "31dc201b-ae3b-4464-8294-484a0de8abd5", "value": "T162F41212B6A0E131E2F281344439F7652A7EB8623B68D94B6754779F7F702C06239BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715689, "uuid": "832b8e9b-ff6e-4b9b-bdd4-9f180053fcf3", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715689, "uuid": "ce34259e-027c-44a3-b227-fcc4444d2001", "value": "12288:/vTd0NaAYNy0n3wziSwLgZY0xkY6OjPOghu4Pny87Nli7iGkvxTJs4Jr:/LCNaAYn3KZAOj2xGnr7Nli7ih5FsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662715689, "uuid": "618f5ec4-81f8-4c24-8ed0-4654532cba26", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662715689, "uuid": "f87d377c-9c7c-404a-bcd1-411cf1398ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715689, "uuid": "4c6ba13b-0ac8-45bf-967d-41cf5916352a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91b6190-307a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662753916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662753916, "uuid": "76b94069-519d-4be9-a901-64da0c101282", "comment": "Malware payload", "value": "406b0bffce09ae1f1bbeee92745aba93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662753916, "uuid": "c1c454fd-2a65-4940-8ae7-f65fcadd0686", "comment": "Malware payload", "value": "57edb17976437e8a4d8ccfa21d83fdfcc3ccfb6077482bf2138b4553f6922afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662753916, "uuid": "03819937-536c-4320-9971-4a1c9f5e4db7", "comment": "Malware payload", "value": "8edd44402d2f8d2607cf2dcd16b90ab0890dd196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662753916, "uuid": "49a2245a-d790-4e92-ae88-9cfb663aadc7", "comment": "Malware payload", "value": "c73d4480bc818c5f30d65e22256fbc876bd7911def39a6417893e46af96413f5ad6497fb16e575a19b446fd7aa0aa7df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662753916, "uuid": "1806da69-da4c-45d4-9dd8-c39b6429424a", "value": "T14F36123332541190D0D7C839D93BFEA872F617768FC2D8F765DA5AD22A065E0F222A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662753916, "uuid": "ebaab446-03cb-4967-981c-fb552e73623c", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662753916, "uuid": "d506ca99-cc3e-4535-9ec1-c6b8b1100bea", "value": "98304:YEg+D8P340GylQsXiV9cPEaFFXjZd3zvdtXexy3h1QCTKY:Y28P4uhiV94TjVHbpTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662753916, "uuid": "6963b91f-c342-4d62-8421-390517451a0f", "value": 5203408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662753916, "uuid": "9363f3c4-bbbe-4ab5-8fb7-a671c277b76f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662753916, "uuid": "bba15de7-28fb-4dd0-8e82-1e561dba530a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3e3464-2fff-11ed-9266-42010a9c0072", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1662701041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662701041, "uuid": "54220fde-25fa-4161-981d-77faeb5b996e", "comment": "Malware payload (ErbiumStealer)", "value": "3d53008cb949c88fe334437a7a2b9a7d", "object_relation": "md5", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662701041, "uuid": "7a30b827-c8a2-4bc5-a62d-48d0c9737317", "comment": "Malware payload (ErbiumStealer)", "value": "58b94e4512fb32ed431664032c8401fc2c6082121fb9e6c25a001ccf0c5ae4b0", "object_relation": "sha256", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662701041, "uuid": "23ce90e4-7d46-4449-a927-2a58129701cc", "comment": "Malware payload (ErbiumStealer)", "value": "cb6796d5f60a84567586c30f18a60576063f3473", "object_relation": "sha1", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662701041, "uuid": "c5b7926d-6642-4079-be9d-c52e86d50b01", "comment": "Malware payload (ErbiumStealer)", "value": "39478d65e3c6ef266629d4a4502fbb9381680540c57ab6e491e7a2ef47adb8d1abf294d0f2e87e6e1e33d50b0f5aaa0f", "object_relation": "sha3-384", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662701041, "uuid": "430b301b-9cff-416b-96e4-9693ccae728c", "value": "T143251929E70729F0DA1756B6855EEB779B18BB148032AF7FFF5BDA08A0330123C49165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662701041, "uuid": "c5064e01-f4fc-42b7-b2e3-2d10a11795ed", "value": "1797ab721d550312b93ab992a1e04176", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662701041, "uuid": "4e721ac2-d5d1-4524-8345-2ab3335270c4", "value": "24576:JZikkTYlYv8DW2YMIpoO7r/diTLVQNBO:qk4LaQTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662701041, "uuid": "de8694e3-ea55-4443-ba8d-02e586cfdbda", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662701041, "uuid": "b95c96c0-f745-4dac-b76d-8c2d6b1f92cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662701041, "uuid": "a60f4288-bb7e-42da-b28a-ada35a9a52aa", "value": "3d53008cb949c88fe334437a7a2b9a7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0d382d-3018-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662711565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711565, "uuid": "48774bde-02bf-4dd3-9115-c0aa155b61e3", "comment": "Malware payload", "value": "48b46ae519c8ca2be6cd016819c3c004", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711565, "uuid": "763f9d25-91c2-4b1e-9a9a-d5fae3faf87b", "comment": "Malware payload", "value": "5a4724cd407720b0017ab8d1169ac3ae5670f42ea53c511eb5683c20398a7297", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711565, "uuid": "71139227-2f99-4be2-ba67-dc86084dc2a2", "comment": "Malware payload", "value": "274b1035cde757d210afbe82ca909b2a3d9e7644", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711565, "uuid": "8bd1989f-8bc1-4209-8531-cb6ffac8d9dd", "comment": "Malware payload", "value": "fea30fedd8bd97f782a3fedd729127e2f00d388cd0523a1b4e13272dba468a68209de597dd7e1a63998b1316f9bc6720", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711565, "uuid": "b985082d-9f8d-4b5b-86cc-c38415feb2bb", "value": "T1785301D02775178C5271E87539DE306F8124562F329A2A102DA791CEFC1A213A9B3EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711565, "uuid": "6aba4bfb-c187-4431-860e-a2015f99a4a1", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFL:8D+CAXFYQChaAUk5ljnQsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662711565, "uuid": "ea68443b-c784-4088-a5dc-c7ccafb81bae", "value": 64890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662711565, "uuid": "e86fcc5f-0fff-40c6-bc3e-bf4e8ec52434", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711565, "uuid": "8dc4bb61-15f3-4155-b7d9-f584f2943489", "value": "48b46ae519c8ca2be6cd016819c3c004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e629ffcc-303f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662728652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728652, "uuid": "84a67eca-8b87-4f72-bf5a-c70df2e5afec", "comment": "Malware payload", "value": "505739f85ae463d6f236717d3aff0239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728652, "uuid": "5b71dc7b-677e-4ac0-96a3-d93b40e9f256", "comment": "Malware payload", "value": "5ab858633f43895ce93b13f2b214d6a0613f983f03c47a5e7e613a890ae2050b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728652, "uuid": "d152ab70-3e02-490a-84f4-72c3e764770a", "comment": "Malware payload", "value": "95a0f67692c617f6e45930987a608ec57e85c1e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728652, "uuid": "91f6a4fb-3906-4521-a7da-425a989f930a", "comment": "Malware payload", "value": "8bfa51df19d53a9e4d534eca1c8153de3668500a99ddb17bb0ee800512feeef46eeab3ecfdf8476795bdf88f74109a00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728652, "uuid": "5ff594a3-4e92-4bbc-a112-3d196fa0e6dc", "value": "T16E16BC9DB26072DFC857E476CAA81C64FB6474BB830B9203902712ED9E4D99BDF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728652, "uuid": "c35de241-b0e8-426a-8778-b0cf7e18e2b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728652, "uuid": "cb6f2296-d3fb-4612-88be-c7040fc23dda", "value": "12288:HylUob0Z+yRuQ7LTsYAvRM0GpFd8JrDtyRcAOdK+4meTCAgiP8WldNOiRA3VX84B:Slt4duCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662728652, "uuid": "3285862e-76ec-4afc-9fda-78eba209156c", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662728652, "uuid": "d289a866-8b32-44b2-b4ec-e690837920ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728652, "uuid": "ecd07917-b8c8-49d7-aa73-463462b73b7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0659a69-3026-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662717797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717797, "uuid": "6b8456ce-1767-4efe-9eb1-f15a57c9df06", "comment": "Malware payload", "value": "5ea09e9cda67542cfbf75605bfa8f7e9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717797, "uuid": "9edd93a6-3b7c-46ba-8113-9a7505468b34", "comment": "Malware payload", "value": "5e636465473340cc6326111ef6c4d4c263e562ffde5a78cba73afee941f717cd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717797, "uuid": "5b272ab5-0701-4978-badf-aedbd970a1b5", "comment": "Malware payload", "value": "de93979f36bad192fae2cad9145ab328feb3a656", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717797, "uuid": "3948bb6f-cb38-48e7-a54b-b9b9454f067c", "comment": "Malware payload", "value": "db8bce07c5cece6cbbc168c749e1819ebb3e32250dd81414c324e13bebec697057447e23a7edec2192afc98e927cd3e8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717797, "uuid": "3b0d41cc-fefb-4bdc-b904-265fd3679bf0", "value": "T19F03E12DE508583EC6AB4A79E5E80072F9498A92D3C6EA4F0C54D3AD4F40ACF575B3CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717797, "uuid": "3817b8d2-3e5c-441a-b1d1-4e3383576a84", "value": "768:gtk5i1/kybmoB58VtWXFgzzoRTc2Iw9NKKuWsp1GT8ya:Okq5movKEgzcc2TeWsCT8ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662717797, "uuid": "ea5d58ab-b049-4919-9265-7e60911d8593", "value": 40497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662717797, "uuid": "ad842292-5026-4690-b718-130cea7eae00", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717797, "uuid": "1e5d4d24-a61b-49b0-b3d8-97c9b6684e7b", "value": "Hello\uff0c\u6211\u662fAmy.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3129155-2fe7-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662690824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662690824, "uuid": "aae198fa-fc59-4f25-96bc-2cea92a8c14a", "comment": "Malware payload (RedLineStealer)", "value": "166c3798b87ec8c9bef215a374777cfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662690824, "uuid": "8d7d76fe-4284-4bdd-a990-fdab2239241f", "comment": "Malware payload (RedLineStealer)", "value": "5fdb7eb927c7423d445d89dba11c6d5a2d50eea61cf8fe061c4dd2fc55874f55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662690824, "uuid": "4c9a0f0b-5d84-4b9e-ab9b-cbbf86dbdd84", "comment": "Malware payload (RedLineStealer)", "value": "452feb03fa61d175f030bfd6fd5a7382eef7ef54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662690824, "uuid": "4c58bfa5-5e63-4c22-98ca-13cb7a481e17", "comment": "Malware payload (RedLineStealer)", "value": "52046a01ce54575080548c2255a7d239c82a42dd79f08f060c080f5305faf07ab947732132c2047c2457a354cbbeddfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662690824, "uuid": "af8c4398-2867-496c-9fa4-9385cc67a81e", "value": "T1DB24CF1279D0C831C5E644308435DAE46EBBBD62AA34894F7B983B5F6E313D127B631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662690824, "uuid": "1d3dc558-bc8a-4344-9b28-18bf0129ee50", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662690824, "uuid": "d8aafefc-8e71-49a8-abf1-1202f1fa92bb", "value": "3072:rn7rSZlY4T2zdGuWJcxfDuNr3H/nmn1hWS9CymnmiyUXJp:XrcmYudD3nHW2FiyeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662690824, "uuid": "3a9c0b4b-7995-4d3f-bcd1-cf075a79224f", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662690824, "uuid": "2b9b64f5-a7d6-4b33-b9b8-76f23c597217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662690824, "uuid": "b9212262-a042-46e3-8aeb-271a64623c11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fda0bba-3047-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662731835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731835, "uuid": "baeb593f-4158-4afb-b6eb-bb845a3bcd32", "comment": "Malware payload", "value": "2a2643f11e58aa316f3c447ec6935142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731835, "uuid": "70ab73dc-0dc9-412e-825a-346cddfe9333", "comment": "Malware payload", "value": "60605be4a782a0f6d9713a71d70b154ebe3f5a9d19db83adcf86ffc1e9e969d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731835, "uuid": "e905cd60-940c-49cd-a32c-5d03936303e3", "comment": "Malware payload", "value": "1c3a8e38a57da513a506c6c76db3a3774d48b3d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731835, "uuid": "4be660a3-a0f0-44a9-b5b8-f0bbaec4c0e7", "comment": "Malware payload", "value": "99c4dbe79a68e2d2234e9103f2de43066f040ee565031a23b61ab60c3721aabbaacf8c6ef31b114c436bf4022149d4ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731835, "uuid": "a97b493a-e98e-4161-aa3a-30037ae31365", "value": "T199F41212BCD1C434D443C63448B5A5E4E6BEB8665F70498F37583BAF2E722E062BE356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731835, "uuid": "292677fb-96b9-4569-9f63-a670ba922dc4", "value": "8214eaa7808ae504d4e701b905d3948e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731835, "uuid": "2a0c74a7-addf-4ae5-a487-d47aa5fdf39d", "value": "12288:Bc10590Uz434Q8WdLLgy596TYm1CuQKHnwJWnVeKsBadghGri:Bv9ygyYy59+YwYJYeXBggEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662731835, "uuid": "8b7fe915-acc0-4fc0-93ee-065f53387470", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662731835, "uuid": "8e7cc0aa-1b08-4d86-a489-036086a76ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731835, "uuid": "8218b8f5-3e87-46b1-a00b-99b22a44fbf4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f037d2ef-3023-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662716643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662716643, "uuid": "4b608e4f-0b04-4c51-9bfc-e7f64a572739", "comment": "Malware payload", "value": "d4191f245f4be741c24ef26117ba4a07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662716643, "uuid": "51586a54-1642-4a59-934e-16ddcad1ba48", "comment": "Malware payload", "value": "6082e08257fee1c87fa2a8af57fea740db6dc0977cf8be11ac48ff8e6cefae81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662716643, "uuid": "ae63e0b8-f032-4b0a-b366-9508dee354ee", "comment": "Malware payload", "value": "6c492af251b7fb294ba495cf33acdbac5c5d5c35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662716643, "uuid": "412cdf04-8128-4605-9113-4d6ab7c0055b", "comment": "Malware payload", "value": "ff55b886930c3546a88d92729b8f4c5b5709f0c2fa1169c556cc4221f07a0d1aeac531853155e3456c18ff218741db0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662716643, "uuid": "3a464c71-d40e-4489-a442-91885d5045f2", "value": "T14E24BF1275A0F831E5E2A5306438C6E47ABBFCA22A74594F7F583B5F6E703D026B5312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662716643, "uuid": "a464a56a-9d9e-4330-98e8-b040823980f0", "value": "9ec19ad11da368328b1ef380c14dc8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662716643, "uuid": "1b2d6518-6d9e-4981-bb50-25e0e42838b6", "value": "3072:mi5Fdah/IRgI+L5tNnhtjiQHD0smxoxKREc6DHlwy2Ibzad:NUI+IkNhpbHD2d69LlwOfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662716643, "uuid": "bcadb8c8-cddd-43c6-8ddf-5472194af166", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662716643, "uuid": "8faa5568-f46a-4afe-a247-6bda85c0f720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662716643, "uuid": "85663c15-51a8-4f88-a91f-1493e0f83004", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcce22ca-2fe4-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662689552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662689552, "uuid": "8a923f89-e289-4f6a-9620-a5334c098489", "comment": "Malware payload (Smoke Loader)", "value": "99cc678edebe5f5a8201167ee9d46e64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662689552, "uuid": "a5a05102-0743-4d17-94e3-6b8c223cc00e", "comment": "Malware payload (Smoke Loader)", "value": "61b798b00b569454bf35692eaa31eecedc70c057502d6bd7b5b56f9076bf794f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662689552, "uuid": "54378369-5913-4c3f-af50-a1b066ea3301", "comment": "Malware payload (Smoke Loader)", "value": "3583e81448bfd5769c3cab1bfd781a1d2b5af673", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662689552, "uuid": "084db32e-473d-49ec-8347-4851eccf3f6f", "comment": "Malware payload (Smoke Loader)", "value": "3032a85f3260c879c58e6fc7493cbc7d2629ba3eb717b122b53916d8f49159032c29faba7c243d5969e09b5d213c8434", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662689552, "uuid": "a850f03e-7294-4696-b787-75ab6023baf2", "value": "T16724C011B9D0C472C5E24D308870DAA5297BBC22AA78984F7B547B6F5E303F13676367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662689552, "uuid": "27fd26ce-af8c-41c1-a105-664905e66acd", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662689552, "uuid": "706405b9-efca-406e-b6d4-e79afa8ed9ec", "value": "3072:7ftAdJ8HVrAeluS4w9JcTPlKHJYo2FKj1cbZLab7+Ja09n1kp:ZueU0uS4wsKm9FK2c30m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662689552, "uuid": "2aecef13-e4fd-4d17-ba48-223ed154adb2", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662689552, "uuid": "64613656-d8e9-41bf-b5bf-d74e94618ed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662689552, "uuid": "4d18790b-907b-4746-9e9c-d3e9ccf44509", "value": "99cc678edebe5f5a8201167ee9d46e64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3972a7df-300e-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1662707316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707316, "uuid": "07c41690-e4e2-46e7-915c-d3b782e46975", "comment": "Malware payload (Loki)", "value": "9eea0656cc2a067da12400bb4be9d869", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707316, "uuid": "64e20c71-0b62-4b13-b171-53e4ae37c122", "comment": "Malware payload (Loki)", "value": "6272b5da75ff99847d5858e5422e3f4fd5196ab99aa32a5dace725c28e451c74", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707316, "uuid": "504f2287-3112-4a22-b614-83b3ab55113f", "comment": "Malware payload (Loki)", "value": "952ff9fe72670632e84fca2df1061643ad9082ad", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707316, "uuid": "5cba4a19-e10b-4df6-b2a9-c3b4b944110d", "comment": "Malware payload (Loki)", "value": "5721b12be373a4c8d2989293cb3c7c6f98a2c242a8b5f3f9d27d34e2cadc60655b24736f317d3dcbd72280b374135719", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707316, "uuid": "e6ef052c-eb65-43b5-a20f-9f2b65da3f4e", "value": "T16CD42363F7CD3ACFB565F8B706822D05A4258981EBD8F0945E655C7CB520AEDC0CE82B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707316, "uuid": "d282aa16-d05a-458e-9a68-865cd3e9b9fa", "value": "12288:/FaUu6niTtJOk4m370StjN6fVttS3tCyQseZOmu0:NaUXiTtJJ4A5U/6t3eOp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662707316, "uuid": "0402ea04-d23c-473d-b299-d6a18877d535", "value": 625486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662707316, "uuid": "7bd9a85c-f670-4048-b375-b77930c3fbc1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707316, "uuid": "8637bbf4-5f70-4b37-b8fa-5bf008523d5c", "value": "AWB DHL SHIPPING DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875057e1-3076-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1662752115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662752115, "uuid": "97921fe1-bdbb-45c0-91db-34a88bc8fc23", "comment": "Malware payload (RecordBreaker)", "value": "2826734525eb63e0edb0603149296dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662752115, "uuid": "27711998-f756-4477-9ed8-fee8c84c7b9d", "comment": "Malware payload (RecordBreaker)", "value": "643a6e47685ed1554850aa273d8c0858ab3b8a833b30bcc05b2a85254865c1c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662752115, "uuid": "6bcfe4ef-d0ba-4d2b-b469-1ce56edc7f9b", "comment": "Malware payload (RecordBreaker)", "value": "0185ee04a332620fd47b2e059e970acb9c2450d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662752115, "uuid": "207d7b6d-249e-42d8-8260-130116b0870b", "comment": "Malware payload (RecordBreaker)", "value": "baf96a57abd1a3f17f2847e8ab03950f969089e2ca920d05ed8b793a58e74c13319a28d008bc76e9c7c83fc1a9e2424d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662752115, "uuid": "e53fdbf9-a39c-4698-888a-9c1306352976", "value": "T1A924CF11B5F0C531E4F209309434D7E82E7AB8661A38D54B7794FB6F6E703E066BA31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662752115, "uuid": "a5f28c0f-7115-4968-8b5e-3f2094b77ad2", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662752115, "uuid": "257ce95c-9d46-4963-ae72-49676d652ff9", "value": "3072:zQ9rLRX0VojC565jrzyezSdTpcLqZ4NlbO/UKMkEXcZ:uKVIxrz4cxl+QkCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662752115, "uuid": "933ab50a-5ddc-4ffd-8935-26554a92efd6", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662752115, "uuid": "237b4409-5fa8-4865-a6d4-a8aba0614394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662752115, "uuid": "9252abf7-db61-4ebd-8f91-4c03c3c5a5ce", "value": "2826734525eb63e0edb0603149296dbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b5f6cd-308a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662760650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760650, "uuid": "4e176c9e-9ed5-4981-97d6-a01ca96b12bc", "comment": "Malware payload", "value": "da26b471e4cd4faf9938ded3fdd0002d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760650, "uuid": "5a0fa196-3863-4b12-a4bf-99b01d9736cb", "comment": "Malware payload", "value": "6656cc498b5f74cad4fe53a3201daea7908c2b73d4be270931f22a0d8253ec34", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760650, "uuid": "7a6979e3-4ce5-4546-bcb6-167ca8308085", "comment": "Malware payload", "value": "72143b67b7dc0ba1869a736c528de2b044b0bee9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760650, "uuid": "f33068e3-2d1d-45b5-9744-4f79abe14efb", "comment": "Malware payload", "value": "fb24e18783914a72ed01e9b6b5ec100c5c922965ba85fa3ad8bf76e0cffc1a1ed50ae2b0ad3e49ca04609e1f4013901f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760650, "uuid": "cd6f17ed-e61f-46a4-89f6-fa1f0f4e2ab7", "value": "T195B2E168D1EF1516CC64C6BABBEB12C183605AB2F24DCBBE64EC64A73EF05312605190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760650, "uuid": "6ef676f3-1745-4e33-8fb0-6da95e2f05a2", "value": "384:Mvj2kVmgu4H6a6cVtT8X9dFV/q4X/hZwDmP6+/+V5m6j1JXlRi8dPqkdQjYKxk:jZguSn6cVt8tdFV7p6Q67+8dPd3Kxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662760650, "uuid": "83076d97-900e-4d55-b9ad-79d3a45840d7", "value": 24788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662760650, "uuid": "3852a4a2-d9eb-44e0-b467-8f2f5fc6dad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760650, "uuid": "229510ac-a02a-45a9-95a2-f976ce43b653", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a075cbb3-3092-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662764183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662764183, "uuid": "8e41bcdf-cb3f-4693-93fa-526f475a0b36", "comment": "Malware payload (Mirai)", "value": "9fae79ca9410b582152d1f99af564c2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662764183, "uuid": "1ede1033-591b-4843-809e-320ef1a29409", "comment": "Malware payload (Mirai)", "value": "66f5c47f3281a1b0f5d0fe2d14e840901269fb4e7e6b0f36c26ba61a769efb99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662764183, "uuid": "0283de6a-a60e-47ef-b671-16211e8b669e", "comment": "Malware payload (Mirai)", "value": "1bcc009fe481128a2e98aa79a378e6677b61d81a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662764183, "uuid": "c1d63011-57f7-4e1a-b32c-4ced0390e268", "comment": "Malware payload (Mirai)", "value": "10446f05075232b71d75130a0fc5e1b422409481ca7916d0ce73f5ac063e2617bc8574843704d3c1e68710293d77cef8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662764183, "uuid": "8c46427f-87a4-4be8-9a1b-bede2f8f02aa", "value": "T1F5439D76CC7A9E54C4198638B0605B301723F518B6933FF61E8B86626853EBCF2693F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662764183, "uuid": "d4f84ca0-a7da-46fd-aaf9-f9c53c687131", "value": "768:Eac3CREzieIqreLeQeAe/NYsgnutYlSvdOzMfrRholzT0pdlCamwv81B:Eac3CRcixq+JBSgikz6clkpvCa/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662764183, "uuid": "8bc44c31-3878-407a-aefb-6e936aeb4bef", "value": 56104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662764183, "uuid": "fff18c70-8b2a-4a1a-9ea9-fd953a7ab139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662764183, "uuid": "56c02239-20dc-440a-b3af-98e14761cbb1", "value": "9fae79ca9410b582152d1f99af564c2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22294d9c-307b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662754093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754093, "uuid": "412db825-f1f1-41ab-a864-866bc4d0f543", "comment": "Malware payload", "value": "3f3e0b69ffb974fc9007a1a1ef1e514a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754093, "uuid": "321797b4-571c-47d2-948b-6ebc8440b5cd", "comment": "Malware payload", "value": "678a7c1e3cf357f5202ac12b6b3e41b16af78fa8e15f119804e27d6e7ffc19a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754093, "uuid": "ade8f99f-3824-498e-94ec-3e920458bbf7", "comment": "Malware payload", "value": "29c0636bfcb22d0954c45f2338840b39954342f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754093, "uuid": "797bcb41-38ac-4064-89f2-721b65f1ca27", "comment": "Malware payload", "value": "7019b05fc7d26733f221fa25d5314d7ca75fcd039aaa1c3bbf306b93644afd6330724952e6a699136122b9d1e7668a34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754093, "uuid": "99cf5353-90bf-49c8-ab3d-03edf5ec9041", "value": "T196B4CF05B9A3C0B3C5635A72946DC71E24367A241F2249EBAFC469B86FB03C12971F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754093, "uuid": "162b3426-47ce-4810-ba72-88633d0a1da2", "value": "49080033381428e3a131ff5659276d1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754093, "uuid": "b546c9de-7a45-4516-b57d-e66bc972efb5", "value": "12288:4Qa6g2K0Gds+ALpMAm/tSeG5+ry4WBGhKs/:4Qa6g2K0GKpc/45+rgGB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662754093, "uuid": "cb882ba6-3fd8-42af-be54-79a16b93455d", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662754093, "uuid": "8ef5f696-ac93-473d-9aa9-84dbfdf7b80f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754093, "uuid": "8b92a067-4f4f-4a3e-9129-8821c79e6537", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548490b0-301e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662714234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714234, "uuid": "27e2ad05-9b6f-4c23-8e97-f49383c60dea", "comment": "Malware payload (Mirai)", "value": "122792146847b9c55e0739f3671f8e10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714234, "uuid": "94366ca0-d5e3-420c-aba7-b7be070601e9", "comment": "Malware payload (Mirai)", "value": "6845a2dcbd235cf1a6f11a98c1a9d07b6babd653c5a13ab4898567c123225d64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714234, "uuid": "18aa020b-becb-4b73-bf7a-2505c1ed9d31", "comment": "Malware payload (Mirai)", "value": "0ae610f83c624fe0d6ace6758f83f9ca81912c61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714234, "uuid": "82b54b42-a82e-48d5-a466-a8ac9825b6ca", "comment": "Malware payload (Mirai)", "value": "d61b28baed14a88c94020399ce4908e4f143f96c31469ca86352c5ac228b46ac6cecd97b9cb9676b6676a65a47964880", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714234, "uuid": "c5f99a48-e8d9-4bc0-830c-ba62d682ec3b", "value": "T11C835C45BD808A13DAD0127BFB2E619D371613ECE2EB7207AD25AB2037DB52B0D77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714234, "uuid": "9bba5726-9ee3-47f8-8e7a-841b545076aa", "value": "1536:thFG3zgZfdZWbPjrVbVDDI9WX+BQdxEipJvKJA9v5jrXns6RvS/b:thrM3xqN2vEgJvKJA913vI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662714234, "uuid": "96c6322d-54ee-4188-a4c9-c9cc4e2d301b", "value": 87396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662714234, "uuid": "93cc7f8e-d2ef-40e3-ab5e-b51ae1033d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714234, "uuid": "3fd5f313-d506-42b3-9380-a8456d6341fb", "value": "122792146847b9c55e0739f3671f8e10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76af026c-3017-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662711285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711285, "uuid": "38e56647-904f-45e9-a766-8f2e1822e051", "comment": "Malware payload", "value": "daeb989b2236bcdd86350dac12b19a43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711285, "uuid": "ad3c2cf6-988f-41ae-bb9c-5fedd40c8372", "comment": "Malware payload", "value": "68bec85408b29c0919797fdde2b9a5bb2a2e45d8fe13ff3e80a67dc6cb86dca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711285, "uuid": "25f54ec2-e3fa-41d6-9966-d59c3a81c8f8", "comment": "Malware payload", "value": "8c09d377e5bab671f2ce1794bc535abdf44c48e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711285, "uuid": "d9270cb8-5f4d-4dad-b3b5-a9e83bc09a17", "comment": "Malware payload", "value": "bc44101d34dbd010aa80180f3658e1305ea67ffee539ad05f5f9bc52bdf287ebad4829ee7c86bb79894c56220b42d12f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711285, "uuid": "b8ef91ef-d626-4fda-a00d-f62f89dc924d", "value": "T1945439E64E201103E16D247BCEA28C0CC4FD873A69958E9B95084FFE5142D1E77EFAD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711285, "uuid": "9dcdb016-eb0a-46ac-8c1c-24f9eff8090b", "value": "b801ab19b808fcd2ae067ca523ed9615", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711285, "uuid": "b2cf3d4e-0e9c-4b30-8080-f6bfa887339d", "value": "6144:AeHBjz7Gpk47fnNXqQ5hAolPzPPbejh9foz2GDWcmf8iuCpTWceB4NoIQhFASepZ:nSpk47PNXjgolPzPPbejh9foz2GDWcmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662711285, "uuid": "e6162395-bced-4b39-9dc5-5b24d98b519c", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662711285, "uuid": "6cc05f54-4449-4b6f-b208-667213e94e29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711285, "uuid": "afa249e7-0822-4409-8a6b-4e802881b151", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28107bd2-3002-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662702133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702133, "uuid": "36b154ac-a20c-4004-afff-ebc0ae803172", "comment": "Malware payload (Smoke Loader)", "value": "0c021e9e2d8dd2dea37791ab65e32f40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702133, "uuid": "b0717067-0ecb-41b9-998f-21ff055c73e0", "comment": "Malware payload (Smoke Loader)", "value": "68dfb100e2cf8180b0e32c5c8ede4667ddd82e42d895930b1ff502c9931d90ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702133, "uuid": "53b06d2e-fee3-408d-b879-baf476e3323b", "comment": "Malware payload (Smoke Loader)", "value": "5157ae0f6d3d9ef18653166c79d2d7003f11c732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702133, "uuid": "0a91a63e-5122-413c-974e-be6bb3029851", "comment": "Malware payload (Smoke Loader)", "value": "22568bdf11ae322828493820307510add179aeb15118d1fafd04fe1b64eff3e9c84e69b13c713d57718ee95ffaadc02c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702133, "uuid": "cf95feb3-3117-4a6c-b993-319b4ac19c8a", "value": "T13124DF9279D0D571D0F644306431EAA42AFBB861EB34984F7BD03B6F6E703D22A75326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702133, "uuid": "6ba0989f-cba8-45b2-bc58-8d95e65ed09e", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702133, "uuid": "37c8f9e9-ab40-431e-a8a3-0f5947bad446", "value": "3072:FPot+XCcl3lTKgwJcKaSsOVkknATdW8my3qw32r3Rg0TRp:2OD3xJ45sOCTdWM3+LO0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662702133, "uuid": "ffad28df-47c9-4b1d-83c9-e46943095a6d", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662702133, "uuid": "aa1e0f9c-f94e-4f0b-b1ae-622c60cd9d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702133, "uuid": "b5a3c1a5-c8b1-446e-bffb-82550796fcb4", "value": "SecuriteInfo.com.Win32.RansomX-gen.15414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a7eaa2-3033-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1662723285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723285, "uuid": "822907c3-4e25-4579-bfd3-9c0283461434", "comment": "Malware payload (NetSupport)", "value": "615565761d99b28eeefa2d631a9096ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723285, "uuid": "e4f8c7ff-050a-442d-8a68-1a507d424db9", "comment": "Malware payload (NetSupport)", "value": "6967ae85bfa1e72317ffed9593170e3b48e7644b79b3b4aae49d1bccb8284835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723285, "uuid": "63745480-06ce-4d4f-ad58-7df75c55b0b8", "comment": "Malware payload (NetSupport)", "value": "6373733534b4d76807f2d41f5d6820374707ab9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723285, "uuid": "fd6b4d0f-0827-47ee-97cb-2966ecdd4a42", "comment": "Malware payload (NetSupport)", "value": "f4272306e4b17fc9b04b3c13ba0233bdf307a1a62bb0828237904f03c7fdf8706a1d7194e9b0f8dadbc009022178a936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723285, "uuid": "2c73057a-42db-4200-834c-8e53c8446f02", "value": "T19624CF22B9E0F871C4E246344035E7E42E7AFC326A69D94B73A03B6F2E702D16675357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723285, "uuid": "a5963d37-1a7c-46f2-8801-781ba0a16fee", "value": "9ec19ad11da368328b1ef380c14dc8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723285, "uuid": "f88fe356-8fc1-4142-8ae1-3c6a3ba7a742", "value": "3072:ZBcRqAoChhLtLnL5q01N06/Z/h04UL2/W+GtNJqEz1Urp4pwW:YR3LZEE0UZ/hpY/tNJ3RWipw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662723285, "uuid": "9687691b-4cc0-45c6-93d7-a0b26b79b0c6", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662723285, "uuid": "12dd0e1c-f881-404d-b873-eeccafd6342f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723285, "uuid": "1f6921e9-3b9f-4b78-be43-4c98beefac14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8710fb-2ff3-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662695938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662695938, "uuid": "a7d16306-14bd-45a4-a63d-e3c86235f74e", "comment": "Malware payload", "value": "8f3a289c80ce6297941c8b2cd1c69953", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662695938, "uuid": "d738f1ea-de74-48fb-8ba0-aa9bb60d28ad", "comment": "Malware payload", "value": "6a13f2f0022f6e9e0b1c04dda1ff5e4557bf933a5197a96558624ddc8d172272", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662695938, "uuid": "c82a1fec-8b0f-4ece-925f-e0681953b231", "comment": "Malware payload", "value": "13d26cb19297c1a7e98d6c0d01c207ad9da50285", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662695938, "uuid": "ead81124-27d0-412b-9cd7-9d40b2e651c8", "comment": "Malware payload", "value": "3c29464b384918fa843dcc6971ddfebbc27662d3ddd08bbac272c2af31f4bd93c4c18c33be87acc9a68c7b770e1b8b1c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662695938, "uuid": "86831061-3555-48b6-b050-14a44f81d20c", "value": "T18A2733635C0AEDEAC4317439597E2345A874CA6E3DE33A220004EA77C5F29698DD9FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662695938, "uuid": "5dadf9a0-8be8-48cf-8176-a07b66af6d53", "value": "393216:KUn+u23SJsJA35z7A79L+DmV1mbgafiubchZnbVT9i/zVN2I+TXHNUKpPbNiRSKv:9+ZiCJA35z7c53TmbBffc3nHi/zVN2IP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662695938, "uuid": "31ba85a1-0d2d-474f-a215-161590bdaee1", "value": 21620082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662695938, "uuid": "1fd2d967-3d0d-404a-9017-161e3b2b7ba1", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662695938, "uuid": "fd7b7559-ecdf-4e32-b0fa-bf883be800b9", "value": "6a13f2f0022f6e9e0b1c04dda1ff5e4557bf933a5197a96558624ddc8d172272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8a300b-3043-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1662730219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730219, "uuid": "06d0c628-edc1-4f37-be23-489d47eefad5", "comment": "Malware payload (NetSupport)", "value": "789598a08bc57fea514d9ffd8f072b71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730219, "uuid": "c5c36d6f-f745-41d4-b85e-63d6b058b90f", "comment": "Malware payload (NetSupport)", "value": "6a9677534228b1e25cb6b978f465b98c19b08844ea9b559e7538f7ff45bb04c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730219, "uuid": "8b2f23ee-3ccb-4abf-ae71-5747b3eb6288", "comment": "Malware payload (NetSupport)", "value": "7fc3b548b599eca588b54a5d78378be24ba4fc91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730219, "uuid": "0cde31a7-0354-4b72-acd2-36a097aba82a", "comment": "Malware payload (NetSupport)", "value": "b07b6d742db60e2b41b667cfd7aeacbd5606667cea972465169936d59a114f02cccd386ddd9b28cb02f04aa7fab42eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730219, "uuid": "320d7292-00af-4e37-a44a-23dfe9142bad", "value": "T11BC5E08ABC53DAF7CA9D9132346B08784C255C2A25A469705560FDC8FA3376CA3193FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730219, "uuid": "45b1ca57-6156-4b45-b8d8-0eccfedbf101", "value": "dbb1eb5c3476069287a73206929932fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730219, "uuid": "c459482b-effa-44da-bdd9-5e5cca478dc2", "value": "49152:ULoNjcFNMcbm0dwovfFYvx7WA+0b7Gsr04TSfZeU69PX8hm50gqdnLospa:ULiSyswWFmLGR9fAUo0gqdnLospa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662730219, "uuid": "b799579f-2e14-4a7a-8762-fccebae9d108", "value": 2620471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662730219, "uuid": "deae61bc-5d9e-4c0e-9226-46d80b322d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730219, "uuid": "772b07db-45ea-4a1c-94fc-8c59169ebbef", "value": "6a9677534228b1e25cb6b978f465b98c19b08844ea9b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9805e92a-2ffe-11ed-9266-42010a9c0072", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1662700603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700603, "uuid": "c3bf4930-e53a-4a9d-93b9-b6392737e069", "comment": "Malware payload (ErbiumStealer)", "value": "00783ba41fee1ba7261b676b7600764a", "object_relation": "md5", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700603, "uuid": "0c2b0b51-2b64-4a0c-b191-fa79ea98bf61", "comment": "Malware payload (ErbiumStealer)", "value": "6af3bebd14348801e1bde3b0cf9e0155ae953503c27a3aa8670d742d4f7f2487", "object_relation": "sha256", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700603, "uuid": "5cc50028-bfbb-4506-9cb9-4d92de15beeb", "comment": "Malware payload (ErbiumStealer)", "value": "fe79e530264c48eb1b26e2c2b6eea53a48b46008", "object_relation": "sha1", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662700603, "uuid": "866845af-0a0b-4de8-aff1-fa36f7039634", "comment": "Malware payload (ErbiumStealer)", "value": "c98dde94cb284ad47395966b4d106362b7e17d53b308f4fe368a1f6a2c22fd0797a8c31af56e5bcd1d05b882c861c6ed", "object_relation": "sha3-384", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700603, "uuid": "45828401-8b2a-4ef2-8831-4247ea7484ef", "value": "T148253B29EB0729F0DA275772855EDB779B18BA158032AF7FFF4FDA18A4330123845162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700603, "uuid": "b7fba6a2-8dcc-4d88-a335-25d0605db2cd", "value": "1797ab721d550312b93ab992a1e04176", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700603, "uuid": "f3ed9a1b-cab9-4f45-a039-6c2f7786f374", "value": "12288:1eAq2tPYHYHn/772LSzQ6M0guMWYH/H3qPBDpRkZJ6ZDZkZPAzGm78S/In:EstPYHYH/772LGM9utYv3qPB1EZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662700603, "uuid": "82f91a30-b782-4cc4-9766-8733278afe00", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662700603, "uuid": "76833d00-60de-4542-9e81-aaee7ce87bd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662700603, "uuid": "0d0b8fcd-f958-49cf-b5e6-47fe92c4696e", "value": "00783ba41fee1ba7261b676b7600764a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf1568e-2fd9-11ed-9266-42010a9c0072", "comment": "Malware payload (BluStealer)", "timestamp": 1662684718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684718, "uuid": "2c213928-0417-43bf-a8e4-5e1099552170", "comment": "Malware payload (BluStealer)", "value": "b8725d3210880f518a7c9d32c7776205", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684718, "uuid": "dafe64f7-9a0d-4647-bf6e-2729d4da9bb4", "comment": "Malware payload (BluStealer)", "value": "6bd709d1e9fa41f6d670e1fb39f98632fc6425c80e7c5cfcc038303e7dcd5794", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684718, "uuid": "d6c0b521-48d2-4cec-a5c6-e4845ac96c0f", "comment": "Malware payload (BluStealer)", "value": "40ae36f2bdd77471b2b7f0dc28cfba90da2cc673", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684718, "uuid": "1e9c749b-15d6-45f2-a88f-133f660fe9a6", "comment": "Malware payload (BluStealer)", "value": "66f8242ccff4314c579b201da18567bc39edc2f50c686b929e00550fdf94a444a23f20c83ebc29fa8495d441f11b5d05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684718, "uuid": "efcb86bb-0dea-4ac9-bb96-784f8e3c3500", "value": "T18BA4011127B6F319E2148BB513FB935400A0FB315EA34D0FBB0C6B5AA636D96D2B9317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684718, "uuid": "8f47013c-0cb1-4b08-9af6-57eebf3adf46", "value": "df8fbcbe90e1e305a660f0ac2aa4fae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684718, "uuid": "71ff836d-f131-41a3-9dc3-8fa484a82c47", "value": "12288:ZBWnxfgsRL4u/1AlLK6FRY2n8OPKxGvYmB:ZexgsRftD0C2nKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662684718, "uuid": "c536cc45-e2c1-4ecf-81b8-e12185d8c88d", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662684718, "uuid": "84072618-d7d0-4b62-acc5-f70d7828c7ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684718, "uuid": "2e9d9240-18d7-4097-8829-07085714366f", "value": "b8725d3210880f518a7c9d32c7776205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac91f1e-3002-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662702138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702138, "uuid": "1badef7e-db3a-4dd9-8b72-5f57fa020f77", "comment": "Malware payload (Smoke Loader)", "value": "089956f6834378c269a770718624f12d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702138, "uuid": "0685aca3-aea1-4b5d-a3c6-4dd23ebbd0a5", "comment": "Malware payload (Smoke Loader)", "value": "6d16759dc2ae1b3e437a4a74e8423b3ceae3c86e53cd7fef8b46a34fa9301d96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702138, "uuid": "fde7780b-9fae-4ed9-84f3-5fa4d511759a", "comment": "Malware payload (Smoke Loader)", "value": "2bfe45b7af838a4a44d17a63c43d2a2ae08f02d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702138, "uuid": "68874905-d06a-4776-ab00-999a083acf2b", "comment": "Malware payload (Smoke Loader)", "value": "8dccc8036acb71246341b212c8809f94b9ece460f802aaacdaa14e37c8f4ae9e76af4167cedad2fe9516733fc6867512", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702138, "uuid": "51d1c290-239e-41aa-a9ca-4e1bf05532b3", "value": "T12224CF25B6D0C472C4F256308735E7A42EBAB8629674888F7B643B7F5E303C12E76356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702138, "uuid": "fe56ee05-a115-41bf-9985-c254565ad07a", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702138, "uuid": "62cef90a-8822-4e04-b072-a7fe438ea8c4", "value": "3072:OmPt5lY3ZlA4hjcmVJc/vYMUuo1NbiuJe+5iyrO0QRdZC2lp:nhY1fgYMUuo1NbQ+5Y0QXZCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662702138, "uuid": "80e23de3-6ed2-424e-8fd2-51a759d07730", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662702138, "uuid": "83c2f05e-4692-4a7d-b11f-cc08e7342f49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702138, "uuid": "f7c1612d-722d-49d5-a867-d1f93c8093d5", "value": "SecuriteInfo.com.Win32.RansomX-gen.32708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839ebb8b-2ff9-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662698421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662698421, "uuid": "f10a3414-8a4e-4c03-a7a0-daf7b6648ec0", "comment": "Malware payload (SnakeKeylogger)", "value": "908cf5dbcca6a9f106085045ed6d8609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662698421, "uuid": "aa008713-2282-409e-92d5-61739ec86912", "comment": "Malware payload (SnakeKeylogger)", "value": "6e3068d40a7f9cf1c1b32ce4c58931efe7363b9f2d9c96117c72e8c5fa90c723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662698421, "uuid": "a5dcca99-9405-4955-baaf-b86d06af70f4", "comment": "Malware payload (SnakeKeylogger)", "value": "84b6bdcdfefb261cbe594a58166669127b0ff1ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662698421, "uuid": "db16e8b9-7249-4a72-9376-b0d84edc237e", "comment": "Malware payload (SnakeKeylogger)", "value": "47f9e8e586d92525175eb13a19038a8e96802a948f4721439401e7058389d2c18a23a8dde79f2606789003e2c166bb02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662698421, "uuid": "43c3d715-6b9d-4129-b4aa-9f8e2db236c7", "value": "T13245084361804CA9D47740F868DDD53216A7AE88E57AC0087FCDBE6BF6F3B1110DBA69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662698421, "uuid": "338edc41-9279-4744-aa16-8d3b559a40d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662698421, "uuid": "03bdb71b-3799-4a55-bd52-1563e270f9a2", "value": "12288:Bfdlx1GxL8zV1IJgM6VkML3e7GcBwdETC2jRgnNzgl:HlQuIJgM6+Wi1qdETCYRgnxgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662698421, "uuid": "2c53544a-94b4-4038-a959-1c5d48dbf484", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662698421, "uuid": "9485b1c9-3395-450f-a693-121a42a9af1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662698421, "uuid": "84bab959-e51a-4811-ad54-b79e12cb560a", "value": "SecuriteInfo.com.Win32.CrypterX-gen.32158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ea4185-3091-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662763581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662763581, "uuid": "3c116ffd-d29a-4211-b6c3-5bab37cb77e4", "comment": "Malware payload", "value": "7acac50d5338da9a75c5d9408e3744e4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662763581, "uuid": "e82abdc3-dffa-4788-b9ea-244a2fde9f29", "comment": "Malware payload", "value": "71d4d2abee3e83ae65dd93e4a6edddf097d638deef3b1b8b54322640d106a729", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662763581, "uuid": "273c2242-2cb4-4622-b033-6b5dbe43cd94", "comment": "Malware payload", "value": "283fc1098279fb2ccc8b08c84ffdc4163b64e700", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662763581, "uuid": "6c53e3ab-a4a0-4991-9d31-17c146fc64a1", "comment": "Malware payload", "value": "326421192fa81fb847747c94ddcd7edf4bf3d4019ee03d755ff42d910e3246a3e8427502ec9449ef052ff4de4411b133", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662763581, "uuid": "4d080dac-40b2-4649-9cfc-3a8fede7b715", "value": "T1CF252310AE682F4FC3197279D8676D4F168E3E6CA316E0B7D355329B21FDB39024784A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662763581, "uuid": "d87254a1-e35f-461a-b97b-e15a34053d15", "value": "24576://fsw7v5436k/NZwVN/o9fbsyZHYWA1dn42KeI929OyxVT:XkFVoCod4DZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662763581, "uuid": "aa8dd045-f1d9-4837-b8f9-7969ad3d4ebb", "value": 1047552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662763581, "uuid": "2cfb6c9a-4e0c-4879-89d4-fa7e193d6f28", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662763581, "uuid": "f539c0d1-e5a1-4d16-a55a-3473fdc7ed46", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.4597.28262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d2c402-3053-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662737206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662737206, "uuid": "8527fb06-bb07-4241-86be-e9656dfb2e36", "comment": "Malware payload (Mirai)", "value": "9e741df1d6771fb346600320d7adb458", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662737206, "uuid": "86890b58-5b94-4903-ab02-a596303f4c1e", "comment": "Malware payload (Mirai)", "value": "71e92908d34bd05c3f0fdaf15bc18abb947d7836c571800665dcbd28364b3aec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662737206, "uuid": "8b199130-df10-4d3a-abae-0838fb34456d", "comment": "Malware payload (Mirai)", "value": "d982e22d8f20b0211c75c515c46d70729776d8b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662737206, "uuid": "1bbcf83b-e24a-46d8-a65f-48be2483a78d", "comment": "Malware payload (Mirai)", "value": "1576534c09ee74693be22668d9b49a834e286f70cd2c5c1b83cc7f8c60f7fb612ba01e1b9680839d9639ade0215d4052", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662737206, "uuid": "13b6bebd-928d-49e1-bed1-33aa3b947307", "value": "T199E2D09221AEABEDC79651F00CAB2F45086053FDC16447D237EC610ACE29B517F6E3A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662737206, "uuid": "49bf4d35-4cd9-4d94-baa6-f076029392f6", "value": "768:bhuRGSh9vAWf5YQO60SoVAdjvjT2oqEwSv8WMgVjP3rQW76SeHnbcuyD7Uiyq2:luFh+WftC8HLVv8WMC8Ssnouy8Zq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662737206, "uuid": "f0725d77-3dc7-4631-a061-ca88a759ba2b", "value": 32992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662737206, "uuid": "d9a61b13-b9b1-4998-a564-b4e822a021da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662737206, "uuid": "c697f483-bdd0-49f4-96aa-d0da03f1d829", "value": "9e741df1d6771fb346600320d7adb458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19028fb-3055-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662738093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738093, "uuid": "cccd4e17-7095-4ff6-8036-0f985ce13951", "comment": "Malware payload", "value": "8d9c396e32632cfd8a54502b8641e4c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738093, "uuid": "21e109a9-e6b9-44cb-85d3-e72d9d478bb6", "comment": "Malware payload", "value": "720fe1ea0ca41002b6fddc3d114e4a49f2107cd98c2de780fdf02d548c043f7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738093, "uuid": "b7d3424c-3cab-4b42-abb1-29aa9b542647", "comment": "Malware payload", "value": "d19dbb8f0daaae9d817db34d37a692599d413e0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738093, "uuid": "a831be03-2d05-4533-9512-5d6c50da7b7c", "comment": "Malware payload", "value": "d504d901e874ec5ee4a8efd84b8ed8a1cded37419183714b0eb33194a7aa65e5097eb7e712acc0a14be3d1c3b3e07cd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738093, "uuid": "eb6b4dca-df75-44f9-a899-1311541526e7", "value": "T18173AF51E7956CE5E807067E99BFF8152027BE9A84664C0E316F322DDB7334290F6E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738093, "uuid": "ffc4745d-88c7-4341-9fc8-a84b82b9d772", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738093, "uuid": "f37f6cde-3e00-4fd2-b0a7-bb27abb974eb", "value": "1536:u1EswBBTZspN9/ERy9ynPgiaDx8FOqu+ZIJNa5dGKU9K90oajG2WbT37qWBzUI:Cehd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662738093, "uuid": "eaff1d7c-02a3-4fd3-ab5f-86c032c260b6", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662738093, "uuid": "263a0edf-c7da-4d49-9bb5-b51672488cef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738093, "uuid": "8205292d-c5f9-471b-acab-1cc3be0d4bc9", "value": "PAYMENT_COPY_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca87c3c-3033-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1662723294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723294, "uuid": "615cd322-60c9-4516-bf3a-3c5cec7b201c", "comment": "Malware payload (Stop)", "value": "63ce99d398474a0540d215c6b90fe97d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723294, "uuid": "760910f3-876c-4aae-ab72-9b4e620bff57", "comment": "Malware payload (Stop)", "value": "757f224af2011afcf0cf966da9a88fa0c6c465a581832e82c15a96f8c7e06bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723294, "uuid": "98470883-dea6-400f-ab5c-13f820756fa3", "comment": "Malware payload (Stop)", "value": "420986942374748883b2d947bf0cd3c7977dca74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723294, "uuid": "77bb56e6-57d3-42b7-931e-d9f45ab1fdb8", "comment": "Malware payload (Stop)", "value": "cd691ddb208d5d83d89305765a69e324bbaf7e13be8420de5f5ec089d891d6940d679c3c0b78c504623df692c838298d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723294, "uuid": "07086d21-8540-4df2-89e9-dab1104c6d05", "value": "T1BFF42243B1D0C676D0D25A741078C7E16E33B8212224561BB392FBDE6FB13C2EA7532A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723294, "uuid": "c8e29e0a-75a1-46be-8583-2802b58ae62f", "value": "f2fff7b5726c9a0e6527dfcd912d5711", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723294, "uuid": "341077e3-767c-4b86-bc2c-ae8be9f008cf", "value": "12288:yOO1/gpyTon4FW8bvzZJG1974gYLSHAM6G+qVRcMy87mGdV+gXnsoJBQx+zoa:yL1MyTe4/5JG19ErwAM6G+8WMy87mOD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662723294, "uuid": "0b3915a6-1bbf-44dd-af37-f7faded8ea1b", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662723294, "uuid": "deae7474-0748-49c0-b926-e6b0112e260d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723294, "uuid": "5bedb55b-3d26-4d72-934a-536bd6f3d54f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de019b76-304c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662734221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662734221, "uuid": "2ab36a56-952b-4b22-8098-e1282ac9ca20", "comment": "Malware payload", "value": "587c740f415b1e6c1692fc0aa3af837d", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662734221, "uuid": "7216acbf-5cd0-4c9d-87e5-57f4d140bebd", "comment": "Malware payload", "value": "779832564a738687454dc2b4a98f8c94e5abf3c9b31e7719fc83908e00452544", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662734221, "uuid": "bcbe48a5-ff28-495d-926a-140c27decf8b", "comment": "Malware payload", "value": "4efeec443dc97dd3e2edc9f89bccbbb6c2ac197e", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662734221, "uuid": "2e449b0b-e077-4eed-bc47-c77a3e8f16a2", "comment": "Malware payload", "value": "b60d008de546ed6361591df7de476d16c10d2130a102ffc713d34f920d8d3e1a4c779a95845f8bb8a668caca25284347", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662734221, "uuid": "4c396b96-866a-4762-9874-f18a4fa63f62", "value": "T1227298329C4258211137946D6CA7F80AFF6103679B2922433EBD52D83FF505672BAEED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662734221, "uuid": "15e879a2-9f63-42e5-8786-5d917fb01fbb", "value": "384:kp6v1a+NNn6YSICq7rqLJBIRg9WPIDNhMUNGJ4H4h:Y6ta+NNn6YAcr8zSI9GJ4H4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662734221, "uuid": "6b8cba85-9157-4274-b173-4a5291d54eb1", "value": 16914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662734221, "uuid": "d1b08c8f-f03c-4f8b-87fd-04a3435d0b05", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662734221, "uuid": "24bf63e4-0ca6-411b-8dd6-a2faf7282a3e", "value": "discord.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6ee2c5-2ff8-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662697816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662697816, "uuid": "f5369645-1285-4628-8f7b-9db5c26f2c46", "comment": "Malware payload (RedLineStealer)", "value": "d5bacf9d0074ccdceeb0260a0e387936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662697816, "uuid": "b7cb542e-3098-4ca2-a856-192c527dd4df", "comment": "Malware payload (RedLineStealer)", "value": "78757636e15f29e5ac4c28750c426e601aeb8502e026d499dcd3874e56638bbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662697816, "uuid": "9da3d297-cbeb-445f-997b-64c8b3e755aa", "comment": "Malware payload (RedLineStealer)", "value": "33761fba602fbefa0101b16c77d8d6d41448fda6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662697816, "uuid": "dd20795f-d750-4c16-83fd-ab03b0dc86d0", "comment": "Malware payload (RedLineStealer)", "value": "6268a6147d9f077dd3d73a3f7dd8b0d21f07a73c29bb02826dec51c39944d008656d3df77d79491207f5f23c620a8e8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662697816, "uuid": "4b8896e9-2e37-4d62-bddb-29c06c870452", "value": "T15324D01279E0C43DD1E785308470E6A52A7ABC629E24898B7B643B7E1F703D07A7635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662697816, "uuid": "f5626af7-066b-48eb-9098-053e9ebb151b", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662697816, "uuid": "aaca37ca-9ad9-4563-8539-50b4bbe0f9c0", "value": "3072:o0ak2lBzh5rzkzJcoZWQXN1p27SpWIKjqSoOoVEchfP0p:O3D5Hk/M+uI0zoOoJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662697816, "uuid": "6b588061-f8d4-4c82-9f32-e2df9cee33cf", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662697816, "uuid": "0316cf39-cb0c-421c-b731-fc8717843234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662697816, "uuid": "e2c88944-6775-48af-966a-5d234be5aec9", "value": "d5bacf9d0074ccdceeb0260a0e387936.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d62174e-300e-11ed-9266-42010a9c0072", "comment": "Malware payload (Kutaki)", "timestamp": 1662707323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707323, "uuid": "74a405e4-34be-495e-a993-31ae5acc2e06", "comment": "Malware payload (Kutaki)", "value": "f2d9b19707c3356037cb197852fe938d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707323, "uuid": "36c50a45-f5ab-41c2-aaf7-9998919085f4", "comment": "Malware payload (Kutaki)", "value": "793b8eebc54d69cd4e7e80400d55bc97dda0ff3836c39eec8c67a00285bdd722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707323, "uuid": "192e5a3e-3946-4693-9e75-c7962c725d78", "comment": "Malware payload (Kutaki)", "value": "44e2604986ee12516c7a53226885eb062e70fb19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707323, "uuid": "4f0daf0d-9b39-4651-a465-93909485909d", "comment": "Malware payload (Kutaki)", "value": "2660b7ff748ac389b7acf42baf89439a66f1a82da1abf873813652f7944e2f2f79cf7c2479e792ad55f7146037fc7be4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707323, "uuid": "5c076d86-48be-49d2-82b0-0723d2533799", "value": "T19F94F10BF6D90EA2E95716721E57DAF06A33F90A4F170B0B3101717D2A7BEA0186875F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707323, "uuid": "96d4e4f7-bccd-4b7d-9fb8-396f8c7478a5", "value": "5cb087ed93d189235a6531d416a88c86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707323, "uuid": "05dbd81f-c067-4556-b461-370c5c354719", "value": "6144:Bx9Xwhm7c/n10V7c5W4Es+CS/wUcvzUjSa5pK2mKdl0TruunfD09gfJChgGJhCj:BbXwhm7a1NB4/8vYjDpK8atfx8hDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662707323, "uuid": "1aab81ae-6a34-47ec-b594-ca6393cf3c8f", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662707323, "uuid": "873cfb83-b047-4f5d-a1a6-fe25de8dd4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707323, "uuid": "8a577baf-132b-4132-801c-06ab31618e21", "value": "HDFC Tax Payment Attached.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e376e2-3057-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1662738925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738925, "uuid": "4f4296a5-7f1d-4a89-8437-13dbd43b7002", "comment": "Malware payload (NetSupport)", "value": "ddf948401b3b834f0f187465918e1324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738925, "uuid": "97897b14-c617-4ed2-8c02-7b7f3ff2df5a", "comment": "Malware payload (NetSupport)", "value": "7b53def5f8927c76ab3d102222b8cec2e5d74cd0529873c7f416ecef7855a830", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738925, "uuid": "d630714f-124c-4daa-ac3d-91694241e85e", "comment": "Malware payload (NetSupport)", "value": "304cf0d70972cd0e5630f33e1f60ea7ff6ec4dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738925, "uuid": "86fc0c2c-1498-4ad9-8368-054fea741b47", "comment": "Malware payload (NetSupport)", "value": "0f47c4b0d164342c2a7bfd56b0a5c1ece9f129981feb619168c042b5476cedbe68f6e0efabc483939fde71d3eba83652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738925, "uuid": "7d4b3c48-98bf-4c84-af74-78a29d8ae3d6", "value": "T1FE24BF12B5E0D472D7E645387431CA942E7BBCE2AB24894B7B643BAF2F313D06631356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738925, "uuid": "7f43aeeb-0157-4668-9c57-ac85df288a03", "value": "8214eaa7808ae504d4e701b905d3948e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738925, "uuid": "f67e63f1-e342-4166-88ec-18887cabde31", "value": "3072:nQp9t7IFMVDjc5ZI3XRUkxk1XLWasPomRYEDrKeHI6lPj:UdsIxCgaEoCYhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662738925, "uuid": "a47ca0c8-c1f1-4415-9ea5-6f8bf00955df", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662738925, "uuid": "56ca7c84-87f9-4fdb-9e90-c29350355fce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738925, "uuid": "6b502ee7-9080-4860-af81-6625e51fb3ad", "value": "ddf948401b3b834f0f187465918e1324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc84007-3015-11ed-9266-42010a9c0072", "comment": "Malware payload (IRATA)", "timestamp": 1662710626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710626, "uuid": "0ea127c1-159e-427c-b501-e95ab408c431", "comment": "Malware payload (IRATA)", "value": "d69fce686ca353b468ac1b2ed5becea5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710626, "uuid": "b8a7711e-3888-4302-8cd4-82bbf2cb0b2e", "comment": "Malware payload (IRATA)", "value": "7b71bdbb48e1ad7fb26d112ea9289a951923b4fbf41b983edd0567b8b9f1661e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710626, "uuid": "356a72d1-aaa5-4bf6-8a8f-c74023f3462a", "comment": "Malware payload (IRATA)", "value": "8bbc66f16edaff7b989d4af6f9be1510012e002b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710626, "uuid": "97a97587-05af-4301-8d7c-44a59e60c625", "comment": "Malware payload (IRATA)", "value": "b29c7d6ab1dc921248cc67671530b4f06879045927aae30580e0eb71551064b8f0bd64353b4b6611350321d174a62f82", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710626, "uuid": "50552ba0-aa5a-49c8-8559-5e39c9ee1b39", "value": "T171A51253F226D96BC8F2D37222B5223651734D289B43EA8E3D0977BD24F7AE847546C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710626, "uuid": "7aaef39e-4d20-4955-a916-83430afbf46e", "value": "49152:MTiT1hXbMAIEa2kPdeCmyDR2//gZPr3ZC7ow2eR53qv:MmTjIfEaTPkCdRyiYEARW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662710626, "uuid": "f61a5e8b-84ed-48fb-a702-b922d1b2372f", "value": 2208554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662710626, "uuid": "4cfcc22b-17dd-49b9-8708-2a5c3a1e6010", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710626, "uuid": "c2d7d545-8daf-44ef-84d0-78e0e7a60b0a", "value": "\u0645\u0634\u0627\u0647\u062f\u0647_\u0627\u0628\u0644\u0627\u063a\u06cc\u0647.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700c60f1-2ff4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662696241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662696241, "uuid": "48d0dcff-9598-422f-a84d-02ea0cbedb16", "comment": "Malware payload", "value": "a042e8658889a179e7d352fe23f8484a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662696241, "uuid": "45b081cb-2f50-45bb-b115-360ce1f7ea85", "comment": "Malware payload", "value": "7bd398307e4e74fcd8788d068e7285ae3d0d0d62baf827a68c24b6bba07f20ca", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662696241, "uuid": "8e9aa041-49a0-493d-a1a1-191bb0092227", "comment": "Malware payload", "value": "5fcb61cc3257a364b1f9bd6ba8f7a220a5bf7991", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662696241, "uuid": "78a8c3fe-2ca1-4494-836c-812cd57850b8", "comment": "Malware payload", "value": "03557d14050096bf626e119ef78201a6ca5180b35c6cfd8a82cfa97505733db6ef2282e6c0683047ffa418b51e8141fe", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662696241, "uuid": "1379cfa7-8f24-4651-ba9f-8995f574ba0b", "value": "T1B9E63381F3D9ED2FCC73C1324BB51A7665864C55C713E203A968B36C98F7AD48A85BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662696241, "uuid": "7e4cb0c1-c411-43f2-8545-1dae85a4d7b1", "value": "393216:3maBC9u9O4X9uGtUNCK54bOZkLx0hb2XUXT2pQBH:DBVc4X9uGtUXzset2XZpsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662696241, "uuid": "055f88ad-0182-4907-8918-e9b5661308e0", "value": 13999989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662696241, "uuid": "49a52d18-e21c-4917-a360-6caa15160537", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662696241, "uuid": "31b9289a-685c-4058-a709-f96b0dbcfb51", "value": "7bd398307e4e74fcd8788d068e7285ae3d0d0d62baf827a68c24b6bba07f20ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da291965-3064-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662744523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744523, "uuid": "d96ffa87-cd64-4a6c-8112-0ad6fab3e94b", "comment": "Malware payload (Mirai)", "value": "3441dd9ff2610a676ff0e024342df1c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744523, "uuid": "a05f490e-fac4-40b5-870c-ce971693995c", "comment": "Malware payload (Mirai)", "value": "7c8c5d522cb7f3a93a45dc55f0a99ad1a2d453c10f3a36f150c82b30ff52aa0a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744523, "uuid": "92aed468-4b26-4657-b019-c7500461bf8d", "comment": "Malware payload (Mirai)", "value": "8d1b396e137c220e14d4d35028582b19c09a5c18", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744523, "uuid": "4ccdb591-fbb2-4542-ab11-e907fb95777d", "comment": "Malware payload (Mirai)", "value": "d4b93eacd9e3bf3af00e8f65d6cf2a1ba3369da458b1b9606527161242b6675e2ca71353d7800f7a5aa82b62cb858204", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744523, "uuid": "f32fea0c-e7a5-4f2c-bdb3-72091c6ba213", "value": "T1D363951D7E218FEDFAAD423447B78E21AA5823D627D1D5C4E15CEA011E7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744523, "uuid": "b78b900d-9eb2-4bd8-8619-b9592e9b868e", "value": "1536:i0h4c4HPTnPm98fp2Pm97NN0jvb+10WJF:irPLQmlNNoveV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662744523, "uuid": "52f03bf2-c498-4014-9a21-dc50f00f7532", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662744523, "uuid": "08bac3b8-d107-429e-9607-35d8f25e408e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744523, "uuid": "e6c6e547-3167-4edb-a08b-c679b6b32a82", "value": "botx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ba45e9-2fdb-11ed-9266-42010a9c0072", "comment": "Malware payload (CobaltStrike)", "timestamp": 1662685406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685406, "uuid": "1b076598-71a4-425d-b007-eeff8c44fb74", "comment": "Malware payload (CobaltStrike)", "value": "7bc67d846493f2e7c132ef3953057661", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685406, "uuid": "28461249-41a6-48dd-a529-986c1550a014", "comment": "Malware payload (CobaltStrike)", "value": "7d536b270b9bf18abaa1aac2515293cc30271ead88038fcefe7c04612b9a5c41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685406, "uuid": "c7ca1baf-4c78-4731-86bd-46522d98956e", "comment": "Malware payload (CobaltStrike)", "value": "3c0f075196e601ef11b652b2088a56e680c1715f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685406, "uuid": "747bb8b6-2d87-40ad-b6ed-1cd65b7f7052", "comment": "Malware payload (CobaltStrike)", "value": "5e530df9564101a6abd5da63fb00fab1fb49024bceb30830baed9641a8b036d4b0648a4c3968898ebc5f8be353dae015", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685406, "uuid": "a07da091-85c7-412c-abef-34dcf172eb83", "value": "T18A521A35EA4378F1FD1A897014EFB6BF9EB3E1138C205C86CF94E94498234B6881765D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685406, "uuid": "bea2d43f-eeea-4e5a-8845-22136ab29cf5", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685406, "uuid": "e3481164-0151-40cd-ae91-c02e2f6daed6", "value": "192:ANH+DgGK83SxHn2OQ/dmBI4KBfTgir+xzL8QkVzd8bqUqV/Qjo7AGa:A1+kGKqbOCdWIVBff+xzLGVzdIfCXAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662685406, "uuid": "2f984f6b-d941-4b9a-852f-27f3b41373e1", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662685406, "uuid": "4d8234d3-107e-4cdb-a641-46316a0d8cd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685406, "uuid": "17d2169c-4673-4381-8676-a58118f95c98", "value": "7bc67d846493f2e7c132ef3953057661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1d24df-3027-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662718357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718357, "uuid": "829086a5-9c3d-481e-9722-5f0b427af86d", "comment": "Malware payload", "value": "47afaecb240d66ccff1c65ad0f26d7e9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718357, "uuid": "1486f68c-8ebf-48d6-b8f7-1e6508a55cec", "comment": "Malware payload", "value": "7dd43d4c5bf4ed635f15589365113227b89ec280ce7730ae8682ca8260563917", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718357, "uuid": "62225bce-c434-49f5-9ad6-5d3628fc0de2", "comment": "Malware payload", "value": "c752f87aa871c87bea3ebd51c1c528888d53c15d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718357, "uuid": "b102436c-4057-4bea-992a-5a9e180f4c44", "comment": "Malware payload", "value": "95202393ded2b38e2ec9eebd4275ddde7a1963e7cf21c27320a2899859388526031c73721603ea78a4e1f0b3b53d4416", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718357, "uuid": "3331002f-61fb-480f-8237-d8e6b9f8b509", "value": "T17FB2C03BC765482BD20267F58205174FB7B9501AE3A7A1BB6C4970ED8687DBD0B70D0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718357, "uuid": "4dff1550-a475-4bff-8516-3fe6846fd289", "value": "384:QYL0PtzckZhUin/+hly5+8F1BPd+I+TvKJy9PpdZWwGKUu1KB7x+WX8cdWPGv3:QYStzckIi/fFvEj2yPhUuKBoTc6Gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662718357, "uuid": "11614e6c-c9c9-4f4f-9045-ba9c6aa366d3", "value": 25105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662718357, "uuid": "14325018-608a-4525-88d4-8c6544c14327", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718357, "uuid": "613322cb-cf43-4d05-91e6-d6e9a4476697", "value": "Untitled attachment 00011.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302c850e-3002-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1662702147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702147, "uuid": "407c5dcb-cfdd-4a64-8cfd-e0b9ab796e8e", "comment": "Malware payload (RecordBreaker)", "value": "c281afa780d02d386d3795a8ba9851fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702147, "uuid": "7bc3d076-9d3a-41ef-9e69-0e40187d22bb", "comment": "Malware payload (RecordBreaker)", "value": "8324f3a58dbe3ba8a2e06f1fe56de5f0b195da302dd131e01fd51f7f6b77f635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702147, "uuid": "22ff60e4-34d8-4001-8569-f79de45dd280", "comment": "Malware payload (RecordBreaker)", "value": "75dd4a1d3a90495178c46e0e41aedc67bc1889f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702147, "uuid": "7039b61f-7477-4ddc-868d-d8c5afefd6ee", "comment": "Malware payload (RecordBreaker)", "value": "d5b244afca815a3b17acc5634c3aceec558b5fc08b37ceb4c726ab004b6a0ef82309c781983369191be6a95a2de2612c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702147, "uuid": "6b1ad42f-99a6-405b-96f6-7677bd5122dc", "value": "T18F24BE227590C931C4B745300375EBE46ABEB8622A28D54B3B543BAF2E323D567B531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702147, "uuid": "86f0e0ee-ad98-4afd-af59-c53b711f03a2", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702147, "uuid": "17f86a24-4229-4f47-86f7-187f448981fd", "value": "3072:nPJ9ZVYtvpLxPJcmI/QS21O4pOPx3Vrv/LYHCBTijZ+sjPp:xFCZxzItN4pOPxFLRTy+oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662702147, "uuid": "231a071c-c955-4210-9820-4e879afd0bc9", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662702147, "uuid": "712bf384-8436-4240-ae3b-e1b8a3674de0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702147, "uuid": "4abafdd1-0850-4822-b13e-5eced7070f03", "value": "SecuriteInfo.com.Win32.RansomX-gen.11556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667ef886-3015-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662710399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710399, "uuid": "04111409-c3ae-4e3a-8e5a-9f526d211210", "comment": "Malware payload", "value": "f7dbeb6f17212cf67aef9d61588a78b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710399, "uuid": "2ce5c792-f681-4b6a-8855-b47e637b9504", "comment": "Malware payload", "value": "83e27fffb3fcd412890496319ce95e2793ba9a433d82130ce376a32fe66158ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710399, "uuid": "f463ab57-88eb-4315-83df-ed746cb95011", "comment": "Malware payload", "value": "88e0884889e9de7dd2f0817a67351e63727f16fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710399, "uuid": "a6209cc0-c9ba-4585-9b51-603666ae8a30", "comment": "Malware payload", "value": "717f5c9f9c825480d5fd52b2e55b5bb3e82b904a617fa2d9af8f78719a155fe74bc03043554b1a9fcd35678d9950b498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710399, "uuid": "9060a3f7-627c-4d26-b07b-aca8395c5b10", "value": "T17F7633513DF4A6F0F211A333AB9A9BC2D2D7C11D4E38A2E71B48D8ED1F681F85056789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710399, "uuid": "ece16898-bfa9-4e30-bfe8-3661de5ae01b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710399, "uuid": "bd739892-f0b7-4633-8412-2ffb5f0a4430", "value": "196608:91OQoXS5k0cVzLbxvVCnoXZvidLeEv0KCC1cHCKaR:3OhS55cBxvVCn9DvbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662710399, "uuid": "407d41a9-778d-443a-80c9-3225545a4e5a", "value": 7595273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662710399, "uuid": "2312dada-8d4b-4c96-b72c-48ea57922a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710399, "uuid": "81934cc1-56eb-46ea-84f5-9524f5cac1c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f78395b-301c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662713259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662713259, "uuid": "13ecba51-53e8-48fb-b5d6-4cd36870b52e", "comment": "Malware payload", "value": "2f5f508a04337e5d621933f147d6a742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662713259, "uuid": "492788e3-c7d1-4778-92c8-4ab7acd178a7", "comment": "Malware payload", "value": "8785300bc02bbf034417c477db91c121123b31b1eaf24fc0f74ee11e11ec058c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662713259, "uuid": "75848267-4ed9-4d5e-8386-1377fde775e7", "comment": "Malware payload", "value": "d5c10e0369fe103d2c883ff40596a1210ce1aa4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662713259, "uuid": "7db4833a-e931-424f-9f6b-57a88b6cb5ea", "comment": "Malware payload", "value": "d600c92cd12235a6da5d19442b3897483af2c1d1fcc8a67dbcf40ce70beca7e4c4f7c9186a8c8c84de75e419a842234d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662713259, "uuid": "e44f15d7-c670-47c0-b3c1-73468431e98c", "value": "T1EA45E1DBA34E1D25FF7444BBA02547E1BAAB42B82AD5C35D3BC015F1F80BA520D53B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662713259, "uuid": "9e052453-ddeb-46ab-af2a-7cae74798970", "value": "24576:w0VSYHXsSUMXMCKq9imDTeHWXDs0Rw6MQ2NA4g:5Vj1vuqxDT1s0C5ty4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662713259, "uuid": "a4196c31-229e-45ac-a93a-e7d3201cea3d", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662713259, "uuid": "2df47365-f955-44c9-8182-45e4c1bc4252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662713259, "uuid": "a5aa953a-e2ce-48b1-8269-61106dc6ad9f", "value": "SecuriteInfo.com.Win64.CrypterX-gen.25284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87a6673-3090-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662763337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662763337, "uuid": "7f58114c-6760-4a9b-85f3-0aade85b3b7b", "comment": "Malware payload", "value": "64e7de63b304359e7d072e7d893134ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662763337, "uuid": "f181397a-a1d3-488f-a295-97b570207f5b", "comment": "Malware payload", "value": "88264f0de2354ff9e7f2e08b13907fc71c2d767c51c0385f2d5ea700c0109def", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662763337, "uuid": "43f1a581-0a7a-4fe4-9f09-cfcedd7c014d", "comment": "Malware payload", "value": "1b59ece9aeba931249ae9fc692e17f519778d858", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662763337, "uuid": "5e0bb614-a41a-4e55-a37b-8dec6650e168", "comment": "Malware payload", "value": "8488c195aad2fa1d3557154a3227e45c9e4b3bf57654cfbdd2159595071f19796c5a7c7ac0d362eb7f394a53d65e375f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662763337, "uuid": "5ac06168-ee8d-40fe-8ad5-44f2c146d235", "value": "T1FE533BDAB800DE7DFC4BE6BA44120A0DF62563A195530F27A7ABFCD36D320989E12D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662763337, "uuid": "f9bc7cf8-bb76-423e-962f-54adaff9ab16", "value": "768:2ewda9FQmC9HGpVTIcTTox/El6gVzLet0GuUvTK9ZGf8EDl8lk8Gh/bGPMY:2Hsj6cTUx/El6myt0vUvSZGUEDmO8FEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662763337, "uuid": "5d35f582-2df9-4b40-af58-1c77fc7a0b36", "value": 64680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662763337, "uuid": "60f5306e-7690-49dd-966d-8f159067611c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662763337, "uuid": "27995e2e-ae16-45be-9e25-f5d36666f94a", "value": "64e7de63b304359e7d072e7d893134ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8304d0-3027-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662718031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718031, "uuid": "4ede6066-6a1e-4f48-b247-e6b1eb5e0653", "comment": "Malware payload (RedLineStealer)", "value": "6bf5488cbc8b5475997c8f9feb9b80f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718031, "uuid": "82d029b0-4f75-42e6-ace2-a213f46aeebd", "comment": "Malware payload (RedLineStealer)", "value": "888b5e39aafdf0f8db93b08e9e6dfc59430c54d1c7ca844f626645e00101ac32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718031, "uuid": "b9988e1c-ce37-40c7-990f-2ba1f86f559b", "comment": "Malware payload (RedLineStealer)", "value": "6f260f4cb0ded66c3ae7d44c1f52ba221c6365ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718031, "uuid": "eee79476-68f0-460f-a1e2-598459c4dcdd", "comment": "Malware payload (RedLineStealer)", "value": "6aebdf1c6c3574e0f2e8b7333ddc02acff2887ac419c2db5fd057cf01b58b7d576d25e0c4afc98f13df27e37d47d6697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718031, "uuid": "dde55035-18e5-434c-9ffa-c38068d60be5", "value": "T1FF6523227691C272E47705B044F7CF6ABE19707703A444C7B99F62EA5E603F5E22D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718031, "uuid": "cee1edf0-b678-40d3-a40c-1c4afd14606a", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718031, "uuid": "84599b0c-2f84-46cf-b10a-1d866f8eef16", "value": "24576:Hk77TrciDl2xUk4ghirAZyoKuscuLERFlq/at8w0b7DOXsWGD/JBACHkJdGBP:HkHTAGryirAZyozrYSV0b/Oc1DBeOkJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662718031, "uuid": "8afe9e79-5b53-487b-9f34-4c4a2ccd9ce0", "value": 1466568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662718031, "uuid": "3c8ec1fe-1b68-46bd-8079-46ae3546da14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718031, "uuid": "e2887011-7014-423b-a702-051afd7df5da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129d67ba-3013-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662709399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709399, "uuid": "367aef9b-6123-477d-9b93-aa1404b8024f", "comment": "Malware payload", "value": "69efb72407a42943162534ec7cd4e7ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709399, "uuid": "abc9b032-33cc-4eed-9a8b-c4448c6485e4", "comment": "Malware payload", "value": "8a40814ff8c008d254cceccca174641b028284e498c20bfb5156dfeca935c10d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709399, "uuid": "fb7cc629-6c14-4dee-bb7c-7b93fe2c65b9", "comment": "Malware payload", "value": "6bf6709866fb42342c2eaac933926ef95f03b7b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709399, "uuid": "928f7233-de52-4c11-8828-0332d9c5ab61", "comment": "Malware payload", "value": "42f1b7629999997b67ccd2b1a86dae68d50fffb1ca3057912c452092d0262f940732d3ed4a8fba18df8b9c7c80812a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709399, "uuid": "c873dde4-9b1c-4cfb-a2e1-4e1c93e115b1", "value": "T14F24BF22BDE0C472C4E2C9344474D7B4EE7AB86A9B78858B7364776F2E30291663D317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709399, "uuid": "00ca2f25-a0e7-4597-a36b-8c82fb6d3330", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709399, "uuid": "bc9cf269-403d-4289-98db-1fdfeaa78914", "value": "3072:MrcR+nIy6BLd3X65AxxinGw2ywsvSUoj+is6pV0EY4WR:jRZLdPkpwgobHY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662709399, "uuid": "610e0f23-3a48-4ec4-b4fa-a9ee91e1908b", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662709399, "uuid": "ec255a0c-89e9-45e1-9ed1-dc9b468b4f27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709399, "uuid": "9e40a964-1e2c-4e7c-8df9-9533657d814d", "value": "SecuriteInfo.com.Win32.Evo-gen.22605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e1217a-304b-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1662733610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733610, "uuid": "a2aa522f-a892-42f2-9ff0-98828935d14c", "comment": "Malware payload (AgentTesla)", "value": "7ea75fbbd00a8ddd7dcab9eb89df2249", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733610, "uuid": "27a61e4d-13da-405e-815f-1f04e634f2a3", "comment": "Malware payload (AgentTesla)", "value": "8b1a8511b64c30b2d369ec41436b9dce57f76dcf51b902506b601f9e48bb9adf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733610, "uuid": "6091dacf-887b-4c9c-91fa-d350360c9a8c", "comment": "Malware payload (AgentTesla)", "value": "ab9d5d30a90ded737cb1cccfc92f98ffbb67019d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733610, "uuid": "8edd0b0b-6a2f-49ee-b8b9-e335d51a5666", "comment": "Malware payload (AgentTesla)", "value": "3e554ff676583780a0fb6b46ff6f5abaa168b2a8006b697050f2019afceb4abcbd33cd71a109dccd06edca481c7d3fca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733610, "uuid": "2b9700b5-f109-49ba-8add-f05dfcf6c33b", "value": "T1A655CF25158C9FB8E03A9F74A022443483F3AC52EB5ED669BFC739BA84B1F41D65B503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733610, "uuid": "2b0ad18f-1864-4c22-b814-a52d64e7f119", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733610, "uuid": "ce5dd4e4-4202-421d-bc8d-94c7f26f4520", "value": "24576:RSpvCMhLuyyjcA+ofkK+B1dgttBp1HzmWOj:4bLuyyjcSv+BjetT1KWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662733610, "uuid": "96218085-a19c-45e4-bc24-8488fdb2ecad", "value": 1282560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662733610, "uuid": "4ed497ee-433e-4009-8fd5-a57c61bd2cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733610, "uuid": "f60095b8-5af3-4787-a82f-796298b3f51c", "value": "W5D16lwDILyMSLk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1cc185-308a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662760659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760659, "uuid": "7d8a582a-40ca-4314-a45d-99a2cd539160", "comment": "Malware payload", "value": "72caa0747ba2d2141b050bc75c93a89f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760659, "uuid": "fa6c7f4e-b8e4-4027-8498-5f7d6e0b64b2", "comment": "Malware payload", "value": "8c222d2b5bb7aed3fe75b809df2e3d43ee08abb79dd41c1b87a4be40cfc7261c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760659, "uuid": "f72b7993-dd8d-4558-8ebe-b40f346f3338", "comment": "Malware payload", "value": "ca9ed65b38379b4ebd679ddaf6030f0daee62dde", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760659, "uuid": "2ba600eb-6b3f-44d0-bc11-979860a90615", "comment": "Malware payload", "value": "e34134ed694c78b12a3fd894a83a27d6cc7cb37ebd437c3e56faa94f82546d9f007812205af71944a9293828a071aef2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760659, "uuid": "d4c33dd3-5155-464d-9939-ab5696d6213a", "value": "T1C0C2D13527054491CE72C4B397B22B901C656F79B153C94E2F89DBE7CE0A1F2B81B9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760659, "uuid": "30ce9777-76f7-47bf-a2bd-1b36db176751", "value": "768:xy9xhFfTK0tRCsZtA8PDK0VAM4oe7xLJgGlzDpUYshr:xy9d+05s8xh4fBVqY+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662760659, "uuid": "f5693c05-6b01-4cd7-80ff-8debb5194287", "value": 27896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662760659, "uuid": "68357903-e326-4933-8618-3ac86325f44f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760659, "uuid": "ebb6bf19-9692-496f-b8c7-61a89aac9f5e", "value": "yakuza.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d70e73-3079-11ed-9266-42010a9c0072", "comment": "Malware payload (TeamBot)", "timestamp": 1662753314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662753314, "uuid": "5804db04-1116-443f-8146-cf23e91ff50f", "comment": "Malware payload (TeamBot)", "value": "31e7391507f0770622741989b7b3a00a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662753314, "uuid": "8e47c8e5-4a98-478d-8587-f568cfbe77b1", "comment": "Malware payload (TeamBot)", "value": "8cb86bbcb25685ceebc56873baf12f6fd9f876c2d196a3e973aa7449108c63d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662753314, "uuid": "ca386fcd-f13b-425f-be0c-e8f323ca58a0", "comment": "Malware payload (TeamBot)", "value": "2d1730f5a123bedc4af5227a8e403878a07bb0b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662753314, "uuid": "cac71f4d-320d-484b-bdec-0d33aab6de08", "comment": "Malware payload (TeamBot)", "value": "8233a5df9830f48e85784df218e6bc5be1435256319d8b7f1c371f0c2e23b28c54507df8e2117bb4ffdc7a0d649ca127", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662753314, "uuid": "d5b692ab-b74d-4c19-8400-42b113871db7", "value": "T1D724CF62B9A1E431C9E305308475C3E46FBABD625A74898FB754376F2E302D12BB6317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662753314, "uuid": "f9df630e-3489-4bcf-b9f5-67632ddee8e3", "value": "ffafc7bbf025f864c5eae76fa1f4c722", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662753314, "uuid": "7710878a-b3cf-4524-94be-119dbd1f1c51", "value": "3072:bCqmzqif9dCcCiyAdH3Jqe2KcfCwCllo5Z6:1Af9dCrAhAe2PfCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662753314, "uuid": "d98ca67c-819d-470b-9b06-297ab32bd2b5", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662753314, "uuid": "03af7fc3-a471-403b-a1e4-c5c16a8e1de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662753314, "uuid": "6644b5dc-c830-4084-bd01-f4a5a9a2e275", "value": "31e7391507f0770622741989b7b3a00a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82f67a0-3057-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662738909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738909, "uuid": "f08df12c-a7e1-4a27-a3a8-ac7e891f05f4", "comment": "Malware payload (RedLineStealer)", "value": "6578d19c1c715bd44e66ebae66de8561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738909, "uuid": "605996b4-83ad-4074-825d-f5bfe102be51", "comment": "Malware payload (RedLineStealer)", "value": "8e0521574c3f25b0458ce7ef4282c6bf54d95184b8da46baf3d54dc335ec2a36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738909, "uuid": "0a2e449a-e91a-420d-81eb-994b4db840dd", "comment": "Malware payload (RedLineStealer)", "value": "24f7456a1ecbea0bcaf4e161cd9eeb9a36b55144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738909, "uuid": "08ff18be-40da-4f17-87ee-cbd01923ae4d", "comment": "Malware payload (RedLineStealer)", "value": "2df69faf4456dafd8759d34e3a9a63eeab729fbd6234ddba5761cff08c71de801c77556a85289ad7755a076050b251f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738909, "uuid": "4335a743-5a79-4268-97d4-cf70021bf535", "value": "T1F524D01175D0C871DEEA88384430D7A42EBAFC625A74998F77483BAF5E302D16B7171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738909, "uuid": "c38498ac-bedd-42f0-b474-d783219cce1c", "value": "5d5b8d072fdd778d9ba9ec0c36bae15d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738909, "uuid": "38ff2c17-173d-4515-b05b-2a9136ed740e", "value": "3072:mIBzTxuuK3E5qcr5DIYC4CaFUAuVz4DJ8LV41Ex+y2:MnOqH4TFUbzRLVoEoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662738909, "uuid": "fbb5eeb7-15c5-4b85-a83b-8f255a3d4baf", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662738909, "uuid": "64b00070-a30d-4605-9afb-09fd404def25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738909, "uuid": "712cefe6-cbe6-4fe7-902b-68ff50577853", "value": "6578d19c1c715bd44e66ebae66de8561.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9057fd7a-300a-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1662705744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705744, "uuid": "ba5b478f-48c4-4f08-8426-d1f024232a57", "comment": "Malware payload (RecordBreaker)", "value": "beafd12ee2fa12d13f813c99e48dc80b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705744, "uuid": "5ccecf4a-1059-4766-bd81-b9c1db7a85e3", "comment": "Malware payload (RecordBreaker)", "value": "8efaf5bcb4dd8909f6f923c1e59c126455c2ba722f6787e32db34eba7a87caf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705744, "uuid": "4f5a7e2f-cd24-45dd-9deb-f39b283c462a", "comment": "Malware payload (RecordBreaker)", "value": "52c6dbfc2b67dd65985b8df8059213e4f42fe3bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705744, "uuid": "2158297b-920b-4376-a0ac-5ebf57e10007", "comment": "Malware payload (RecordBreaker)", "value": "d84e48b12e0c3ce18659739da27e7245989aceeff621691a00d4f6f91064c4d96385e74857663bbdafdcb75b2a6a12e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705744, "uuid": "3822459a-f95e-4872-9c42-743825c56c3c", "value": "T15C24CF25B7E0C531C4E2483094B0C794AEBEF8621A74794BB7A4376F6F702D2667A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705744, "uuid": "2b0a3f35-ae0b-4b8e-955a-f84500dec2de", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705744, "uuid": "d16f5906-ff2f-4d5d-9096-5c249c16c0eb", "value": "3072:FcYIMW7hKI2+65bfQiiYS+hvzkzmOID0FMLAE13I0X:VSK5Zfm0hvzSIwF41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662705744, "uuid": "70d2b838-1a5a-49e9-9a8b-7fc9a89a7f51", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662705744, "uuid": "c4ea6f55-5802-4a08-bea6-100452a8ab0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705744, "uuid": "0e4ef82f-93aa-4c1c-a3fb-08ff942ecc34", "value": "SecuriteInfo.com.W32.Ransom.QS.gen.Eldorado.8073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7022aa-302d-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1662720770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662720770, "uuid": "b3d9cc70-7923-4736-ad94-925e433b8038", "comment": "Malware payload (Formbook)", "value": "fbcb87e65d3a23b4fe229aeace34621f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662720770, "uuid": "8ec718e8-18a8-4932-b4fd-d92f5b650d60", "comment": "Malware payload (Formbook)", "value": "8f361d8882f426ba9ebfe5c5d76a9a459cb8554d93c369864726dda441026876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662720770, "uuid": "4e23e5ed-3a6d-47a7-89c0-9a13e3cfd767", "comment": "Malware payload (Formbook)", "value": "8139f123069e7e7632331779de8ed6d5031efcd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662720770, "uuid": "f600bfbb-b670-46b7-a22c-efee53e295da", "comment": "Malware payload (Formbook)", "value": "4c67736c0a894d541b0120a84b496aba80ab0acfe8457f99d4a11036bc9341b1799ab39c64809485f038805f492ecbdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662720770, "uuid": "8cc5e951-8981-4cfe-8ad7-056d9625867f", "value": "T164151B0B21D40965C87251FCA4CCC17357AA9E45E63BC949BFCA9CEFF192F6C42D22A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662720770, "uuid": "9e4c43e1-4130-4782-8c0a-b60d3a623ad3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662720770, "uuid": "ebebdc5f-9493-4992-beac-e8acdbc2d5d4", "value": "12288:8UUq1vQWztAJchTCRjN1McME0s2BJOwxmGr5t:V17W2hTMN1tZ0s2BJOwxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662720770, "uuid": "cbc09669-c37d-4f34-ad3a-8f8bc04ab81f", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662720770, "uuid": "8bc0d53b-7cf3-4fa2-80f9-de8c6ef7c6dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662720770, "uuid": "17aecd62-a81a-445a-988b-7098a2823da5", "value": "iftex order.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139fbefc-3013-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662709401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709401, "uuid": "a3489b79-e90e-41a8-84b4-187b5661cb8e", "comment": "Malware payload", "value": "372f78857f2689c000a2a9e61e5e9f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709401, "uuid": "3a384080-6655-4332-997a-4c546160fd6a", "comment": "Malware payload", "value": "9029d7f2265862ca6817fbcbb0e414a94ccf87a3d5add347af7037f0a144114a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709401, "uuid": "0723c172-8537-4182-a177-0abc601ab545", "comment": "Malware payload", "value": "6dca31a4b30b765fa56352b9c45de9fe53073932", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709401, "uuid": "766d6e72-e61a-4e83-9b1b-a5947a80405b", "comment": "Malware payload", "value": "61699a92928aa36fbd8636db14de0629b4158486bf9c67310c49cdafee3ff8e27b9662b955dc9aef17a3b74ec4d8871f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709401, "uuid": "52d50c5f-f599-4f98-856f-6682ce294f5f", "value": "T19924CF12B5E0D432E4E645308870C7E46BBBB8B36A28894B77983B6F6F303D16675357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709401, "uuid": "c11234da-61a7-493e-8e98-38bb13177bac", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709401, "uuid": "fcee1a01-8581-408c-9b5b-2a5ebbd66b1a", "value": "3072:6DLoTYXrNBXJ6539U3N/vHLmrgA1EkDb6flwsp0DUy+KKDb7VAw:25NNsmN/vHCrRbDG2scwb7VA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662709401, "uuid": "a555c00b-da64-41e9-972a-7de97cd5c1e9", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662709401, "uuid": "1a3bebad-20b4-4fef-a27b-67bdffa595b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709401, "uuid": "2d6b0345-8882-48c5-9db9-712f009509bf", "value": "SecuriteInfo.com.Win32.Evo-gen.1068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2768da-3069-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662746617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746617, "uuid": "7e3008ca-4555-4495-97ac-056fc7f4d8c8", "comment": "Malware payload (Mirai)", "value": "71e03944f1c617804434bc1c37b58544", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746617, "uuid": "107bf302-d739-47b2-8665-31bdbc43fe29", "comment": "Malware payload (Mirai)", "value": "91c3397a35b17790c1b065d59d4e0bb93ff5614d09d54054b62ac4c306c124ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746617, "uuid": "5ad085ee-b0c4-4ca2-895e-290364827ccf", "comment": "Malware payload (Mirai)", "value": "dfc21e1d576001933b380f3435908351955c099a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746617, "uuid": "18d67fbf-223d-48eb-90b2-abf0be44596e", "comment": "Malware payload (Mirai)", "value": "c5e9b40ae64bc6cc789d34dd8e44dbc7a23b2af8b333044271ecb24debb8426e4e72c52494fb7d329093681a5de12625", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746617, "uuid": "7b838c5d-8ae9-4547-9f1b-7f08842bc414", "value": "T1C2437B21BD762D27C0D1A07912F74B11B9B957CE26A4C61E7DB20E8EFF246402613EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746617, "uuid": "81e2ecba-4a0f-4a2f-b7a6-a3f58c273ce8", "value": "768:ukopwEgINLE56/nDiRAVIdWW2c8/O+Toq3wmJh+0V0U8Y8EOS:ukWwrINLE56/nDiWc8DsmfjV048Ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662746617, "uuid": "1f0dd2e7-a823-4f33-9b85-5e06428bc11e", "value": 59792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662746617, "uuid": "fbacb140-e0a1-43a8-a04d-b46855b84ea3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746617, "uuid": "1e7f5b4b-36e0-47bc-9631-747841ae0325", "value": "71e03944f1c617804434bc1c37b58544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cf2a7f-3064-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662744519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744519, "uuid": "69b789bd-39ce-43f6-bac5-147d2f34c279", "comment": "Malware payload (Mirai)", "value": "1c9ca3ce6e248f2271890543c7fb5182", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744519, "uuid": "23d5630b-e1eb-4d75-8418-0b49fd0fd869", "comment": "Malware payload (Mirai)", "value": "921509ff94ac35f4696ec7b13675cec824c50cc4c57ebd3661ad1e01e52d29a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744519, "uuid": "33b3bbfb-a503-4e83-aabf-3ad3187b8af2", "comment": "Malware payload (Mirai)", "value": "fe89b5fbfdfcb96b91e27733183d1edebad7e993", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744519, "uuid": "e393c680-c9e2-41d4-a4af-11383abf9ef0", "comment": "Malware payload (Mirai)", "value": "21e4bd06677e2660ecbb2a36565ad16fb0a6e2b805e5b60a79f8a8d4e02724ef4d2831a22ba34deb2e7495f4646d3270", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744519, "uuid": "83cefa95-4101-4c17-9112-2ab189647412", "value": "T18A335CC5F543DBB9D852057030B6EF338E36E1FE115DEA87D394A232AC43502A50BA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744519, "uuid": "361b1a87-a95c-4281-89cc-fe7e258b4d1e", "value": "768:ap0uCkjQke61gS2Ginxe5u68qu8iK0FvKiBYGlSTBf4WsvKQLDJPZzn:ap0uCkjvRKSbinC0UiBY+Slf4D3LNPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662744519, "uuid": "9ebc0b83-0e93-4077-928f-0cf09a77dc5d", "value": 51380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662744519, "uuid": "2aab7949-77cf-47ac-8a36-7898692a6951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744519, "uuid": "2a4a8176-2391-4320-a9f6-e354b223cbf4", "value": "botx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5593fec5-3038-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662725403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725403, "uuid": "5df19c00-acab-4352-9c58-a7e563a35812", "comment": "Malware payload (Smoke Loader)", "value": "e57190f6758917bb0723039c0d29ef8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725403, "uuid": "3f181951-640e-4569-81e8-5b0bca237e52", "comment": "Malware payload (Smoke Loader)", "value": "938f070976e2f90ad6cc8e4bd378b85160df9722537e25afde4d49f4aeb57d5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725403, "uuid": "376c899a-04be-410b-9daa-8bd4443f3a55", "comment": "Malware payload (Smoke Loader)", "value": "bb298aae9d78481b6a5df69712a7a4926ae81433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725403, "uuid": "79d3a1fa-1cf0-4dd0-b9e8-af8ac01083d1", "comment": "Malware payload (Smoke Loader)", "value": "0e669721c7de8a9b4c0dd2291d83ccc23864eede1d373d5ed25b96a016d3a5de94777464bf04894c599900f66bd8f6cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725403, "uuid": "fe5f8e14-41cb-4b96-8562-56feaf8977b5", "value": "T19224D022B190C871D5E344304474EA942E7EFCA26A7899BF7B943B6E6E303D12775327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725403, "uuid": "adf896e2-c461-4d27-b44b-d4dee067cc94", "value": "5d5b8d072fdd778d9ba9ec0c36bae15d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725403, "uuid": "4859fadf-92ec-4e77-a066-a136a3e8367e", "value": "3072:funTzRpKZp5Fr5tQYohZWmC25aHbOCuBYo4t2:vBFXoKmC25aH6CuBYj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662725403, "uuid": "6bb73db1-e9ff-4a84-94ba-f40f1bd604bd", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662725403, "uuid": "2031e269-cbdc-468b-b39f-fca255cb1800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725403, "uuid": "4f6db376-065d-4ef8-9e0b-ec63da28c731", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2a1261-2fff-11ed-9266-42010a9c0072", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1662701043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662701043, "uuid": "52b9287d-87b0-4dae-9345-bdee399550b1", "comment": "Malware payload (ErbiumStealer)", "value": "10e0cfc8d7e70dd80065c8335ce20911", "object_relation": "md5", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662701043, "uuid": "06cb26e5-35a1-43ee-b361-2aca359a5e83", "comment": "Malware payload (ErbiumStealer)", "value": "96e9511209ca80dbd6ca81de9733b4945316e592f1a6f86f50e3354bd62f0782", "object_relation": "sha256", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662701043, "uuid": "c0f163ba-8d3b-40a5-89d3-5c2b0dc63148", "comment": "Malware payload (ErbiumStealer)", "value": "b8ccfdc564e9ea5dee1a85c55c8240a49e96c14d", "object_relation": "sha1", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662701043, "uuid": "e8714a6a-ea52-40a8-b727-f637f4ac4840", "comment": "Malware payload (ErbiumStealer)", "value": "0ca3afb71f9827aab3ca0115f5dfcb26472f0c0c3757385b4a1f34821d59522d98d3f63419ebe690aabbb95a62510736", "object_relation": "sha3-384", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662701043, "uuid": "1e1082a3-976c-480f-9b1d-6b6924b927d1", "value": "T12ED48D1239C18036EB7238324AE4EAB549AEF4711B224ADF57D8173E1F746D19E3163B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662701043, "uuid": "1656e562-ef4b-482a-abb7-b2d5e2add4f7", "value": "a41bb85a2ca7e8422e7df8e92c308576", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662701043, "uuid": "708f7f69-b372-4828-a82e-7f014643dd12", "value": "12288:shMb/cXEhzbhlzkqLxe4xZ99aiXNKIQnwFh8h5nP5XhmFlve35hdt4ORuRwEvLSu:shMb/c0hzbhlzkqDe5n5Clve3P4OivQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662701043, "uuid": "45081b43-a5ec-4bba-91de-ea7b0cddc30a", "value": 638920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662701043, "uuid": "f4edbd84-7df8-4564-a7b0-a9d4a44a734c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662701043, "uuid": "3536001d-c489-4de6-aeaa-91aa5c1c43ef", "value": "10e0cfc8d7e70dd80065c8335ce20911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd03fd8-3016-11ed-9266-42010a9c0072", "comment": "Malware payload (DeadBolt)", "timestamp": 1662711032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711032, "uuid": "3ba8db7e-7f0e-44f0-9794-5ed5a2db5176", "comment": "Malware payload (DeadBolt)", "value": "38971bceb94bdc62568d88f749d76d12", "object_relation": "md5", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711032, "uuid": "f4fed49c-56ef-4fd9-84f8-9ccd086d6efd", "comment": "Malware payload (DeadBolt)", "value": "9764774e29c3418ad56a123759793a3308ad50f8f43a5783035c9fc1c4798563", "object_relation": "sha256", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711032, "uuid": "89d20ca7-3b24-4216-9a0c-149334e07780", "comment": "Malware payload (DeadBolt)", "value": "9c563abccc7c066962d1aa9058a3cbd17b76bbf4", "object_relation": "sha1", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711032, "uuid": "277296a8-2536-4203-a668-4e37eec2631d", "comment": "Malware payload (DeadBolt)", "value": "49eb059461a80641ba912e2c0174e8aa6fd68458883a5eb76bc413f32c80af9e35327f5e75544f47500ac2e2a3020564", "object_relation": "sha3-384", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711032, "uuid": "a52a9e82-f8e4-4f13-97bb-b7e84d8ec946", "value": "T1D725230734144F76F154BE3A22126E5886CBFC24A409AF914A2E9DDBBDF3D944D20B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711032, "uuid": "3870b220-3654-4c24-9ad5-243886b7794b", "value": "24576:Q6bpSMWWTAiqYNxzIlt+dEBUmYgLvQoFdEUU3+:Q0pVW1lixet+dgDQo8UU3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662711032, "uuid": "517ea55a-c157-4bff-b619-e7c0d32e48fe", "value": 1009472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662711032, "uuid": "2e3bd0c9-5ede-4cec-8e4b-387808cf7504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711032, "uuid": "b8fda424-1c5f-433d-ae45-d4a8ef6aca7e", "value": "9764774e29c3418ad56a123759793a3308ad50f8f43a5783035c9fc1c4798563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118cd35a-3024-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662716698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662716698, "uuid": "b6cd8c6d-513b-46ea-a19b-2b539d27b63a", "comment": "Malware payload (Smoke Loader)", "value": "60ba2a174b94ed8c97b1606917c647cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662716698, "uuid": "3c2c85d7-bd62-44d3-89db-5a3efefcf16b", "comment": "Malware payload (Smoke Loader)", "value": "97febf46a1de5649a128ad508b28616cb5e52463778eb7e5d4d2ad0f1439e0e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662716698, "uuid": "180135a3-a88e-4ad2-ad87-efaf2af39398", "comment": "Malware payload (Smoke Loader)", "value": "a0990cdab9340319b344d4095518e62537f0a64d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662716698, "uuid": "f93f52e2-023d-45fc-82e8-50ffbdcf574c", "comment": "Malware payload (Smoke Loader)", "value": "a23c68542a3faf593c15b9c7911488143e313cecedc7637afd39dfb510e7cd22e04836625fb0a46ac221321a6d463a3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662716698, "uuid": "70e0174e-4ccf-4a7b-98b7-fa77ee094d3f", "value": "T13A24BE22B5F0C472D4E259305034E7E52A7BFC729A64998BBBA43B2F2E703D16675313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662716698, "uuid": "803bf4cc-02b9-405b-bb5b-cef3f94e5f5e", "value": "9ec19ad11da368328b1ef380c14dc8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662716698, "uuid": "cff01284-6af8-46f0-969d-f7a001790bb4", "value": "3072:va46wupuFqzGL5qwZDfD7qsFHu1vKxBuljVuH+5C:51FabwlTFHuyLUo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662716698, "uuid": "a3fa1274-23ce-4621-a9b6-ad7282f7a5f7", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662716698, "uuid": "81c3cc0b-e38e-4473-b4c9-295f8b208805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662716698, "uuid": "4244c658-69fa-4afd-8f21-f753a82b1614", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e08e1b-3027-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662718365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718365, "uuid": "bc9500eb-ed00-467e-af81-214b7319d09c", "comment": "Malware payload", "value": "bb246a226d818e0bb26cbb3ac48771f1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718365, "uuid": "8ee5f168-88c6-432e-a463-b467f38fea26", "comment": "Malware payload", "value": "98decd8ef707cc71cdcfd0c88f7508aa057d7de21a96fa82faf5fc5fe757ded8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718365, "uuid": "4d1c11b1-7469-4d55-a4d7-5c3a171e921e", "comment": "Malware payload", "value": "4055607fd71693bf07aece193bc824d0806a3be4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718365, "uuid": "28300486-d818-42f4-8dea-01cfaf8f1a3d", "comment": "Malware payload", "value": "9a8b34b52823248f073670e06a3304450dbc09cce2191b69d0203fad4d68d6c49108a86af874f2e25bc15aad18491d6a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718365, "uuid": "cf1fda80-4eed-4c0b-94c7-11cdfe732740", "value": "T11BD2C035CE4DC073E1116375CA840B8F7B7AA11AA733AB1B1D6965DA9C0327C5E52E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718365, "uuid": "0e2ad0c3-5557-4370-a678-bc99f72742f3", "value": "768:BMdOv83L33+i0FvEdWnUUejotE3rS/e6IE/tNuzHErfT:BUygHnwvzUotEbS5r/tEiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662718365, "uuid": "b267e55c-0788-408f-8a58-46960ac1232b", "value": 29016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662718365, "uuid": "8e03cbf0-c887-4ab5-8ee7-9b44ab55311c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718365, "uuid": "105a2a15-ef71-4288-b464-d36d304d8410", "value": "Untitled attachment 00014.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc462327-306e-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1662748875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662748875, "uuid": "a64f51f6-faae-40d6-b4a8-17b051f5ca84", "comment": "Malware payload (Stop)", "value": "7829413732977911e46b8a3c7263a605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662748875, "uuid": "95e3dca0-234e-42a5-b6a0-b814d170a13e", "comment": "Malware payload (Stop)", "value": "99a2871b0c8f4a1dd546b650dbd0ff44b367cca9fedc51d51cb1f554fcdf83ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662748875, "uuid": "68102b58-7395-47fe-8154-d2bd2eac27c7", "comment": "Malware payload (Stop)", "value": "6e87d55e36d56fca27ef1543b04c352583cda56b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662748875, "uuid": "416b43ec-cf70-4acf-91ac-9c3f6343e36a", "comment": "Malware payload (Stop)", "value": "fa84398204dcc08e3ca2501707c2fb92aa93c3bdf2e42cdd9e1017ed1f6940397be413c102078ca8f68311b04899f31d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662748875, "uuid": "0b8680ee-e106-4caf-8a7e-787b5304967e", "value": "T1ECF42236BAE0F935C4E240719078DA956577B9236F2545EB3BA4352E8FB03C05B7A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662748875, "uuid": "c60767af-6d65-4186-b816-6e2b164aa533", "value": "d222372a7f8612f1284f3a88f8d20994", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662748875, "uuid": "3f23ec83-c3e4-468b-902d-dda2da5a81be", "value": "12288:VR3RcufF9RZ9w4FSwWrvPwzIr72i8RJ6+G3TMwuGYxhO1t45p7XiqSCt:3Rcufz7GYFWrvgbcMtGr1t45zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662748875, "uuid": "997c9668-526e-499d-b48e-9f7cab114a3c", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662748875, "uuid": "c756c2df-ea18-4e35-8509-a78146532fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662748875, "uuid": "dfc53388-148b-47c3-9d9c-3668b4859759", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611f1791-3089-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1662760211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760211, "uuid": "68593cf1-4c78-4b96-a2a3-21241a443404", "comment": "Malware payload (NetSupport)", "value": "d2d21e445faa3e527881f62583997bae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760211, "uuid": "bdf1d97c-1b28-42c7-93b6-1ff04f89a0eb", "comment": "Malware payload (NetSupport)", "value": "9c250f3a851b37017fb6a9514ea160f4ebdeccb34d17a55401c974cb8f011980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760211, "uuid": "db770707-9574-4952-9ff9-51e8e624f9bf", "comment": "Malware payload (NetSupport)", "value": "a026c4be2c062be7fb44011e09308e85360d3294", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760211, "uuid": "23fe904e-ffe0-409b-9070-4461be00203f", "comment": "Malware payload (NetSupport)", "value": "1775b296ef2ad0d6352b6c7787abec31d579e6e82dfaff9a36553e466dcac49b9104ccd5bfbfd606071850a636ca3387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760211, "uuid": "c3fc7827-cc62-4987-af5b-d725109d028f", "value": "T17724CF2175E0C431C5F249308434F7A92ABEFC221B28958F77943B6E6EB23E06675B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760211, "uuid": "38d5f490-b81f-4154-b0a5-9377909d9d7f", "value": "1b356ecc92b2a52db834ffe06f790b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760211, "uuid": "13e4d310-2857-4f75-8de2-32a5dedeb003", "value": "3072:sjipbDLDjGqZp5+vfTXg1ZtOEkgk44FTv0KdUvu3bi:BtLDjGqYvrQ1rOjgk44pvXdUW3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662760211, "uuid": "9d79f862-03f9-499b-af43-048b5d13aec6", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662760211, "uuid": "f44061ca-9ee4-4eed-a831-69833e78ff6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760211, "uuid": "ee98dd68-8070-4798-a9ca-052e6c1f4b7f", "value": "d2d21e445faa3e527881f62583997bae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb70763-301c-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662713258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662713258, "uuid": "6b0a041d-82ee-4bc3-844d-440a9ce59787", "comment": "Malware payload (Smoke Loader)", "value": "25b720892cfe397922655358e7f21641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662713258, "uuid": "632ff60d-9652-40ce-881b-5eb5beb70b22", "comment": "Malware payload (Smoke Loader)", "value": "9c7bbc19d6eb9e508afad47c3f73b7a7eb8c76fed6cdc3db5881221e3ac4078d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662713258, "uuid": "9b1626e1-eb46-48c8-b1ab-e81aaae20e6b", "comment": "Malware payload (Smoke Loader)", "value": "23afdd7f3b8240b20f3a9b9f491ea90fbc34a042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662713258, "uuid": "11b9a1dd-32ed-4227-b6dd-3e2a7a27f39f", "comment": "Malware payload (Smoke Loader)", "value": "b644e473ef5168ba5ce0395e7f10f088c31e8f57d7588a7aa1e3b27c30906e1cdd0a5bfe0e227321be5418cb3b65e7f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662713258, "uuid": "4ac2bbf5-4a06-424f-99aa-8d41a17807c4", "value": "T12924CF22B5D1D832C4F244305034E7F42A7AF8721A64995B7B993BAF2E30FD06A76357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662713258, "uuid": "073b303a-2eec-47c1-a52f-4700804cf632", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662713258, "uuid": "17d3b11e-67fa-453c-9346-c2263bd2b5be", "value": "3072:9Sq/CIiZjLDr651ucsAWmsKob+0Exx5Cs57T8g+TJa7tXlY:hqjfUuxATmb+zx5CuT81TJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662713258, "uuid": "6817f86f-1b4e-4740-b7a7-7a179405bfda", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662713258, "uuid": "af19e448-aeb6-4754-877c-c9972638e77d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662713258, "uuid": "634fe463-159c-48b7-b8f5-a46feceb42bb", "value": "SecuriteInfo.com.Win32.Evo-gen.3516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb00e6f-303f-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1662728611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728611, "uuid": "dd04df6c-3150-48fb-bb78-1565da1d7d0d", "comment": "Malware payload (Formbook)", "value": "69609c6ef52b390d329cefc80c006911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728611, "uuid": "3a6b36ff-c0e7-4ae7-8365-a1da9e0bf8d6", "comment": "Malware payload (Formbook)", "value": "9d4c21abe700e9fe80d7eee11ed3286a65aaa053b57f7531824a41d0597f92e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728611, "uuid": "e47c80a0-28fe-4514-acad-e81612c954a1", "comment": "Malware payload (Formbook)", "value": "d52c1ce84199ea0154b841c41339b7be37148808", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728611, "uuid": "d68591b2-34de-48f0-89c4-3e63e435aa62", "comment": "Malware payload (Formbook)", "value": "22c645a0d3c84fc281b150b64bf401e882fcc696d07f1fdde3269b9fc25ae70c8a405f8c0dd53e7aa9114cbc1740f320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728611, "uuid": "bb707818-dbc5-445d-9ece-5c70c2a9c6d3", "value": "T15915AD13A450C8B1C5225F355C1BBD689D6DFE112F8C798F62B86D89EF3AB45381B382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728611, "uuid": "1f0022a4-c3b1-4940-a53a-c13d952ef970", "value": "b9e865dbab68672dc86bace50ed643d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728611, "uuid": "48ab4ec4-42c4-4c95-9d84-9dd5f0865df2", "value": "12288:PcZI0RpZLWuz11zDo3A0eMqM1PyYiDuB6ZGK7jq8OMEI3c41RMCoqlkXWt9Nt1/Z:P4PZKkn8feMqMY3+6HyLwrbMr7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662728611, "uuid": "78f71107-2029-4dc4-881f-c7bf32440bb4", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662728611, "uuid": "6c249b5a-cad9-4383-9b47-8aa24b549e96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728611, "uuid": "11eab5f0-95ca-4350-9067-047c04fa4dfb", "value": "SecuriteInfo.com.Win32.BackdoorX-gen.22955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde4ed5b-3069-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662746650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746650, "uuid": "e3e30114-946f-42e3-90da-eb5ec63dff14", "comment": "Malware payload (Mirai)", "value": "017976c837e954ced2352aa77faf263b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746650, "uuid": "05a6755e-9753-410a-a704-41409642b243", "comment": "Malware payload (Mirai)", "value": "9db9f8bf1980d057bc0d32590d4a6e2e53a17543d7bdd33e0fd1c6d6959ed795", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746650, "uuid": "fa5cb877-eac3-4f46-bb8e-6812dc6c12e6", "comment": "Malware payload (Mirai)", "value": "cd9d3fdd52cc76da4953cb7acd8ce36e33bc7c53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746650, "uuid": "1edcd10a-8fc9-4383-87a8-8d95054df3dc", "comment": "Malware payload (Mirai)", "value": "2b197b4c64e25d55e73fcd7583863d3d4f2fc3d4416a1a116f2d6f06f134a7f3b435677b1e0116b9c657736a5a85ea80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746650, "uuid": "87812a05-3da6-4bd4-87fd-a3a064205621", "value": "T11D4329D6F801AD3DF84FE27A94174E09BA3167D402820B27A3F7BDA3AC720956D16E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746650, "uuid": "db93e7f7-9233-4816-8b8a-1e0cf93a78dc", "value": "768:IbeUSinrbTFl6c7spYTABwuX8P8Djq+OQC2W0XBls1jWGFaQLDTCxgS9l:kXr3OY8BZX8P8DVOQC2WMBW11LPCx39l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662746650, "uuid": "41ee1288-b093-4daa-b32c-5b5497eef6e9", "value": 55876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662746650, "uuid": "eb23e107-573f-4efd-a5e9-bd2243b39658", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746650, "uuid": "e815ae0b-2329-40c9-9fd3-21dade41d386", "value": "017976c837e954ced2352aa77faf263b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc97564-3025-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662717229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717229, "uuid": "a3d41992-04f6-444b-9de4-782fc40215bf", "comment": "Malware payload (RemcosRAT)", "value": "10a338066bab1f5d7e67a09d4ebb7a15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717229, "uuid": "7a4cc951-8bbe-4f3f-a739-f70c219af892", "comment": "Malware payload (RemcosRAT)", "value": "9e3c6d2f7b4a61b99f97c864da82a42d4e8ab8eacc729618172fbe44bf237155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717229, "uuid": "38a88ed5-9e4f-4324-a389-b11a2a7e24cf", "comment": "Malware payload (RemcosRAT)", "value": "87e22d423f4ca18c410f033f6c3d583b256b2db6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717229, "uuid": "c71947c3-d5b3-4599-857a-af7e60731626", "comment": "Malware payload (RemcosRAT)", "value": "1b8db519eb1f831ee9a501157a195785bc4ec99a36d8669cb1e7c9c973ae0f007f3d4c4edc916cc26db4f213532e508d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717229, "uuid": "50e762e8-6608-4cbd-9e99-dba76dcd4064", "value": "T1A1C41346D7D00063C98BAE76309247934BB0D20E5C924FDB9699F1190F6E3CAB64E9DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717229, "uuid": "ec53b92f-be6d-4fba-ae8b-91841e6e3023", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717229, "uuid": "acdd7e3b-d6b5-464b-a6b7-34b806e385a9", "value": "12288:FOkE5gVBa576QeasvLnnU0Wd8Oe2tzBydHKlGbhNIsB7:FnEIBaBe3wFe2tNsKlE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662717229, "uuid": "98a36f2c-3eea-416d-b65e-0e11e3231347", "value": 596832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662717229, "uuid": "d360bc31-d69b-4e8e-9935-d35140a9c05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717229, "uuid": "c2d6bc4c-edaf-4477-af80-2bc1287d46ff", "value": "SecuriteInfo.com.Win32.PWSX-gen.21616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba82491-3027-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662718326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718326, "uuid": "95ca8e8e-99cf-4000-87b7-9e2aa892037b", "comment": "Malware payload (RedLineStealer)", "value": "b2427feb2629cac3193874ad54e71ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718326, "uuid": "6ec011ed-e23f-4ce8-b879-e7a16ea43ae7", "comment": "Malware payload (RedLineStealer)", "value": "9ea6a9492a5d62161f14fbb77d7e0c5a8507d92a9fcbcc110cd0a3d867e61c68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718326, "uuid": "e55b4683-2ff3-4385-8225-1a73c09752dd", "comment": "Malware payload (RedLineStealer)", "value": "a6463de4ee739e351d9cb8622469f65b491ee0ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718326, "uuid": "4e43e6fc-379f-4111-b0d7-556f4fc2cd8c", "comment": "Malware payload (RedLineStealer)", "value": "7ff963b708dffcdebf42b9e7c610dffd8ec56421f07d52e1a6083f13ca9f562dcec13408a39376d11281dba4d4582263", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718326, "uuid": "a7070604-7de8-4ee2-b6dc-759388ed1cd8", "value": "T13C6523227A91C1B1E4B745B90DD5CA7C8E7931310B3665D3A6DE1E7AAE213D1B3302CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718326, "uuid": "6f61d283-7e68-4511-b462-b26cc511631b", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718326, "uuid": "a984b2be-a8f0-4292-b55c-b7c64d60524d", "value": "24576:Ik70TrcZm7tzhEbMJ09Zplnx5AsLQFDjqJxI7gkggZeJ+l71hZNveZUZph7FZ4g3:IkQTAZIz6uKDJx3Laqqlgal7DreZy1xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662718326, "uuid": "63a3f71b-70d2-48e8-bc96-01c78cd20894", "value": 1445376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662718326, "uuid": "26e77e9f-9fdd-400a-9ae1-1db52d0977e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718326, "uuid": "a3835811-07cf-4337-81d4-d872c4e55cc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434e4393-2fd4-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662682422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682422, "uuid": "10091409-fcb6-4f97-854c-0a3096ca3024", "comment": "Malware payload (Mirai)", "value": "41ff4c2a65bb2fa6ec1f463d36640f2d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682422, "uuid": "65950764-50ae-4f9b-a80f-c345f0055762", "comment": "Malware payload (Mirai)", "value": "9fe9fc1f50040b5a0604a947a3964627f18887e1bf1f8ca6e4e29757ea1fae8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682422, "uuid": "b11562e5-437a-4b2e-b697-5678410f470a", "comment": "Malware payload (Mirai)", "value": "e1d4a364e204f5c1edbc57f5736272fb18c74942", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682422, "uuid": "30dcf97e-71ac-4025-8f5b-50980637ee98", "comment": "Malware payload (Mirai)", "value": "920d6866aaffe04b7156243af2c98ac25941be0f68ce335f30f63d99b0c09bf14a5bb0a755793b2e0c4be2f7189d03ea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682422, "uuid": "26bc7519-c227-444f-9471-98c921d508a7", "value": "T1D7F2E1C1E184C772E6554E39AC37014B339D1B68C3FBD44BA0B50687BBE90CF5A97862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682422, "uuid": "474e9d3c-e8d6-42fc-8397-b8cc6f45a9ce", "value": "768:DZ/YoclZM3GvecCYg8rupzesIytX4Uj6c3Nq3UIlw:DyocTEpVMrupy92XYGaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662682422, "uuid": "c2365a95-0e4c-43f3-81b6-c7bee2b9b579", "value": 35236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662682422, "uuid": "9819d525-1740-4faf-9362-fcdc805e892d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682422, "uuid": "24082347-607d-4e3f-9a85-c366a90525b6", "value": "meihao.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d68f908-300a-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1662705739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705739, "uuid": "8d7cb3e9-4ad6-4177-a3f4-3d417908c427", "comment": "Malware payload (RecordBreaker)", "value": "91bfc26e68c3a47f51f9fc3b43765ba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705739, "uuid": "863cb4c5-ace6-4a71-8954-5c7e085313cc", "comment": "Malware payload (RecordBreaker)", "value": "a027bc1335ac781074822ce6092e3241a1177aafc27d14858677a4c7116a2c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705739, "uuid": "b4dcf329-3114-4aca-84ca-4199f02925ad", "comment": "Malware payload (RecordBreaker)", "value": "a22108b5c7aa245af29f2313d93b084f8bf922eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705739, "uuid": "f89d8f45-cf63-46e3-868d-e24f75c3f140", "comment": "Malware payload (RecordBreaker)", "value": "7316d68aa6fa3461cae58abaa1884785420b0c85c520fa12f034c44c280ccce183ef053f4660dc867f65faaef4781f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705739, "uuid": "401ac0fa-b056-4c52-9a8d-48c92b709ffc", "value": "T1FE24CF11B5D3C8B1CCE244304435E7E12EBEB8A25A25998B3F643B6F6E303D166B2757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705739, "uuid": "3e9078d8-888d-4efe-ae84-db4399c002d0", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705739, "uuid": "23235663-2abd-49b8-ab6f-e4082533ba4e", "value": "3072:JiPtjVY3ZFQYhzSHGlJcK74hcy9A57WW6J0vy2/vNop:4DQ1SmUhT9k7WWXvN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662705739, "uuid": "7fdd4857-14a4-4185-acf1-98221c4c12f3", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662705739, "uuid": "341c33dd-650b-4887-bbf1-5828e83c5c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705739, "uuid": "e1ab39e5-fccf-45e4-9e4e-2b52cc93d514", "value": "SecuriteInfo.com.Win32.RansomX-gen.19101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c69b87-303b-11ed-9266-42010a9c0072", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1662726857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726857, "uuid": "a72e80c5-a450-4f72-9ff0-709064314f00", "comment": "Malware payload (ErbiumStealer)", "value": "9c481583c1d15addba6b844161db1b56", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726857, "uuid": "0e9182de-7da1-4ef2-aa1b-268eab7a8ea1", "comment": "Malware payload (ErbiumStealer)", "value": "a0e1ca584a89fa14547b43ee47ecca4dca89a58a893e51a7eead5e46a11eca5a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726857, "uuid": "d5613eb0-c723-44c9-9309-9080e2413bfb", "comment": "Malware payload (ErbiumStealer)", "value": "8988df4078232d09c4014c8fcf276c5c7d9a1c14", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726857, "uuid": "f0d619f0-fb0c-44a4-b189-17f2cb5c2b8d", "comment": "Malware payload (ErbiumStealer)", "value": "3802ebe77cb9a41009dda7263a9baef1a7a324848d57a90138fb7b68d638f4396b4c68eaf18e01d2c729743d270db6bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726857, "uuid": "21cdbb87-47eb-4662-af66-157e8f4adfd6", "value": "T1CBD57D31EA569074DDC515B1D23D6FF36C389A245BB851F7EBE41CAAA5240C2333AB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726857, "uuid": "b6704a58-0e8e-4a05-8d11-618eadce7cd4", "value": "c0d46b7ff0e53996feb53e4ba78f033e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726857, "uuid": "1955c7a6-f2ba-4250-bc53-414d9d2df284", "value": "49152:HiEYw/IFUAu8m2O0qp+O7Obof0UCIOImB3pa4vAR1/d+c2oQ5hP58:X08OboFmNFAR1/d+soR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662726857, "uuid": "73d9c468-fc9c-4735-b7e3-a0962fbdef1f", "value": 2843648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662726857, "uuid": "be7954f1-0318-4f04-9acb-f325f82e496f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726857, "uuid": "70bcb3a9-ccc7-40a3-85be-23b096094d67", "value": "9c481583c1d15addba6b844161db1b56.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d98567-3036-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662724437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662724437, "uuid": "72603e8a-6a78-43ec-a8fa-ce1ac666f620", "comment": "Malware payload", "value": "91912001d91edaf58c788212ecc78c21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662724437, "uuid": "5c7c2493-2b26-4e77-bf27-09954518820c", "comment": "Malware payload", "value": "a23ded5b961507a0c9a7ee75e718c01f8245c9e9907e4dd0b191763de527b972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662724437, "uuid": "0635825c-ec64-4c82-a538-f94f396f0a0a", "comment": "Malware payload", "value": "8a0dadc0cf11fcd6167c8d55870e84e221306bd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662724437, "uuid": "e9f4e6c9-e147-4341-9e88-b69792c318a5", "comment": "Malware payload", "value": "96f7d687fe8ae356951d99e2c2a3ac7d8b50a035bbe6ebd048ff1f6b39363948492d2ad9a2cd61fdbecaaece4d2e250c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662724437, "uuid": "1eea834a-c6e7-4ea9-8bc4-87f6827eb4c8", "value": "T18024BE22B5D0E872C5E284705471DB912E7BBC622E3998CFB7943B6E1E712D02B75353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662724437, "uuid": "61430a39-fe4b-4b3d-92b1-affa4815b9d8", "value": "5d5b8d072fdd778d9ba9ec0c36bae15d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662724437, "uuid": "b3407038-2cb2-430b-ba47-77a188550d0b", "value": "3072:0uCJlHP+m/Njr5FJkc3Cv6+tqQ7Yo6N7rm7eX1cp4/Y9r6cHuLqI2:jm1XJz3fo2xvaeX1cpCY9r6cHuLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662724437, "uuid": "9f49e58c-c016-496c-a7fe-64208a047e34", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662724437, "uuid": "2e275432-b611-4843-828a-f38ef25a0dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662724437, "uuid": "74e75ed9-4a3a-487b-833a-dc55c0ba00cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f364f2-2fde-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662687014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687014, "uuid": "7e28f61a-0885-4e0d-87db-0f09d9f1d44d", "comment": "Malware payload (RedLineStealer)", "value": "c9438b10b5caed21c704bcc1bbad6674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687014, "uuid": "44b966c6-5c67-41c2-8d35-8ba2d9c53467", "comment": "Malware payload (RedLineStealer)", "value": "a29ccb6f91a6170af4d7405feec310345cee8ef98a198cf7f31f68533329d238", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687014, "uuid": "9e033631-7202-41db-ba96-3b95352447c2", "comment": "Malware payload (RedLineStealer)", "value": "4803804769dba4d83d6a3b249f9d5e87af0a0354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687014, "uuid": "8e5eef44-83ef-43bd-9584-de93a65d28af", "comment": "Malware payload (RedLineStealer)", "value": "2c7b735dfd925ed171d61095b261777d7ba1c8582ff162e12b2e9b475edc67a62b4ba0f3ef4f112c1ffd6cfe3e648dd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687014, "uuid": "57829194-fb1c-4d97-aa11-03ae4ab6074b", "value": "T1E5349E10BB50D035F1B752F8497A8368B93E7AB05B2495CBA2D566ED17387E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687014, "uuid": "75ff641d-9c35-442f-a9dc-1c9b2113f11f", "value": "457b43f14b11b6656241dbb61ca0b883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687014, "uuid": "0340ccb7-9702-4046-8b4b-554e88692b59", "value": "6144:enctVTD2xFZDJMn0tcLFHpkBvmSiibjju3zNuiT46ytDY:en8TI3DJ8iru3pxT4NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662687014, "uuid": "3ce2cd27-5bee-40e2-9355-6bdf2392b7a1", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662687014, "uuid": "434192f5-93f0-40fb-a3f6-929a5f5a2bb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687014, "uuid": "6f48af1d-96e9-4dc7-9bd5-1ca99cd559f9", "value": "c9438b10b5caed21c704bcc1bbad6674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b971c3-3002-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662702150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702150, "uuid": "220957ce-1537-4ca1-9b49-b9390964f35c", "comment": "Malware payload (Smoke Loader)", "value": "98588fbcf50d636b1eb5e398495a8f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702150, "uuid": "5be706ba-ba99-4fce-bb7a-28c70fabe150", "comment": "Malware payload (Smoke Loader)", "value": "a37080283b6b715823c036f2adb3b9a8f7051a52b03402156e4410a9b5363a6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702150, "uuid": "bbca96d5-32e6-4877-998c-49a834214d57", "comment": "Malware payload (Smoke Loader)", "value": "2ed832315e07f52010fae575c2a074defb864c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702150, "uuid": "99a7ae26-2e8e-4fc2-9c4c-ea1487868b73", "comment": "Malware payload (Smoke Loader)", "value": "6926ebd2dcf257c617e2e33d6bbac85603a002e2532fc19971ceae387f0f38d2ec2c32388bf28f767adfce9a46d14664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702150, "uuid": "2d9c865e-7942-4539-9a01-d729de7c0e71", "value": "T12D24BF11F5A1C871C0E345305431E6A52ABEBCE2EB38998F7B553BAE1E313D12676326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702150, "uuid": "d538366f-9664-461a-b300-cf24b09cfd7a", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702150, "uuid": "97916e22-8577-49dc-b1ce-c2686afd5a6f", "value": "3072:1Eagd23+wDvPG5picHJc9L27ujfSTDeUCsL9hTDD93rkfdv+dhPp:DvRjO5Aou7WeUF9h/D9Cdvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662702150, "uuid": "47d26f22-5d97-45cb-b242-9b8abf146684", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662702150, "uuid": "f91da7c3-d3a9-49ec-8fd6-59669ea417b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702150, "uuid": "a5f5f662-526b-44f5-9a9d-265912c12a49", "value": "SecuriteInfo.com.Win32.RansomX-gen.32177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13715708-302b-11ed-9266-42010a9c0072", "comment": "Malware payload (IRATA)", "timestamp": 1662719708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662719708, "uuid": "6ea4a89c-40d1-4a5a-94c9-e6633f456a0c", "comment": "Malware payload (IRATA)", "value": "3cb25b33fa771650cfdff4c544528381", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662719708, "uuid": "60505d99-c0ec-4980-adb9-74f0c449693e", "comment": "Malware payload (IRATA)", "value": "a3d3835cf139b1700c2d2145afc911b6fa9345f2ecd3259d85169f015a83dce5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662719708, "uuid": "c857b7e1-80eb-4e0b-ae98-c56f662eda3a", "comment": "Malware payload (IRATA)", "value": "5532291652b2c6a494e1248bb1530fcd36a4e6db", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662719708, "uuid": "4c732601-de98-498a-9e8e-a65b84ebb445", "comment": "Malware payload (IRATA)", "value": "36c70b397ad109e118485cc2972b88d001545c93078624d0bb4a46000f1e202ede0ad291bb0e67633aaf43225b6a3c22", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662719708, "uuid": "2e16b958-38b1-4bb9-92f0-e21245eec2ca", "value": "T152F52313F222966BC9F6D33622741635617B8D288B13FB4A2D5877BD28B7DC84F916C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662719708, "uuid": "3804074f-8be3-4171-b18d-6eff03b706a4", "value": "49152:q/1UjSHe5UQtHy1fffEcy317sc1x7B3l0ZL7ZhJqzdNlSx7i3CrgzwMmePm8D8pf:giE6efffnRcj7jGPJqzd7rCrgtm8OElU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662719708, "uuid": "74e7448e-251a-4218-beb9-5c2fe2f2efb9", "value": 3564453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662719708, "uuid": "2d99637e-a5b8-4cbd-8fd6-a5c8edc36e3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662719708, "uuid": "05ac1863-caf8-4da2-967c-f47f325df0d8", "value": "Live Sexy_signed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8e1d26-300e-11ed-9266-42010a9c0072", "comment": "Malware payload (Kutaki)", "timestamp": 1662707322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707322, "uuid": "f1b133f9-53ef-4b35-ab54-807e25c7f777", "comment": "Malware payload (Kutaki)", "value": "549dcf693379a2a4afa76bb321caff0b", "object_relation": "md5", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707322, "uuid": "0f7ad95e-73af-485e-b115-341c03b4c06b", "comment": "Malware payload (Kutaki)", "value": "a4ce28e86378c0ea7453ffd0fe06e738e014133d598845ab8c62d76b7dd26ef8", "object_relation": "sha256", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707322, "uuid": "f7092be8-1376-4316-b216-686fc5d6655e", "comment": "Malware payload (Kutaki)", "value": "4a31a8fe53d1c54f9064caa941a8872de1138c88", "object_relation": "sha1", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707322, "uuid": "92fd7f29-5c11-44a7-a864-308ec8719b8a", "comment": "Malware payload (Kutaki)", "value": "239243652671c7ce5079477ff9a561612f1e0ddfa7730a7e04ed2cc311f96d9969f467efe67a71c7a0880c7e575bdb71", "object_relation": "sha3-384", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707322, "uuid": "9b2ca708-9e5c-4a8d-beeb-e67cc526d2e5", "value": "T161742344D84D693D2D8164650A0375347E38FE8EA3770F16619ED8FA4B5B0A98F2CBB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707322, "uuid": "fa5fb8d8-4262-4f76-9b34-f0fa75623435", "value": "6144:zis8hbMKLBZ6EdLRW4Es+CSNw6svzOjSaR9K26odl0TZuwnDD0zgffC1aGJhCjdq:27bFvdVB4NYv6jf9KMa/DtC11uU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662707322, "uuid": "e8299906-88cc-4507-a241-871914849304", "value": 340007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662707322, "uuid": "96d4cea6-e65e-4b3f-b534-fa57be22e60f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707322, "uuid": "a76e2298-8d33-44fe-be0d-d4e08351b703", "value": "HDFC Tax Payment Attached_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eacac98-300a-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662705741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705741, "uuid": "ab8b5f4b-3c05-4760-9362-09f729b2d809", "comment": "Malware payload (Smoke Loader)", "value": "ff9266e869719458e29077e7136065fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705741, "uuid": "917e2328-2f36-4d75-8b57-d567d8b37906", "comment": "Malware payload (Smoke Loader)", "value": "a5e0d57d528b0ad1ef1beb1847df973ef95f3259e8439175de7972721b0194e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705741, "uuid": "56b030e6-fdb5-4dd9-8d8d-22c346aa1e4f", "comment": "Malware payload (Smoke Loader)", "value": "e4db76f020cc0250e56e1ca3f7df88cb6921c70c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705741, "uuid": "23c6af73-c87c-4848-8890-fe30420691e3", "comment": "Malware payload (Smoke Loader)", "value": "743d50da916d94ee6d83fa69b7dc11848f79e99da8d1f39f69f85ab50ed0a751ad7ea694eeb228796163197d7d8c571f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705741, "uuid": "fc51f7a8-dcee-4638-81ee-5d925d725598", "value": "T1F124CE11BAD2C471D4E285315074D6B86ABEF8626B3884CFB7A43B3E2F702D16776352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705741, "uuid": "c2ff4a59-8baa-41e6-b806-398a0734ebba", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705741, "uuid": "daefd540-42ee-4c52-b32c-685c0e5ffe90", "value": "3072:vDGYYOapc9zTOd65MxRrVFyA89KOn4dc7k5KFd:Zj9XWxJVd8994i7k5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662705741, "uuid": "d04cebfd-48e5-4e37-b62e-5718225c57a3", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662705741, "uuid": "1a5e6f76-2350-491a-ba97-cb1df51b2214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705741, "uuid": "271538e1-e1dc-4ee7-bebd-52718d706459", "value": "SecuriteInfo.com.W32.Ransom.QS.gen.Eldorado.28850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1771856-3011-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662708914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662708914, "uuid": "98c0e6bc-33f4-4329-81c0-df541da4705b", "comment": "Malware payload (RedLineStealer)", "value": "3fdf448f17f65a9677f6597c807060f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662708914, "uuid": "de8bc913-a0ec-4f74-a2ab-168a25d513c2", "comment": "Malware payload (RedLineStealer)", "value": "a7489fc37d4f0070ba0d94570784d7ca5b1a46b8ea4ffff1fc4a613c2cda77e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662708914, "uuid": "6e2d9182-370d-4472-a225-e5a449c09c91", "comment": "Malware payload (RedLineStealer)", "value": "762d6f52fde7394fd3dcecf9a9b91595a37e164d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662708914, "uuid": "cb16cbea-9116-46d4-8031-b5df3363a8a9", "comment": "Malware payload (RedLineStealer)", "value": "333c1f8de8b91adadc330abe8022e5653e5ae4ada6328d877d42e387286ac27ed90a6a3bb32ae9a27ece84ba7cfec53a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662708914, "uuid": "3a826019-8414-4db7-833c-f6e63102d754", "value": "T108355C29EB0729F0DA275772855EDB7B8718BA158023EF3FFF5BDA18A4330163885161", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662708914, "uuid": "efa9b8b7-cf42-4dec-ba58-fa4b774ca03a", "value": "1797ab721d550312b93ab992a1e04176", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662708914, "uuid": "a054c0a1-2aae-47af-9a0b-94b746a1741a", "value": "12288:lo0YAZ+OYfYwb2f7GqXz7nMOaf2zYDqyqvhKNv3tuDjZJ6Z1ZWZICT64SXHzU7jj:Ei+OYfY42f7GqnMlfmYrqvhKh3tuN/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662708914, "uuid": "d6c63357-3c06-481d-9ffd-83d50d9dbc47", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662708914, "uuid": "33ca055e-4fe3-4d07-a6f4-b38aa39a7482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662708914, "uuid": "2c752d4b-a7f4-4cf1-822b-ccc527946849", "value": "3fdf448f17f65a9677f6597c807060f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d040fb-2fd9-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1662684735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684735, "uuid": "07bbb146-288a-4fc2-adbc-5a052ee5618c", "comment": "Malware payload (RemcosRAT)", "value": "a046b77eae58dfe0971bae4966c3d6e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684735, "uuid": "7d1e5cf1-1406-4a8f-aadb-fe19d738715c", "comment": "Malware payload (RemcosRAT)", "value": "a9377ce657072c1a9f9e8b8d6b93104c0103810e20690aba6f3370778ead5f56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684735, "uuid": "97b633cb-f868-4d5a-8440-bc67e6f0ec5d", "comment": "Malware payload (RemcosRAT)", "value": "69c6e740d49f48eca0602faa7a660459b6b47434", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684735, "uuid": "c08884b3-43d3-4ad0-9455-a3a908640855", "comment": "Malware payload (RemcosRAT)", "value": "b5425a2f631d97ab2382e75ddb6158d66846a01a50a599118621107eccdbbdf0e5ab8d5aea7f43c572ee716f1c633177", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684735, "uuid": "7311df6b-f571-4154-bfc9-aa1410dfa8f7", "value": "T1DDA4AE02BAD2C072D57161344D2AE735DABDBC212835997BB3E61D5BFD30180A73A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684735, "uuid": "03af5e9a-e406-4002-b617-d00e66113414", "value": "5d354883fe6f15fcf48045037a99fb7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684735, "uuid": "d53ac5b0-2084-4e91-afd5-5ba3d8748864", "value": "12288:umnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSZn9:WiLJbpI7I2WhQqZ7Z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662684735, "uuid": "27c125d0-b54a-4b5f-89b3-b6d84ba8b7e3", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662684735, "uuid": "dde51462-3f6f-4e24-a610-f1e07cbae4a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684735, "uuid": "fabbcb39-ffe7-46f2-a924-86801765d64d", "value": "a046b77eae58dfe0971bae4966c3d6e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4cb5a4-306f-11ed-9266-42010a9c0072", "comment": "Malware payload (zgRAT)", "timestamp": 1662749310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749310, "uuid": "9426de11-b87b-4db6-8972-f0d10892c455", "comment": "Malware payload (zgRAT)", "value": "d163efc01b98f9041ce8a5dcc646bc13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749310, "uuid": "69f2bfe6-4392-4b90-99bf-b073d76d9633", "comment": "Malware payload (zgRAT)", "value": "aa5db1e76d992d81c9b6f368bc705f4240512bc4aa193cc23fa3ba50ce48d1fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749310, "uuid": "2a4acd5d-7169-4c08-a919-f0be7040c4c0", "comment": "Malware payload (zgRAT)", "value": "995262edd0ca8f5e29e52cbeed2b5b024c348061", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749310, "uuid": "182d44c6-be9b-4cb0-b4e6-179c50d52f12", "comment": "Malware payload (zgRAT)", "value": "81a2740521b5785daaaede06bbc1f6ace926bddac6883df86638efdf3c1356bb5d756dac4e3ac5adc4d6d24be8eb7c20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749310, "uuid": "5c058f3c-c5b2-4b92-82c1-90a58d2ab7fd", "value": "T1C5D330E2A6C5FFD3C1BB61305EE2361007639B49282682506BCC255F3B616DF3B85B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749310, "uuid": "3eab387e-8128-4bca-a6a7-ad82e17adb3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749310, "uuid": "0a64a766-3967-49c5-85dc-5aa93d23bfeb", "value": "1536:89l3qJGbWiEd66skCdBWAWVfh04l8ljRWcplgMPocPoJ4TGEWx4/2B:83aJg2iWAYfXcwz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662749310, "uuid": "2a56c967-8481-4eb4-948e-f4aaa2533f02", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662749310, "uuid": "ac26b268-eefc-47be-9728-b090df118f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749310, "uuid": "55c5dced-86d8-47c0-9b81-32f80c8d53c3", "value": "SecuriteInfo.com.Win32.Malware-gen.7466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472c7922-2fd4-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662682429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682429, "uuid": "4761e79b-bf3a-4c0a-ba76-6d345720ea4f", "comment": "Malware payload (Mirai)", "value": "2b4ec58ba070122c5e73d59e7adc92b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682429, "uuid": "721b426a-54ea-4659-a423-9b82494b9452", "comment": "Malware payload (Mirai)", "value": "ac9b5f32ca793b4cf9c33a586cf66167b9484f3fa00bc0c1641577ad69c4d0b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682429, "uuid": "4ec19380-5735-46d4-865c-4ff9ffecf1a3", "comment": "Malware payload (Mirai)", "value": "f5e4871f9f83255e192804f04251b3570394cd28", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682429, "uuid": "5f2f91ee-ff58-4b85-aa24-332d6560f053", "comment": "Malware payload (Mirai)", "value": "a8cbd7cebe0795caf19295b16b64d94e05facc367296de495bf16574a7c7b6cae685cd2862ce187f7350cc0f1301350b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682429, "uuid": "77fbd7c1-eb40-4922-b50f-06a582df4cb5", "value": "T1F6E2E19D468828D9DD6E1DBE9CCD07315E05F8D836CA9B8A23248D449F0DA16FB0A1ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682429, "uuid": "1a55eeee-43bb-4ad0-918d-fb168d1f80d9", "value": "768:1LGYPByXKjImyo/1e2ZtgRErbu6DbbX5N/Ppqm+ZWMb:1LXUamoM2Y0vj8m+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662682429, "uuid": "19987c88-88a3-472f-8abe-b4b9b151b6b7", "value": 33256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662682429, "uuid": "da665401-f252-46d0-a6c4-1e7545943525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682429, "uuid": "ac4ea4f3-878d-4843-919d-1f12449e5f0f", "value": "meihao.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1999fc7b-3058-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1662739046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739046, "uuid": "eb4b5d13-45af-49a9-bef7-9de9ad0631ef", "comment": "Malware payload (Loki)", "value": "c8082e4ab97d79f0843ad15225b1d4f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739046, "uuid": "d6bfee1f-25db-448f-87f3-bccf35ff6c82", "comment": "Malware payload (Loki)", "value": "acdc4a62f577a0392697bb667404f57acd1e265fc3029038d664b8810c121c70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739046, "uuid": "052c4c2c-3d91-4f75-9141-6a9da5a182aa", "comment": "Malware payload (Loki)", "value": "c558b32c413fe2bbe733ce8c48b9c57c4241a026", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739046, "uuid": "b94b75dc-401a-4638-bff9-8bf3411cfcee", "comment": "Malware payload (Loki)", "value": "032036ec4b429fcb360663fae601d9a59a3aba0e90d9967791a49a4a1e097367eacaf56aaefa7ee6709badfaf3569728", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739046, "uuid": "303b767a-fc33-4f2c-967a-8038d920634d", "value": "T197252B0B21D40994C87251F8A4CCC5734BA6DE45E637C949BFCA9CAFF5A2F2C42D27A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739046, "uuid": "dde0f75d-2d48-4f5e-8442-475f3214ceca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739046, "uuid": "66941b74-5b25-4830-993d-b862d4a83d7d", "value": "12288:LqAp41hw4e/ehLrz8OmbYrHN5KEWZXc38L9xihQTOe/d712S1hw4e/:jL4LJhm8ips38LKhQTZ/v294", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662739046, "uuid": "3b135e67-a343-407b-904e-c667b164dcbd", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662739046, "uuid": "4e71917b-d16f-4a67-ad8b-dbba62d607e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739046, "uuid": "04ce2cb9-d919-47a5-963f-ef0ab683af93", "value": "Bankslip_Copy_Scan0041_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02991168-3040-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662728699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728699, "uuid": "7894c3af-88ec-4cd8-a767-e764f0b9fede", "comment": "Malware payload", "value": "34e6d9336826a9330e585e01300a1c84", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728699, "uuid": "6c243218-cbbf-46a3-a576-1e719619f55f", "comment": "Malware payload", "value": "ad41c40723928b5456c57f913dd8d1dbb6d7eb8f273afdb1e0dd238076b4ad15", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728699, "uuid": "f4f27861-3b95-4b4e-bf93-d61f3b1ea155", "comment": "Malware payload", "value": "41c436b9cfb37911583eee97949b274f340f0a9d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728699, "uuid": "2feae1aa-462f-4b67-bffa-f8d80505efaf", "comment": "Malware payload", "value": "0ad311fadec01b86319110987b9dd2db73ce4a315abff1839efd5c19353019c2db99263fef0f68195ed6f40064865f3b", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728699, "uuid": "4ff56bea-1daa-488d-860f-a938d4d21f24", "value": "T151D19EE44101A228DC0EE564EDCD2C7146340564B76A8E516DCCEC3EF7CE62A19E4FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728699, "uuid": "88641eae-618c-43f7-a1d7-dcf051677060", "value": "192:l1bn6FnCp+j14tqLMqLnMGAqjagQ1o78/8pOAe:zpw144fLnxdjU1o78/8sAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662728699, "uuid": "5ef1a3e0-8809-4b6f-90ff-54ae46d64b5b", "value": 6350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662728699, "uuid": "ba12b0af-b289-4632-a937-8c99288ed30b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728699, "uuid": "f1bcb928-9f93-46d2-b277-c612b5c04eb3", "value": "Ordine CA-nr acquisto 4507506396.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22393049-302e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662721021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721021, "uuid": "70c4aed6-1c18-4e3e-832b-682344457fc4", "comment": "Malware payload (Mirai)", "value": "48777d34f4332142bae48a45ebe3e36a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721021, "uuid": "1feed7ae-7d26-40a7-b9cb-b198bb207a7e", "comment": "Malware payload (Mirai)", "value": "ad467ef26bd6ab3d358bfd9ec6a00989e6ed613e040cfe6add5ce005cf7effea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721021, "uuid": "92f03114-1cd4-4e0c-ada0-528838bcb464", "comment": "Malware payload (Mirai)", "value": "1e7cbcc21ad6c6988a35d65cd11529f763b4419a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721021, "uuid": "f6d54c2f-0e25-444f-8cfc-27ae24be1327", "comment": "Malware payload (Mirai)", "value": "09f718ebdeca76c34613770584ea1bba849e9a6b92737b69d3a03dd8a055e3a5f0f1780dc2e3a8bc6e2b5b40a9faea09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721021, "uuid": "91736f93-90d8-4cf2-9f9a-285aa56f9b9a", "value": "T1DA634AAAB800DD7DF80BE77B8417490AB631A3A515830F37639BFD53BD321A44D26E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721021, "uuid": "97a173e7-bce0-4ffc-a604-21db11772348", "value": "1536:O6u0szoono9lYMqLoYgB81AArzAfXO2NMYfTf1R/yP:zTszo32tcYgxAIXzNpnyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662721021, "uuid": "9a2a57cc-f832-4a36-94bd-d7e4df2337c2", "value": 68976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662721021, "uuid": "20a89dad-70de-4f77-8aef-db8795f5561b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721021, "uuid": "b8ed990e-386b-4b2d-9b92-b6583e3db53c", "value": "48777d34f4332142bae48a45ebe3e36a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa50ca3-3038-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662725277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725277, "uuid": "08783682-93a4-4523-ac51-64a1f6fdeeb2", "comment": "Malware payload", "value": "c7548eec3e9c95bad4a15635eef9128e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725277, "uuid": "54241ad8-b3ea-4d5a-b412-6d8388a93c86", "comment": "Malware payload", "value": "ae301418779cda32b8bec10741c30094ee0615e81ec1d91dea3e940fde982fe0", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725277, "uuid": "4e463893-ebb9-4f2a-a26d-ec678e3bb938", "comment": "Malware payload", "value": "03fb4c3a07c5d3b00a4b0cf3cc204ae6895da5f6", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725277, "uuid": "4c0d86d1-e58c-424c-8185-fc6f20e4847b", "comment": "Malware payload", "value": "59bfd09bc9392eb708e10f2c1ac6103880bca71d177cc0ded861c9f8137687423422f581c825e0f3675efdcf74f3d9e8", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725277, "uuid": "4be39d61-11f0-4a46-9af4-2e1724172c7b", "value": "T18BE2C072797E6899C6AD4A3E401A06F4FA2DC01DC391E78FEB18D76C0F41C651A9A70F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725277, "uuid": "88b76a86-4333-4c23-9cd8-d161bb04d0f8", "value": "768:nIf+rb17fL4aJnH29eA/DEEE3RQtuYrkrEU4FvCFwg:nIWrb1d4VtVgIBvCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662725277, "uuid": "41a6e33d-7ee1-451a-ab48-5c8edf9aa6a8", "value": 31861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662725277, "uuid": "97397bab-15b6-48ec-b03c-f2e51f051da7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725277, "uuid": "012db952-a8b9-4470-8fe1-c31f24f3f676", "value": "SecuriteInfo.com.Trojan.GenericKD.61878187.17961.19103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9642b7-3046-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662731563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731563, "uuid": "a0aa75ed-f0ea-4a92-808a-f15fe707230e", "comment": "Malware payload", "value": "a1afc80eda4040b89393b6fb4b080f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731563, "uuid": "6bd3d409-a607-4ebe-b340-097c26663c29", "comment": "Malware payload", "value": "ae5b79157725bbacf7138beacbb877a5144a3e5818232b5949032941df21f7a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731563, "uuid": "bf048e2b-faf2-4ccc-b56a-94410cbb0b76", "comment": "Malware payload", "value": "dff7f1e37e7c72e19221d4318777b48bfcd8729e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662731563, "uuid": "203ca8ad-7d09-40a0-925c-dc4d7af5ae3b", "comment": "Malware payload", "value": "ede5649cda1f6e2f3e98bb19c257009432b05b82c57f3d849c3f25caf11f4280a0c6d49826476feddb0603fb5d4529da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731563, "uuid": "b5a9ced6-9ac7-4728-9e94-e7411f109888", "value": "T17B940A2D2A630B62FC1ED1B0C5018A04BB660F537382A9C25FDBB6C5976EDEDED158C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731563, "uuid": "2857cd9a-7142-4287-a5ab-f7706b45a5cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731563, "uuid": "eefdb0f2-26f8-4b50-a46e-effd06dcd04b", "value": "6144:Mge7cTyqfnHwI97P8+3yo/xQtq6wgs3aV9OYMPGzsJu:Mge7cTlvQI97E+3jpU3sKrpfAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662731563, "uuid": "d3ce6200-ddb0-4724-bbf8-34397b7bcba0", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662731563, "uuid": "43ee7de3-7868-41f0-a1b6-51580c8e7c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662731563, "uuid": "e6a5dc3c-db53-45bd-b9c1-759454efdfc9", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.22893.15357.6602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d449dd1-2fe3-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662688989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662688989, "uuid": "14845b05-b2fd-43b0-8129-227d5bdf26cc", "comment": "Malware payload (Smoke Loader)", "value": "85f88a3eb2f650dfb5cf82b9041e6680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662688989, "uuid": "6c75eb40-e758-43af-bf21-d55fe2c5f3fc", "comment": "Malware payload (Smoke Loader)", "value": "aed3a06c9acb44139ec7939fed7272df38295c884c42ae612b68f866cfba5a7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662688989, "uuid": "3a74f26a-68a5-488b-8218-5325bc69fdd2", "comment": "Malware payload (Smoke Loader)", "value": "71c49521b805ebee52a321bfa6a513d103e77386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662688989, "uuid": "1f9e7802-6d33-4cb4-a524-9002f687bf1b", "comment": "Malware payload (Smoke Loader)", "value": "9119f82522d99b6746ba7c10ef9aa29969024e4cae196ed4d34471e732c05fc0760aef1d5f182c8e568c044e8b9be84a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662688989, "uuid": "ff3f5da8-94c1-4d66-aeb1-344d7c6a5720", "value": "T14C24CF11B9D0CC31E6F244308034DAA5AEBBBC625A36858B7B543B6F1E323E15776367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662688989, "uuid": "07c1f175-4145-4716-83b8-ba38dbeda8c3", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662688989, "uuid": "f0ccee4e-f4ed-4945-ab8b-45e1391bcc01", "value": "3072:hHttdZ8beJ3EwpuS4WNJcHJTLDn2DXjr/4uPvgIfWm3rUOmTaxzByp:LNz7puS4W+TXn2DXjD4uYIOmAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662688989, "uuid": "58be3f26-1d1b-4e80-a201-c85e96ad3c99", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662688989, "uuid": "8523537c-3335-492f-838e-76b5e33da53c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662688989, "uuid": "5c802b1b-14fe-42a6-9d02-c4b2383bb4d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00c343b-3055-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662738037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738037, "uuid": "e303a059-4600-4679-9f9e-c610b02d0b70", "comment": "Malware payload (Mirai)", "value": "e87a28f90d3e1630699840f01f3ad9a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738037, "uuid": "1d497d07-1673-4daf-9ac5-6d0781b19b97", "comment": "Malware payload (Mirai)", "value": "af4b75a9ce67f2a1fa883e02b310e74c3ffdec0d5ec89885deee7937cb3dcb19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738037, "uuid": "c456e67b-3872-4e3e-bf19-97dbc454cf61", "comment": "Malware payload (Mirai)", "value": "20370d72baf088d77fcea3c9d99fc3170b3896a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738037, "uuid": "75cc4ffb-b010-45fb-9ca4-295dd2beaa4c", "comment": "Malware payload (Mirai)", "value": "6963bb580114f3c841f4a026b1f6e1c5223ccdb97f2c75bc3abb7eb50fa0f7104fd784189cb13ea7bfab2c1b2cf02b57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738037, "uuid": "011e7ab5-90ac-4f45-abbd-3b8fdd0f6630", "value": "T1E5430258D22AB961DFB0103ADA742609AFE9EC40D8FC717AB10C1785B191BE7D07F6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738037, "uuid": "00adc716-f19c-4ef8-bd46-c629a9095031", "value": "1536:hQXiFrCnKzb2sKQLGUPBi+5yjon7qYZyx:hQyFrCnKXKQLLkiAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662738037, "uuid": "ee60aca4-8440-403e-980b-4a0c0fa79614", "value": 57860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662738037, "uuid": "66e9b169-d662-49b6-9966-6aa40601c5a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738037, "uuid": "117a43b2-ce0a-4ca1-9cc5-baf96d8a7b4e", "value": "e87a28f90d3e1630699840f01f3ad9a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aaa7877-303f-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1662728418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728418, "uuid": "d97fd2dc-b80a-4be2-ae98-60de4f941ad2", "comment": "Malware payload (AsyncRAT)", "value": "c5da839b1c6505b50f9d18588bc29dcc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728418, "uuid": "f7f8719b-ca20-4daa-ba80-7522c9c758be", "comment": "Malware payload (AsyncRAT)", "value": "af51aadc7d93eea0355ed2605959052333a0e124753ff5df78d16bcbf5031fbe", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728418, "uuid": "e6b2bd10-687e-4b3a-ac31-e7cc75b8d416", "comment": "Malware payload (AsyncRAT)", "value": "808bcb8114f6188448b06ef581965e6ee09d4562", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662728418, "uuid": "c02aff7f-0b73-413e-91cc-6f8bc7007d0f", "comment": "Malware payload (AsyncRAT)", "value": "9f2d94b983fd37059689626d13594a5cd9bc7d774748990a524ead82128245909bb94ff00d2ad691c81d0094a4a6e49d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728418, "uuid": "e70fcc37-ebee-4963-b6a7-74ab727fc504", "value": "T15625070336924DA1D17652B890CDC0728BB59E45E53FC647BFC98CEBF182F6956C23A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728418, "uuid": "8cb4915c-5bae-438e-93f5-dae228ee6190", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728418, "uuid": "9683e82b-4123-4b0e-aaba-a91835d79c88", "value": "12288:7SDJuxq0TA5FCxv2eP0Kla6EMAXmnSBY5eUk4MVYolDfyWEYjms8hV:7S9RK4i0p9r2iYDcmy3qs8hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662728418, "uuid": "bd0f0a1e-83d3-4718-9569-e401d1260650", "value": 1051648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662728418, "uuid": "d5d99066-a204-4145-b053-b8cc3f8aae40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662728418, "uuid": "954030a3-2ada-46dc-9b50-4b9e10b6460d", "value": "ScanCopy378493rh1.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8956aafb-2fdf-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1662687264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687264, "uuid": "640516c1-97c7-450c-adb9-f82f2622ab04", "comment": "Malware payload (CoinMiner)", "value": "1a025bdee360170e570a133330f7c71e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687264, "uuid": "8ae42fb3-ef9e-42e0-ba91-3beb23bca418", "comment": "Malware payload (CoinMiner)", "value": "afa216fa5a5f2a4fcf32d1ff932166afe668941d0f9625bb11f80fde6a693bd1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687264, "uuid": "1c41a289-2d5b-4bcc-baa9-19b81cd26e9d", "comment": "Malware payload (CoinMiner)", "value": "df3e2d94f296026cd6964915b084884fc8589e7e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687264, "uuid": "e3e1cd25-696a-4029-9a55-90852038d194", "comment": "Malware payload (CoinMiner)", "value": "31a1eb73e67751d8668dea57b1e1af6c956522d908fde9fdc385c74e3b6bba763d7ae9a279eaba30663f63b7d49fa1c2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687264, "uuid": "5b7bd3a5-5d5e-46a2-9085-6735fe81da1d", "value": "T13A24BF12B9B0D571C5A24C304471E7E129FFB8626A34854F7B683B6F2E343D166B932B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687264, "uuid": "6613e921-72b3-4da8-9f74-1e93fc98a5a7", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687264, "uuid": "bf13cea4-395a-4016-a97e-751e495a8975", "value": "3072:eGI+w/6qUrqOVWJcr2AJ+SiFKV3aqFq51A6UrL9P83qTcKp:s5ArPVT2AQxFKV3aAg29P8Gc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662687264, "uuid": "6b0312e3-b4bf-484e-a258-2640e84dd289", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662687264, "uuid": "475c8b55-4c63-4236-8380-625c02f8425d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687264, "uuid": "f0e213e9-c023-4e94-bf98-524717716343", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a873c82a-3026-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1662717811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717811, "uuid": "e34874b8-b87c-4697-adb7-a5cceb05f67c", "comment": "Malware payload (GuLoader)", "value": "84f0b4cbfae914858f6fd3fe1242485d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717811, "uuid": "f9855589-a176-4c96-8bfa-b524c85802b9", "comment": "Malware payload (GuLoader)", "value": "b0046ffc09cb5b4ca591ea14a82b6208cba4501d8479c7e5897915c92d970fe8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717811, "uuid": "f821efbf-b1da-416f-a2ce-1092c04bcc4e", "comment": "Malware payload (GuLoader)", "value": "8704715d5604cbb605f7835e3343def83445fdd5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717811, "uuid": "af077f9a-d101-4a70-ab44-7184c92078f6", "comment": "Malware payload (GuLoader)", "value": "ce1647c6862bca01ecc98e2b59286a5ed1d8930f64d0eca9131d05450514a16301dd0eb5a7b5f3c31ef45bd7a45d6764", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717811, "uuid": "8923c264-338f-40f7-b64a-fe3248b03712", "value": "T15DE33FF76DB2E8E8B77CB3BCE0518B1E9848851247E6151CE42904A5BBD4340A7B53FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717811, "uuid": "26324d90-020a-419e-8534-f7c6b7830cbe", "value": "3072:IRgKfRWzI89JzuXNld1VpIVJBYcs4BLOgoRDLG:9gQISJzuXvJWLYcs4BLoR/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662717811, "uuid": "3910bbd3-ecfb-4980-928c-a4d7752254db", "value": 146626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662717811, "uuid": "315e81f0-952e-4e24-aed8-44190441cab7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717811, "uuid": "e2416b9e-558a-466b-bcc0-f7da0f68d662", "value": "INVOICE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db45f1ed-3064-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662744525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744525, "uuid": "1b828dad-be11-4487-896b-f50f71255d0a", "comment": "Malware payload (Mirai)", "value": "c1e8c492ab54ef0d1f6842817775bd83", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744525, "uuid": "9c319cc9-2d12-4e9b-96e3-97387a2a85cb", "comment": "Malware payload (Mirai)", "value": "b07c58b9b04880518e754b3d62632bbb7b68cb0213edf29f20b191c267f281e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744525, "uuid": "57f69132-ea5e-424a-b523-07449f762a65", "comment": "Malware payload (Mirai)", "value": "24bfc3f4c083da33e16260fa6614bb449735b891", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744525, "uuid": "f9e8a3d9-e5ba-4331-93da-67bf5a1c7013", "comment": "Malware payload (Mirai)", "value": "11afb9764f21998830ddf9b55451c1c3c769a1750ce292647d8b1db685d0426c5225d50036d2059644de06eb95f1131e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744525, "uuid": "489a000b-714c-4fba-bbd6-413fd678b9d3", "value": "T1B6131A96F8C18B2AC6D1167AF66FA95C3320A3E8C3CF7303CD645B51769601B1EA7E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744525, "uuid": "3da583b5-ae62-426e-b53e-dd7399cdcd6b", "value": "768:oOAH2F2NbBx99FJJPuzTDyQuCc+BgNE1ko52GRePRt5O6vrGD+kOdNfwbZ010U57:ofO2F3FJJPuTcjNE18GRuRt5Oi8tb+1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662744525, "uuid": "5a6b928a-42ae-44c5-aa96-f82ce29f58da", "value": 44648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662744525, "uuid": "153a7053-083e-49a9-9c48-93a9277cb5cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744525, "uuid": "c8eddc64-644a-4172-9164-cae7de751f75", "value": "botx.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1c7b70-308a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662760656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760656, "uuid": "e9870de2-bee0-42d1-b5ac-49fcacd8927d", "comment": "Malware payload", "value": "67cbcccada15466e59a6572dcecbea1c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760656, "uuid": "83dd8491-443f-4c1e-87c2-cffc286a08c9", "comment": "Malware payload", "value": "b2c0d9d044cbc547c4bc0e46f0034e48edc62270b7ca6613de5ebb014d8d542f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760656, "uuid": "1266e793-c791-4856-b379-ebca9d03980e", "comment": "Malware payload", "value": "580046e09ab51c5957624964ade1aea8fa6227ce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760656, "uuid": "b21ee2da-84d0-4e79-bf63-cfe100c5b305", "comment": "Malware payload", "value": "32504c6462f4b7659e3ca33ad34ffbbc88b02a446449a9017622fcc89feefd0f64cf8bf74236e6329a0061b4a3144b5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760656, "uuid": "837511f3-a48e-4e7a-bc33-b627939cc972", "value": "T1AC92E1E499C0C6F3DEA026B6F4F5C6CE722CC77CA832309C6A50436D66C66815AFD493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760656, "uuid": "306a9f15-a808-4236-a273-8b45ea7b0cce", "value": "384:gOSNzzWH/XE5a1dXuvz50o+gy8fxms2OfRg9nLLWVK8s3UTKHZCmdGU5EwDw:gOUCHs5GX+6/78fxp2KsLss34Ko3UbDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662760656, "uuid": "daeafdca-e3d0-455e-a0e3-9cb447c64fef", "value": 21140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662760656, "uuid": "fcf75c43-2ff2-4b0e-a606-2d0f07f0c14f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760656, "uuid": "a2a99df8-fab9-4428-8c11-0c7c9f0bc9a4", "value": "yakuza.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de594adf-3064-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662744530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744530, "uuid": "0b7b192f-df04-4775-8708-5a59d88fdc21", "comment": "Malware payload (Mirai)", "value": "38ac52c0f5d5ea322fc08634c49813ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744530, "uuid": "6986a750-0947-48bd-a587-d8e648f34d5a", "comment": "Malware payload (Mirai)", "value": "b32d590b0e2ad2b52161cac75a7a664672ba7f38e68d0a4b20a5d9c40076ec52", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744530, "uuid": "30b9023f-41ac-4aae-ab47-16a12eaf56a7", "comment": "Malware payload (Mirai)", "value": "79a5052651be5c150161575232832644a6783c09", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744530, "uuid": "d3a3c6d1-ae3e-4be5-9c4f-622a47be8a26", "comment": "Malware payload (Mirai)", "value": "5873ae9a66efd7fffb906d7cb14b40c20f3dbeaf995fb962aa738fad7e7b2c36f936d8f2796556ac8129b6ef53224749", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744530, "uuid": "6c96f881-7151-4fba-8d35-cee3f042e936", "value": "T120434995F8818A12C1D112BBFA2E958D3B2563E8D2DF72039E301F6137CB82B1E67D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744530, "uuid": "f5d49eef-b095-4e12-8fe2-2f4c3c4eb899", "value": "1536:lVd0KkAV/j+AzXxGfRuQt52a8PX5Sb+10m5j:lVdxj+gMZXb2a8hSe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662744530, "uuid": "dee9201e-ac0d-44f5-9b02-4b64aa5e804f", "value": 55688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662744530, "uuid": "c81fa56e-0388-4e18-aa87-9bb962bdfd4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744530, "uuid": "9bf9ec1f-1da6-4fc0-bbba-1be8702a0d41", "value": "botx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538fb622-2fdb-11ed-9266-42010a9c0072", "comment": "Malware payload (CobaltStrike)", "timestamp": 1662685456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685456, "uuid": "08ab58e0-9f30-4be8-9c88-8f5f32d2ee7a", "comment": "Malware payload (CobaltStrike)", "value": "1e5808299675e52756d0f927793bb83a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685456, "uuid": "a1c0c9a3-2e20-40ed-8930-2486540b2fca", "comment": "Malware payload (CobaltStrike)", "value": "b50fe48e61eafa150652f36c7b619ebc13145bedd19f78d4c4250085c960d2d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685456, "uuid": "ab461758-9fdb-4770-a031-4f484b5e1789", "comment": "Malware payload (CobaltStrike)", "value": "8cb4a37b60609aee7fb616ea74442c95f53aa610", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685456, "uuid": "31143358-74f0-4549-becd-5151dc877c04", "comment": "Malware payload (CobaltStrike)", "value": "c8ec3ae6e31882243a6a2946d38c6520cbfdf2d3d39cfe39033e85d586c5ffd30221ad304cca6eee3c2cec1c13227553", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685456, "uuid": "6f78b82b-1802-49eb-8b43-37260a7fa0fe", "value": "T137521935EB0378F2FD1A497414EBBABFAE73E2134C205CD5CF94ED4558234AA980664D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685456, "uuid": "3d765c05-f668-4d32-8d4f-8ba8107d59e5", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685456, "uuid": "12955f61-2faa-4360-94c9-658c3b3443f5", "value": "192:pHCugRK83SxHn2OQ/dmBI4KBPwgir+xzSFN8NFpgZbqUqV/Qjo7AGa:hCxRKqbOCdWIVBPk+xzhofCXAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662685456, "uuid": "33c248b7-fd07-46e7-8178-7967fd8a9432", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662685456, "uuid": "01b00a68-1bc2-4423-9569-e49186d40830", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685456, "uuid": "1ded66b0-fd87-43ab-90fb-4b8e1ad70ed1", "value": "1e5808299675e52756d0f927793bb83a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffc564d-307c-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662754518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754518, "uuid": "6473121b-c2ba-4c14-9d7e-ac250cfde428", "comment": "Malware payload (RedLineStealer)", "value": "327c4866682df9566e7f6379bc3af70d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754518, "uuid": "92442c1e-918b-4e06-bb36-31ddff2ef5a9", "comment": "Malware payload (RedLineStealer)", "value": "b534f2d22a5f8a0e2acfdb77bc21e3c13172725a4bb9a8a1e22cf89dfb16a727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754518, "uuid": "7e97b4d3-27cf-4aff-ac1b-128ce38e5658", "comment": "Malware payload (RedLineStealer)", "value": "a30b624bd413bfe0910f13ce2fd274e7f913ad3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754518, "uuid": "5b9f470b-56e0-4a0a-b4a6-724057537535", "comment": "Malware payload (RedLineStealer)", "value": "f73d76099003fc5b620561c6fb514483aa9e32658b43e0ec35f4dcebb6fde7c02c1829024dc5c7584bb7fbbe8cac3fa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754518, "uuid": "3a7fd619-5e79-4398-b365-11686dc580ec", "value": "T1C224CF12F5D0D872E0E685304031D7E66A7FBC626A34894B7B9C3B6E6F302D16A76353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754518, "uuid": "d08c534d-aee0-4e3d-8968-7da653ffef92", "value": "8214eaa7808ae504d4e701b905d3948e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754518, "uuid": "e44666c7-be08-40cb-a5db-f90eb2b8f6a9", "value": "3072:L9e9dMs/bBjUOTc5CXOEfJoUQgCTB2o4QFBKRZZ/Pj:KbBwOXdJXAKRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662754518, "uuid": "64083b39-6b06-44fc-a625-1f51497412af", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662754518, "uuid": "254ead00-1d0f-402d-a982-6993afe81e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754518, "uuid": "3404b196-5598-4d76-a781-27a6c8b30322", "value": "327c4866682df9566e7f6379bc3af70d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6013f55e-3030-11ed-9266-42010a9c0072", "comment": "Malware payload (zgRAT)", "timestamp": 1662721984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721984, "uuid": "ae2b0409-a068-4f8d-a725-ad42c27356b2", "comment": "Malware payload (zgRAT)", "value": "05ce4e77d80ea6e40ee05dcd06b7d2dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721984, "uuid": "19547dd3-5d06-40bb-8791-bc64cdc2f928", "comment": "Malware payload (zgRAT)", "value": "b541c7be67db127dfc53c8b8830d80d99a7389b1b40815057a4f4cdb64f37691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721984, "uuid": "06aa9e9d-b644-452b-8bcf-563c52486112", "comment": "Malware payload (zgRAT)", "value": "e37a6637c8423c138729eea2f8d9db35f3495835", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662721984, "uuid": "c1808678-2bc6-4c07-befd-e7dd7e71d401", "comment": "Malware payload (zgRAT)", "value": "69d87390fc56c0540835d4e3c0d5196d90f50141729ee581774a4638125a13d6e917f75ccf707bad0644fb8cc6d112ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721984, "uuid": "02866f87-2dab-4f8b-af6b-cb9d2283a85f", "value": "T1A715F1CEBB1D6AE6C261583FD5E4F1310DB4387C19338CF09F4165AE6D0A7824A7A94B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721984, "uuid": "a3320b21-02a6-4139-89fa-c873fe0e7b83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721984, "uuid": "45c9e156-cade-4820-a6e4-bbaca39949e6", "value": "24576:lQHPHmpWVsg860vjQRDBD7DrubBeoRxVS9mBgkJy:w/ffDBXubBeUxVS9Hkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662721984, "uuid": "74819f5c-f891-49f3-8241-4e3b95f334de", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662721984, "uuid": "7e82ce7d-a3e6-4e4b-ad1a-fac17c4674c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662721984, "uuid": "92aac62b-378a-4fe2-9199-0a6edda8224a", "value": "SecuriteInfo.com.Trojan.Mardom.MN.9.27020.2982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9808145a-300f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662707905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707905, "uuid": "859161f4-12a3-42e2-a964-256ad0407b45", "comment": "Malware payload", "value": "0236b18914be25ed939e6216e2265633", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707905, "uuid": "5956ffc4-ef92-4fdd-89fd-ea6fd9302a91", "comment": "Malware payload", "value": "b8f641be717ef41733d3adecfe9c4c1d79303ae676c9e9bab4fd490d7f360356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707905, "uuid": "343699da-5777-42ee-b700-501efe9ec6b6", "comment": "Malware payload", "value": "4bece5f3d3850640d9575153ca5ba0a1b1e01083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662707905, "uuid": "0e66ea7f-7ac2-4258-aa43-c6a0603ebeb6", "comment": "Malware payload", "value": "1cfc7e61fd1b646431c83c04bd3f18d096fa0f126f2e705f035b8a91ec49e9945203b681e830eb556571a81c877075f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707905, "uuid": "7282be0c-d0f8-46ee-84b1-aefac7da41ca", "value": "T16734FEC05148B8EAD1572A706C3BEEB1052FBFF9232095083A0777679973E56266FC4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707905, "uuid": "05cae7ca-90b2-4250-9736-0140ecdfe90c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707905, "uuid": "f81c82b3-09fb-4a25-887f-19ea946e8cad", "value": "3072:qy/T7gqPHIvuvHQFpaIYkKEPIFJzE17vtK:T5VHsaIYkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662707905, "uuid": "dab8842e-20a7-4029-850d-870314789970", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662707905, "uuid": "8b3aa335-1d13-4043-9c8b-af1cd2a61ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662707905, "uuid": "fd78659f-fa4b-42d0-b9d9-68ca99d47f69", "value": "Statement Of Account_08092022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6edbf8-300a-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662705743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705743, "uuid": "518bd2af-a68d-4781-b5f4-4f2ff8a85c4d", "comment": "Malware payload (Smoke Loader)", "value": "add7937f407111976de44803d11a3ff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705743, "uuid": "a8253627-bda3-42d8-a0e1-226b0505e32e", "comment": "Malware payload (Smoke Loader)", "value": "bb0953eb20424f6c78f462973cbb6848157bf87f51fd55ced0ddd3b9ef78595d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705743, "uuid": "ab313721-bdc0-4650-aa8e-a1b062017c9b", "comment": "Malware payload (Smoke Loader)", "value": "ad9eb2ab8df111a1fe1352dad381d8b44df7a230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662705743, "uuid": "76e3aa8f-bf0c-49c7-9d88-2f5932d78e68", "comment": "Malware payload (Smoke Loader)", "value": "13e07eb18907330166cd2c673bfb42a75221975774c08476674c29b87921254612a527baf733f3edfe56258dc077d34f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705743, "uuid": "f1d2ea3a-8b56-412d-8ca7-1aa7e3cfe489", "value": "T1BB24CF117990C7F1C4F285307036DBA06ABBB86E6B38454B37643B6E6E3C2D166B531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705743, "uuid": "08cabc4d-38de-4b4c-b3a6-bc1a75b44068", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705743, "uuid": "3fdb8333-0b04-4f58-a23f-b1581dfd2070", "value": "3072:1QtsUkIhVwzeQx1hJc7jyS+6EZa2rVV23ljhWsCawxdb/jQp:78oiQx1iGhJrVVslTWb/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662705743, "uuid": "a8489dec-b831-40d2-ada2-3387e0ad7a7b", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662705743, "uuid": "6020f19a-a551-4a52-9359-48fe892ee23d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662705743, "uuid": "8c1f827d-9932-4835-997b-53852fd1c4e2", "value": "SecuriteInfo.com.Win32.RansomX-gen.3814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6c92b2-304b-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1662733517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733517, "uuid": "4fe077ee-0cbd-4446-a801-409dfd6a8939", "comment": "Malware payload (ArkeiStealer)", "value": "0c5386837fe7307fa22835e8ef2a8ecc", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733517, "uuid": "115e50fe-7652-450a-a495-44a75119632b", "comment": "Malware payload (ArkeiStealer)", "value": "bba622f07411673517d523dbc455aaac235c556619a15fd9878a9b8ec560c6d7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733517, "uuid": "8c784848-147f-438a-bc45-1638dae79d30", "comment": "Malware payload (ArkeiStealer)", "value": "a6030f82e42fa269006551c1c25f37811140f280", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662733517, "uuid": "a2e08ed1-c1c1-42d9-ab4a-efbcf0079ec3", "comment": "Malware payload (ArkeiStealer)", "value": "6d27b2c39a310763606d6c7d5b6a7807626d28fd6234188d9c0a2676b28f5c82a0a315207ce24f400431fff88f129ebd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733517, "uuid": "11ba4455-b356-47d6-a0a4-6e8b10513e07", "value": "T11324CF22B1D0E471C8A245309474D7A43A7FBCA6AB2C588B775437EF2E703E16A76316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733517, "uuid": "01cc306b-778a-4411-8591-c3d0b988a43e", "value": "9ec19ad11da368328b1ef380c14dc8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733517, "uuid": "2b6c03ec-4bdd-4c7c-9bab-986e47d390aa", "value": "3072:SEdaxh8HgubrL5HaMZc50e7aJL+gykXx2lC7qVQ3dqSc:7DgikMZ87+uk4lVVwYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662733517, "uuid": "1d4fd9d9-66a5-4966-bb47-4c69fa54680e", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662733517, "uuid": "9bc90364-7d25-45d6-8911-fafebf8d5697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662733517, "uuid": "517eba64-1718-4dd7-9ef9-a66b61d09e9d", "value": "0c5386837fe7307fa22835e8ef2a8ecc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64cf5d1-3069-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662746583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746583, "uuid": "edbc326e-65d5-4316-a838-58354a9b2174", "comment": "Malware payload (Mirai)", "value": "b54fdcd4497ba7ec338d5df56a64f621", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746583, "uuid": "adfd1349-6c7c-481b-9882-2cf07bee0f49", "comment": "Malware payload (Mirai)", "value": "bc120ef4cc170070af04bb74d0a6623d60542231ce8cb804022505049eb89b74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746583, "uuid": "621b3f4a-8178-4151-8260-12e70a91f635", "comment": "Malware payload (Mirai)", "value": "1498d6acdd5c22f8a12b08620fa936f6039f3f91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746583, "uuid": "1f118636-5d1c-4176-aa7f-df7b3b39fdae", "comment": "Malware payload (Mirai)", "value": "ba5bd00790f31e67a075c5163fb55db38caaf86a912343bd7023dfd9c38717f760523ca47e3e73d23b999edd30a99376", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746583, "uuid": "4564d734-3f6a-467c-926c-088ed204c0d7", "value": "T1D1436C41B21C0E07E0531EB0343F4FD19BAEEED122E4F685699F9BAA8035E731545E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746583, "uuid": "4a179842-818d-4927-9ef7-5e10c52e227c", "value": "768:WZrRMJ0cs2G11V/nglfYF5Ie/ysuYs/gEAf2l3KoPI3MdwbZ010U5+P:+ADs5jV/niQFOWPm/gEDtPIcWb+10m+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662746583, "uuid": "e0be5246-530f-4e27-a1c4-34290ca21eeb", "value": 55784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662746583, "uuid": "184c1f65-6f17-4468-9bca-5665c59dced9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746583, "uuid": "841d63b7-13e9-429d-94db-ddf045309653", "value": "b54fdcd4497ba7ec338d5df56a64f621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09586f4a-3056-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1662738160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738160, "uuid": "896c68c9-27f5-468b-b926-7a704d2a6e6f", "comment": "Malware payload (AgentTesla)", "value": "e51566572e11ed922963b82b25e3918d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738160, "uuid": "857330fe-b442-40cf-9251-3c161da806d3", "comment": "Malware payload (AgentTesla)", "value": "bf43c81289f07f51373d48e7bce32757f5730f94399b51dffb4e7cfdcb3626ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738160, "uuid": "a2806faf-6a75-49a8-a0b4-7517feba3837", "comment": "Malware payload (AgentTesla)", "value": "4d8756ddf0b5e2ecc835776de531c56b79f65859", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738160, "uuid": "b48f2560-f6a8-4b1e-bc6a-b0c5cb75358c", "comment": "Malware payload (AgentTesla)", "value": "b14d636ce2c3d21ca43818002b2384819d5443ec130f7e0c68deab311f3c6f3fd79f286d65f1d7c16a16e584a353b59e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738160, "uuid": "92251a7b-ab38-45ee-9c39-366b2a073fb7", "value": "T175351937218749A5C07250B860CCC5734B6A9E45E637C945FFC9BCABF5B2F2846D22A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738160, "uuid": "d24c93d3-8886-4b34-9558-a242b35bcb73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738160, "uuid": "0469b6d4-1f7d-47db-9ee6-7f7c59b340d2", "value": "12288:SEdkI2iNBdQfxvCXhD5XKSQtxG7fd7LfU083mhDqkyUNaaDsS4Td07YpxYOMtcjH:JdkI1ZoghNXJJfUHgfJDsSb7YpeOIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662738160, "uuid": "47092c8d-f7cb-4fec-bec6-fcad3181448d", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662738160, "uuid": "69cf27ff-bb4f-411e-9bf2-6c6765ae8638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738160, "uuid": "b35b4dc7-c47f-4a3f-9535-370d0c965efb", "value": "20220909915.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beff4277-3070-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662749631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749631, "uuid": "facfe250-38a9-4e63-8006-7ac25db5ede3", "comment": "Malware payload", "value": "e86fe5369ba1f0b416d6d6a3bd787ff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749631, "uuid": "ee266889-d4c4-4240-a07b-bf7c364aafc4", "comment": "Malware payload", "value": "c1a73f7739a7b955b899bafea374835c48757b50ac6743b0ff8be75c90748d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749631, "uuid": "38b2bd0b-9a42-4e06-8acb-d6d7b5fe3d2d", "comment": "Malware payload", "value": "a75e402845ffb2a92ba55b67664bdf7cf9ab6eac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749631, "uuid": "46ace1ee-6342-4217-9cf4-fe71137abcb4", "comment": "Malware payload", "value": "2159109cccfcff3c1503f74c99ea7b7a6dacc1a5bf894374ace5c3ca069ea726f9b8e1ac1fac1345188b7375b98e5c9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749631, "uuid": "ed36abb6-b222-407e-802b-32dea37c3fe5", "value": "T1AAB46B4027FC8A1BE2AE57BAE87154205BF4F417B267EB8F4548B1ED2CA67029D40773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749631, "uuid": "46f0375b-75aa-495b-b885-881ac3ffea95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749631, "uuid": "fe1047cc-58a9-44e8-b27f-0e65f4c1b212", "value": "6144:UTEgdc0YuXAGbgiIN2RSBYkDTPdXR4gaJXVErOjcEX9b8F9SkQz7yAcTR3C:UTEgdfYsbg5PUbHCA57yAcdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662749631, "uuid": "ef691517-f649-43e8-8c48-72bd4c01a34b", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662749631, "uuid": "0cfe49eb-fc12-4bac-850b-b291c867084a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749631, "uuid": "3406ff79-79a3-48d6-8a55-49cbb90f6656", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd84c656-3064-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662744528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744528, "uuid": "1881499b-695a-4ec2-a5ef-6e8383262cba", "comment": "Malware payload (Mirai)", "value": "2df93bd4121a05d2773a987258ea3642", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744528, "uuid": "20a4644d-a90e-44d5-b278-2a9f9e64d1ff", "comment": "Malware payload (Mirai)", "value": "c1f6f810c72c85f366e7e0da3ba1a80ac65b1e554ecd43b99a967e0ff77bb265", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744528, "uuid": "2c64c97f-3e57-49ff-b11b-08053a9f1e24", "comment": "Malware payload (Mirai)", "value": "2476bbab63639cf8fab9e968d0a5ab49aaa5d350", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744528, "uuid": "64f76e79-3206-4a45-a9f6-c58fbe6d20c6", "comment": "Malware payload (Mirai)", "value": "b79a0847de0c83f4943f13f9b6e0c88fe539b80662ce3bffee1588d3c604ca66a963b3f98ea4a7baa453a623835cf0fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744528, "uuid": "9f1af17f-53d0-4068-b419-f4ce8330aedf", "value": "T1E2631856F8818F11C4D5027ABE1E158E371757E8E3DFB2139E206F603B8A56B0E2BD16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744528, "uuid": "768b7165-cea2-4a26-8028-c2c5a2c44136", "value": "1536:V/nExqC39S6jgVZs8MqaXwQr+Q+MsipwyL3CXjb+10mRWA:qqs9fkVZiqaAcwyL3CXje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662744528, "uuid": "60900380-8e94-4c7a-9835-7b46186f8817", "value": 68284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662744528, "uuid": "6958ad98-88b9-457e-9a03-877813cd97dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744528, "uuid": "6e36458f-2469-456a-b52c-5e53f7b0c7f9", "value": "botx.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894643ea-3038-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662725489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725489, "uuid": "64328c93-8318-45cc-a3a9-e0da89ebc5d1", "comment": "Malware payload (Smoke Loader)", "value": "3b1642dd6d275aff1067b8362e9db661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725489, "uuid": "5a04f2c1-94bd-4269-83d9-e72560886095", "comment": "Malware payload (Smoke Loader)", "value": "c28979c726cf60a9bfe8fb473783fb3e86dba470901d3ad459d9065bf85c66b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725489, "uuid": "2d09e26b-ddb9-4488-985e-d73c499140fe", "comment": "Malware payload (Smoke Loader)", "value": "6adf323b248923b10e2fecba3da8d3d1162359e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662725489, "uuid": "46f63936-cd6d-4187-a084-04b697e0498d", "comment": "Malware payload (Smoke Loader)", "value": "89f035283eecdf0b5969252c1e6715ce03cfb046e06b0e4639d2f4a235211262551ec101ee7cf2d01256f5332d4b3616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725489, "uuid": "83b95e02-102e-4d58-ac65-e122268fe7bc", "value": "T13E24CF01B990C472D5E24570A474C3E06A7BB8B26A3999CFB7943B6E6E713C12BB5313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725489, "uuid": "60f2ea4a-ad91-4f53-b714-4418707026a2", "value": "f2fff7b5726c9a0e6527dfcd912d5711", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725489, "uuid": "17b71303-1807-4ca0-99e7-bb743a01e3d7", "value": "3072:e2MZ56J2ZblR+S/5CW3ZGijWi2qwx6yiNgCvYNQ:mph8ExjjKx6yZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662725489, "uuid": "c71fa351-f13d-4275-acd1-4d17b3775c13", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662725489, "uuid": "2b4c5855-1518-40d2-ad82-cad69e58c2cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662725489, "uuid": "11533821-8fe2-4a6d-8c10-99fa5df3851e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2770ab8-3069-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662746711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746711, "uuid": "c2154461-da8e-4226-aa4e-dcc2a1f73bec", "comment": "Malware payload", "value": "af8c6f5c4c1edaefb17263649c46bb6a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746711, "uuid": "51c35c9d-5710-4bb9-a423-223c7d43fede", "comment": "Malware payload", "value": "c39d000ab3bc8fed90aa713ea4ddaa24379a5bb5c995a12c43f4bfd033b2dacb", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746711, "uuid": "66317fa4-8f97-4f60-a5cf-77d9e2d383b0", "comment": "Malware payload", "value": "96aecc877cf9be5472ebd757326feedbd9ac31b0", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746711, "uuid": "56c402b4-5326-4576-8e98-650e2a67d965", "comment": "Malware payload", "value": "c015b81700e5a9769fa393840bc3e93408216b0b2aa8f377897b52f73845e06efe7f576584e403a738cb6dba91c26a38", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746711, "uuid": "788f5646-391c-4e82-9975-34eadbb23007", "value": "T1ABF52317F222966BC9F6D33621741639607B8D288B03FB4A2D5877BD28F7DD84B916C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746711, "uuid": "23bad6a2-9501-4938-86d0-1fdd6099a96a", "value": "98304:zb8SV6efffnRcj7jGPJqOd7rCrgtm8OEl3:zbFXcXgld7rUgtm8fl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662746711, "uuid": "584b0556-7f62-4d87-bc70-10b8d97f6306", "value": 3519397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662746711, "uuid": "dfbed5ca-8f61-4497-8fe6-641230f89a58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746711, "uuid": "32de7555-e01e-481d-831e-bb19813c5054", "value": "Live_signed.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e39f94-308a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662760652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760652, "uuid": "274df175-0f26-4830-b67b-a1ddbb6b5167", "comment": "Malware payload", "value": "fc1ee68d7bc6defb377c3078b459680b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760652, "uuid": "05460426-ccaa-4d8c-bfe5-6c2c0447e807", "comment": "Malware payload", "value": "c4bf2834bf07c9222b85f96ac1058a4525cbb941b16cc25d0fb0aeb7b27d135b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760652, "uuid": "791c9982-ddfc-4679-a756-9482e9393710", "comment": "Malware payload", "value": "cf3dc8041eaf7fbf5c62cf09f3ebb005c5fc7a5d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662760652, "uuid": "5c5efc10-4130-4ad4-9a75-041d2f66764b", "comment": "Malware payload", "value": "781882206873ff92b45c1d2c476f2ed26bd63ae3dfa0b6c789f69aa474e1b09552b6fb653a66785fdb2649ec49ab938a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760652, "uuid": "bfc4163d-ce39-4e65-9143-387a91eb0eb0", "value": "T166230177D60AC6D085F11E3E887D9BAAE42B7FF9C49F68276141772D3A0730623B2154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760652, "uuid": "41721ece-688d-4dc2-857b-e909932b49b6", "value": "768:pYSvAL8QbMhAOyjWcyfOSKAyjwWiL+q3UIjV1JWyKQaQ6hug8Xl:puLnXOyachSKt0WwRj3haOg81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662760652, "uuid": "91fd147b-07d5-44d8-b6e9-f1e7b5bf3d71", "value": 50120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662760652, "uuid": "a066e28b-4941-4557-bae4-e2d66d4ead68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662760652, "uuid": "c16a320c-4805-433f-bf48-11eca1a3c3b8", "value": "yakuza.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b6c651-2fd4-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662682425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682425, "uuid": "3f6f9be4-4285-4865-b10e-b6058f2efc66", "comment": "Malware payload (Mirai)", "value": "b93a3773e3f92132c65a643db7ad0d3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682425, "uuid": "f93d4847-3794-48d3-8564-b6276e0b7264", "comment": "Malware payload (Mirai)", "value": "c5017f3d05b6294e6d4879618fa5bee9585b3286a1c12b5253bc41cf139d93ba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682425, "uuid": "7db2b280-764c-409c-a982-d032737eaa1e", "comment": "Malware payload (Mirai)", "value": "5cb505cfdcf64d343e10b78e3048295bb93f1e20", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662682425, "uuid": "3469b72d-7bc8-4549-a636-c717417cd20f", "comment": "Malware payload (Mirai)", "value": "0a37fe9c446be9f2bd21835f29190e39148298800c95dba5a1506942f5603d20a2a188d854d739ffee647f391515f6e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682425, "uuid": "095afeeb-ad8c-4425-8146-e611c5ad675a", "value": "T1CA43016683ABA33BEE5035349B325182B07E4FF4FAB5357B6A20D2847953518B1BA508", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682425, "uuid": "cb4df52d-dd79-4dbe-a2e8-cb28a25da920", "value": "1536:VUyZE4wZRiVkCt/Q2i+Xnmnge+DgySstbDgl:VUyARMkUQ3n1ySWbDgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662682425, "uuid": "ca460331-be9f-48a3-8b39-3f959d4d84af", "value": 55192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662682425, "uuid": "94f52ea2-88c7-4af7-9f87-c67387110cbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662682425, "uuid": "12bb0d91-04bf-4e06-8810-8c0a89a70450", "value": "meihao.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da741c0-2ff3-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1662695727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662695727, "uuid": "2996fbd7-ce53-4502-b561-d9df48989ff3", "comment": "Malware payload (AgentTesla)", "value": "81219178e4bd82b798796a13699163a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662695727, "uuid": "b6360648-8024-489b-88b7-54376863c72d", "comment": "Malware payload (AgentTesla)", "value": "c65044d74f0a87a8134e7089eed36d8b07191ac4d4239a9c401c8dbf1e0b21ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662695727, "uuid": "32561e17-d386-4f73-8215-222a9eed6f15", "comment": "Malware payload (AgentTesla)", "value": "0ce070434a2b2c66e615b54fc7a87d5c71b2ee71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662695727, "uuid": "4001e927-862e-4164-a2f3-27edad7322ec", "comment": "Malware payload (AgentTesla)", "value": "66a0a0d3a64f5e16bae11b3c7963ef4a3befd0d0e7752410a15ca40cf043df9cd204c95a64b645eedc7683fa9fc18d6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662695727, "uuid": "7e0d9022-fba3-4a53-97ae-12d50643a898", "value": "T10A45294361804CA9D87740F468DDD43216A7AE88E57AC0087FDDBE6BF6F3B1110DBA69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662695727, "uuid": "cd720c3b-22e9-48b5-9466-fae8dc414955", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662695727, "uuid": "9d6c71a1-963c-4eb3-be4a-637e7df31d8a", "value": "12288:Gjdyx1yXy61JDqdBxusW1gSgVKzw/ja/LGydxCLwzppJ7nxdkuK2iS:cydg+dur1gSA1/eTjs8pLxdNK2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662695727, "uuid": "24cc2b42-f767-45bb-8f94-69254663b0e6", "value": 1253888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662695727, "uuid": "89b27f77-8b10-4dfa-b109-8244b234f752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662695727, "uuid": "ae49fdba-3b0c-4206-ac78-a914a02a0b03", "value": "f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d45e92b-301f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662714678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714678, "uuid": "773e533c-8a26-4b0f-97a2-098864357d2e", "comment": "Malware payload (Mirai)", "value": "e9cc415da24934574107ec687ba3eaa4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714678, "uuid": "bbc3951c-4d63-4ae0-b2ea-dc4c70582567", "comment": "Malware payload (Mirai)", "value": "c7413fcc0b81e5c4fef84bd229669763e8ef1409adf8260a12eef2229d7f5d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714678, "uuid": "65659c08-e619-4528-8951-214ce4bc36e0", "comment": "Malware payload (Mirai)", "value": "e82082189ee071c46455c2d79e847aedf1456672", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714678, "uuid": "01ae2558-d40a-4448-a834-06cf906c8153", "comment": "Malware payload (Mirai)", "value": "ba4821ed97f5ba22c796de017539bfc6d1f39fddbcf1187668d8ee9dc5e8628d682000e68b5d22a5b19409859ec9fc38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714678, "uuid": "e5da07b7-acf5-41ba-8e37-2da61836ef8d", "value": "T1F7734BC6E683D8B6ED0147B431737F328A76E63E2125DB93D3B9A932F981101A51B34D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714678, "uuid": "ca82158f-b25a-47c2-80d9-78449a06edc1", "value": "1536:99jpYQzJ8RezWNewfHDicZyi/lr2wFlXLIBwDkSWv2/2:99jpYOSv/fjiqX/lqMl7I6DKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662714678, "uuid": "65cf3c06-a8d9-498c-b270-c6da9a929375", "value": 74896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662714678, "uuid": "b4b617e7-cef3-4d8a-8229-77a7809149a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714678, "uuid": "bfee8c07-a7ac-4e03-b38f-506d44b57913", "value": "e9cc415da24934574107ec687ba3eaa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014fb78b-3022-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1662715812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715812, "uuid": "1f440968-f702-4f35-be3b-e53c2b6587ce", "comment": "Malware payload (RecordBreaker)", "value": "02075a8a60e411a3028165f461e7264d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715812, "uuid": "08056d8f-55f8-4da3-a745-f828402ef2e8", "comment": "Malware payload (RecordBreaker)", "value": "c92c50045d67238564803d3be7e94fe28fa9a64c6a7c629e752d18451af44d9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715812, "uuid": "98ac00b4-42d8-43e7-9cae-bd1cc594a040", "comment": "Malware payload (RecordBreaker)", "value": "05a1da49fe738b383c4bc53a867091b6ee771f77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715812, "uuid": "48734305-793b-42a1-9825-e0e340888f74", "comment": "Malware payload (RecordBreaker)", "value": "43cc2e971e256eeb950afec69e82c3f35fcd1c41b06edd3ada8e650e3e44c7f593df4a16b275929671828b95c119da20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715812, "uuid": "1a001ad5-52a2-4f4e-b268-44b953e00f26", "value": "T1AD14BAA8360EEF70E6DD15B5DE73630316B44D0755522E338C7E3E1BB9A96C268CCA90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715812, "uuid": "17fea3ff-b37a-41bd-b408-03214bf69cec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715812, "uuid": "a9203dc4-84e3-4c1b-a379-3e199d423bbc", "value": "1536:18CLPdLNokZvwFiRRrhEIAZqP3cInPxXWBSOh:fLPnEcRrhEIAZqPpn4rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662715812, "uuid": "8846b2f5-6809-4675-a8f7-8138e369f1a8", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662715812, "uuid": "370d0703-8b61-40a2-9ae2-58e79172e952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715812, "uuid": "547e7363-b25b-41e7-9352-0cda6cff74d0", "value": "c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4a09cc-2fdf-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662687190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687190, "uuid": "b8449431-ee55-4275-b24a-5b595f9b123a", "comment": "Malware payload (Smoke Loader)", "value": "1bd807247f3e2f2c80227401a5657b0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687190, "uuid": "78ec06d4-9d0a-41dc-8a38-d69a2149acbd", "comment": "Malware payload (Smoke Loader)", "value": "c9519b21f42e1b7c5a9a65cd0636f39eca080fffe536267c1bde08027aaba673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687190, "uuid": "8e6c29ef-b02d-413d-a84f-18e1d0f33376", "comment": "Malware payload (Smoke Loader)", "value": "476dda93d16543ab75ee6e1e3d123c2505ab0659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687190, "uuid": "0917bb84-69ed-40b5-bf6e-b6a3886ecb66", "comment": "Malware payload (Smoke Loader)", "value": "71a48c14d61ee279ba859cd33c23bd32cfc0e057f49a0a2b84298b4e3271c845298f156a86060b4ef4807676e3c692fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687190, "uuid": "8532c46e-92f9-404d-88f6-8855bb7e4e73", "value": "T1CE24BF2179D1C471C5E645308435E6A02EBAB8726E28C94F37543BEE2F733D26A76327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687190, "uuid": "ea1f5fb9-c325-4026-808b-b8bf1ddb1282", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687190, "uuid": "efd6959c-7097-4cf4-b4a6-ab239741f8f1", "value": "3072:Eyv59lYMjkR+fJcCjWnXx3FgYIFAEUlbyXBut7Kuh0Fp:hx7i+o9FbIyxDha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662687190, "uuid": "e96adf5e-5380-4d0e-aba8-e800facdb854", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662687190, "uuid": "eebfad87-08d8-46bd-8cbc-e64bef317140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687190, "uuid": "01ab2a42-b162-413e-bccb-d1f65f4dd14f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052507aa-3043-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1662729992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729992, "uuid": "4393c228-7228-4382-8f5f-256fb1c41323", "comment": "Malware payload (Quakbot)", "value": "c6ad59f1f0d4e90d5b3f222d175d6d1e", "object_relation": "md5", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729992, "uuid": "68c0026e-6940-40a7-a25a-5690cff9a4f1", "comment": "Malware payload (Quakbot)", "value": "c98b8a97cd14554cf1f47562921122f1c1624ed5f9f3603847d0e16103b798d5", "object_relation": "sha256", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729992, "uuid": "aef03dd8-ecd3-456c-9526-9d7b14070e4f", "comment": "Malware payload (Quakbot)", "value": "992a2036bb2c7dd865cdcedeef33d8303c48ee75", "object_relation": "sha1", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662729992, "uuid": "dadce2bf-12fb-466e-b580-5bfc3321a05c", "comment": "Malware payload (Quakbot)", "value": "938f15cb9979f9ac9581e8fc5323d06e83bc41b0fec647dd2486fcefb885efc05b1e6122cfb2086afc087f2c865f7452", "object_relation": "sha3-384", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729992, "uuid": "1d97d545-596f-4021-b444-69eb264456a3", "value": "T10DA4AFD568AF8046E884BCF05096B7735BDDBDBB2F09CAE71B541D2BE8312C191264EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729992, "uuid": "ee11c1cb-cd2c-4440-9740-9cb09838786d", "value": "84df75911ee4a4dc00765ff38f6b934c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729992, "uuid": "a30a5196-ba42-49e0-ab28-01bc184da4f7", "value": "12288:nDFhSg4nkx/LMw27kcmgexU51plXKixdvKXsmR:nD3S1T6YhxlNqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662729992, "uuid": "81ddf2fa-6484-4961-8ede-b83ef0e3b493", "value": 451441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662729992, "uuid": "4e004669-3d38-426b-b269-7da56cfc4bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662729992, "uuid": "de1eecde-5a84-43f2-9964-596d3623a86e", "value": "_KGM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8e3817-2ff4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662696104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662696104, "uuid": "9e9ef848-0ca1-4a13-8de4-e3b3e7fe483b", "comment": "Malware payload", "value": "8e9b31d70c6ba6d60d0fc9750b9ccc08", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662696104, "uuid": "e354467e-8cd0-49d4-a37d-701f16bd1fb1", "comment": "Malware payload", "value": "ca06b233b2d4e96c1ee3d14417f862c9321ec32fce4b10c3a99b6f8ec8d2c920", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662696104, "uuid": "6fbe5a2f-b5a1-4ef7-8a74-c166cc4cc22b", "comment": "Malware payload", "value": "5f33237c686b42d7b8bfcc62f9e41c7a3aba443e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662696104, "uuid": "bcf3ee72-47f0-4c02-b4ba-579e263ba4b4", "comment": "Malware payload", "value": "6d6121f474812f449e46dd02b655a55d7882f377816d2a8ba0b7deb5fb3e2d803abe5c8990f55b60bd2110192e8da302", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662696104, "uuid": "abba3c3a-5025-4ae2-a812-bc4b8ce80e23", "value": "T179E63381F3D9ED2FCC73C0324BB5167665864C95C713E203A968B36C99F7AD48A85BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662696104, "uuid": "97a8d9dc-30bc-4a19-bc8a-4af42712b064", "value": "393216:3maBC9u9O4X9uGtUNCK54bOZkLx0hb2XUXT2pQmm:DBVc4X9uGtUXzset2XZpDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662696104, "uuid": "a79825e7-b89c-4747-bac9-f620cf63bbe1", "value": 13999989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662696104, "uuid": "828fd025-2f78-444c-9f99-10061c147e8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662696104, "uuid": "6d094ba0-cd63-42e8-aab5-9b448d0177f6", "value": "ca06b233b2d4e96c1ee3d14417f862c9321ec32fce4b10c3a99b6f8ec8d2c920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0c64d5-308b-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1662761112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662761112, "uuid": "acfa75a8-d543-4fe1-9c3c-5b5952061c98", "comment": "Malware payload (NetSupport)", "value": "4ba211fd0f4e87d602cc3ff2d72d5923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662761112, "uuid": "53058e9e-7242-4601-aa30-8b692893a8d9", "comment": "Malware payload (NetSupport)", "value": "cad30ad3dc657a39b8e8625ed7d40ae81f4ad7808021758ddbed1990227403e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662761112, "uuid": "ddb9a3bd-f0f8-406d-92fc-0dbdeb962550", "comment": "Malware payload (NetSupport)", "value": "39961f482f6b0809a307e2656f9594c3109d16ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662761112, "uuid": "66a438a7-0b3f-4445-a79e-bd5d454b410b", "comment": "Malware payload (NetSupport)", "value": "13d0ff6489032037cf01db9db3cc3abca5913102ebd24f6d33e6480fc2c27537012e305edec77db18b048c713822ebab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662761112, "uuid": "8c042dd0-a509-466e-9354-d5a94df2a2b7", "value": "T17E24BED1B4E0C973C4E245304830D6F86ABBFE635A24998B7BA43B5F6E312D1727171A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662761112, "uuid": "e5055655-d363-4320-9be0-fc1d5fbd9ebd", "value": "1b356ecc92b2a52db834ffe06f790b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662761112, "uuid": "7227d1a7-93d9-42d3-80f9-80c162ca26b8", "value": "3072:9z5sqyLDITrdp5z1eh/gIhUWsXmVaauUfO8hgGhNDii:vcLDITrPrIiWsXmVaanhgG7Db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662761112, "uuid": "e48da595-f9f7-4d5f-8afa-d2b96264bd67", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662761112, "uuid": "e8484970-18c6-4eff-9e5d-b5d1385269cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662761112, "uuid": "016f5606-272d-4a20-b61e-020841c1ac58", "value": "4ba211fd0f4e87d602cc3ff2d72d5923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c1e1be-3070-11ed-9266-42010a9c0072", "comment": "Malware payload (DarkComet)", "timestamp": 1662749648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749648, "uuid": "6225a86f-02ac-403b-bdd5-b54ee6d55dab", "comment": "Malware payload (DarkComet)", "value": "ae5d11ab94b48e917e1ce2b1e7c4ed12", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749648, "uuid": "eb3dbce3-755b-44f0-906b-b51762d4c4de", "comment": "Malware payload (DarkComet)", "value": "cafe8d935b3afac2695aca899b702c039c97cd1c4fbbc67f2ea80ec5e1808c09", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749648, "uuid": "5e890ace-9eb3-4002-8195-2b0228778fc4", "comment": "Malware payload (DarkComet)", "value": "1c723713a0e6ec3afa227e8039f4dec01a8b1a98", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749648, "uuid": "965ab5c0-d3fe-4da5-81bc-0b58533553e9", "comment": "Malware payload (DarkComet)", "value": "4cdadfda95cad9ea059c219ac1e745bab3bf9dcb68b30d189b3045dbd58e8fb367da68e9c1d2f36114090f65e7adf39a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749648, "uuid": "ef7b32e2-9ce3-4558-b4fe-3a074aa94ac4", "value": "T1577412507AC9E802DBA839FC081167140655BFC90EA993237AF7320D26F019BFFD662D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749648, "uuid": "1498d5d2-8133-4d24-8b45-9af4ebba0f35", "value": "a38ad86d74cafc45094a5085e33419e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749648, "uuid": "aea9b776-0733-412d-b24b-fbebc763994d", "value": "6144:ccNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37gplvccV:ccW7KEZlPzCy37gfUcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662749648, "uuid": "c374aad1-2c23-4885-96be-1b100ee00161", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662749648, "uuid": "c01e05e4-ccd9-47c4-b567-955cea2e3a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749648, "uuid": "721d87e8-0853-413e-9107-c9b85261cf74", "value": "darktest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731782c1-2fdf-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662687227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687227, "uuid": "2dbcdeef-2d6b-43f9-9bbd-5de0786be05e", "comment": "Malware payload (RedLineStealer)", "value": "0560f777b7ffa448adc77493b9b21eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687227, "uuid": "52903f2e-c2e9-4d2d-bd78-859642906d49", "comment": "Malware payload (RedLineStealer)", "value": "cb3df9a9c73428751b722ae2dfbce2d04b46125d6aa5f69164e73f0f25ccfc8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687227, "uuid": "35cd41e4-467e-44b6-9aa6-6cefdd3f237b", "comment": "Malware payload (RedLineStealer)", "value": "6efc8ed22b32875f0d0e240eddf355e34fcf4513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687227, "uuid": "1bd7ea0f-6247-4e39-a857-18dc96fd6d80", "comment": "Malware payload (RedLineStealer)", "value": "77020ace2543e9af5a85ce633318077992124b4c4aac2e13195d38e2979ef50af2f83937b90a480afc7be25ea137397b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687227, "uuid": "e8c13e46-6f9f-4b14-ae98-85d6631a4a2f", "value": "T1FB361273126441A9D4DCCC395537FEA071F21A3B8F01ACBBA6D97AC625370E5A233A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687227, "uuid": "9a590e90-1ed8-49ff-b3bc-ddada61abae3", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687227, "uuid": "8b79f382-38cf-4a43-88e3-9e7a9a1ff7fa", "value": "98304:I/ioRNHU0B+Ei9pUhGUz9iXNWMXGp9TuOxkz4nijSHFLUvnCv7r3iC+aCAS:IqyOEine9XpwbSiaUras", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662687227, "uuid": "f8df857a-84e2-4cd5-aa26-c947e840e8e0", "value": 5045984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662687227, "uuid": "a9902ee6-eefa-430a-abbc-0dd6fb004aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687227, "uuid": "86af9ff9-694c-4bc7-84ae-fbfd732b0f0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54b1575-3075-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662751736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662751736, "uuid": "1951db0d-0153-49bb-b552-871fd88bed95", "comment": "Malware payload (Smoke Loader)", "value": "2fc462bfadf33e5d906777ad1689436c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662751736, "uuid": "e3609319-b083-4fbb-9a9a-f97f1fc7d524", "comment": "Malware payload (Smoke Loader)", "value": "cc4d8793136acc14b75b0e48f261cc58e0fac6267dee07541ebe540c4d61b1a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662751736, "uuid": "8bfcbd62-dd56-432d-89e7-210e49ef049b", "comment": "Malware payload (Smoke Loader)", "value": "c5bbcb4838ff3a5809ce9583a75e29b4fb40341d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662751736, "uuid": "678db672-d6ed-41b3-931d-e28bc25d778d", "comment": "Malware payload (Smoke Loader)", "value": "3e706f3afc25ed84fe8613f660efc394e02256404514e3ad422bb6bbb2a625e019e5fbe938d625613d76161b536f68d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662751736, "uuid": "946597c6-d912-4ed7-8a4a-401bc07b630e", "value": "T14D24BE21B8F1C832C4B245708474D3986BBBBC625A34958F7B643F6F2E722D166B6317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662751736, "uuid": "e98d6bd3-1ab7-48c2-bffa-fea809bb149f", "value": "1b356ecc92b2a52db834ffe06f790b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662751736, "uuid": "a7f187be-8c77-4c61-9ac0-8bae1ef5d602", "value": "3072:Kb5sqyLDITrdp59p1BG+D2e3i3kHhBxOhXoQ+i:ccLDITrbbAei3MxOZFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662751736, "uuid": "36a2eee5-af60-4446-b068-7c7601511fe0", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662751736, "uuid": "56a1cfb7-f5af-4e13-a6ad-4029b4ac9c8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662751736, "uuid": "c6786c1b-f148-4ddc-8b24-4cfc76b7af82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1cf75e1-2fe3-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1662689050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662689050, "uuid": "92c3e8d3-c174-4cd1-a551-49592a85fd1a", "comment": "Malware payload (CoinMiner)", "value": "9bd3608265396a8a0898f8482612635d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662689050, "uuid": "601a0b41-f5ad-45b9-bc31-884983a84897", "comment": "Malware payload (CoinMiner)", "value": "cceb2387a21b76c6d768aa09c1106291b737c9e873e814e9cd6006a7ed37f63e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662689050, "uuid": "497e52d4-a4fc-4fe8-900e-f9d76cb544ad", "comment": "Malware payload (CoinMiner)", "value": "c7c30933ca880e4b45fe27af693d49d132746f31", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662689050, "uuid": "9963d310-13cd-4c2d-a7e7-932f9ddc6406", "comment": "Malware payload (CoinMiner)", "value": "5be4e1df5b622811c4620ace0a6116f0cdfe64dd133e352243d04ddfaafbadc17d530ffe89b8581a1801ecf44d9c4c41", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662689050, "uuid": "e0087bd7-21d7-4e24-a38e-ce6e09473c9f", "value": "T11224CF1179D0FC72C6A28E308475D7E06EBFBC225A24494BBB543B5E1E313E17A79326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662689050, "uuid": "086f75e0-db91-49a3-a4f3-6cf26a375152", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662689050, "uuid": "cc432cb1-2af2-4a79-9297-30063a27e50d", "value": "3072:mqBtOBENC4BYBvaCJcLm4LeOjstV/vf+DlqxebXWah3BYI7cp:djPCBim4COjSV/Opq23j7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662689050, "uuid": "97081a12-509a-4dfc-9571-27f1348e8461", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662689050, "uuid": "22f46545-cd0b-4961-b465-f2c62090c6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662689050, "uuid": "6b80791d-e38f-4c4e-9991-d40d1c7116da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a100d2ed-2fd9-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1662684727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684727, "uuid": "425b45fb-fbeb-4808-b675-6a3c35541bd8", "comment": "Malware payload (RecordBreaker)", "value": "b27fda3b7eba2be512d2a6da23b2281f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684727, "uuid": "64c18714-5ab0-46ec-a53d-d693484d0667", "comment": "Malware payload (RecordBreaker)", "value": "cf16aaa4e7e4e906915e9901e93f4de670355784d5350991e8f09b813cc7988d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684727, "uuid": "ddb6d799-8c25-486f-b036-636e96f05999", "comment": "Malware payload (RecordBreaker)", "value": "1efd790a0df3814a0c5cc4d81f31c2ae7e764e2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662684727, "uuid": "62f8e682-e899-4b95-9a62-83b5fe16d051", "comment": "Malware payload (RecordBreaker)", "value": "7cfbb6a8b60e89f79a983daffb3be2d89364e38d47ae17d6cbc4df2fa7760e57972a3ec6f78c924394a6fef8e5b4498d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684727, "uuid": "3930bb02-01eb-47e3-9949-8a75158bdb37", "value": "T17324D011B6D2C431C1E788304475D7A5AA7BB8F16A25888F7BA4377F6E702D033B671A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684727, "uuid": "6b5b0713-ba17-4eb8-985c-b79f87962f44", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684727, "uuid": "f5d71dd7-b6af-4020-9d22-fdec460c0804", "value": "3072:kvM5qvN5ZaKE7xJcQ9uwm7E6u1sqGnbZNOqK2p:ri1aB7lowUEVWqWOqKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662684727, "uuid": "e0bd8725-4b0c-4f98-9f41-376d2fd7bfa2", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662684727, "uuid": "92e2d6b3-cd57-4b63-b701-affe41cfea9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662684727, "uuid": "2d4576b8-5e15-4b20-b2c8-749a1bfc26b6", "value": "b27fda3b7eba2be512d2a6da23b2281f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d09a401-3024-11ed-9266-42010a9c0072", "comment": "Malware payload (FFDroider)", "timestamp": 1662716718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662716718, "uuid": "69139e47-45b4-44bb-989c-99a858be832c", "comment": "Malware payload (FFDroider)", "value": "31602ebe5470cf625f5d0888fbd9918c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662716718, "uuid": "756adf27-8317-4fb3-8e49-eaab0f71a802", "comment": "Malware payload (FFDroider)", "value": "d1260997bc5cd00b88b61cb7adddae0768a3af22fa53e365a78bd528537f2b74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662716718, "uuid": "2d5a7023-a235-444f-b1b0-b35c392baca0", "comment": "Malware payload (FFDroider)", "value": "361e0bc1d515b4d5edf17339cd4e866e004b6a98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662716718, "uuid": "62509f5f-7bbc-4fc9-9e22-012bfebc61e6", "comment": "Malware payload (FFDroider)", "value": "ecb700957805c5ef870effacc10424a9c980e3d10337fa1acbd82ad6a6f1aa1ec0b8c438e395ddac3f562a46c0620db9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FFDroider", "colour": "#C1C037", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662716718, "uuid": "d27547d8-4e73-491e-975d-903f93cfcf8a", "value": "T1C5163388D91426B1F0665D74093B344CE9706CDA3EBCD4FB23E56F4C6A703E86127B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662716718, "uuid": "eabb7f3b-9e9f-4de6-b8ff-846ad1ad3711", "value": "cbe52706b29ce8ef0d4231afb14f1a09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662716718, "uuid": "aa85a0bd-2409-43d2-ad2d-a881604ae5f5", "value": "98304:oD9UShZa98B/bLlcHv3s/H9dAtdiplNRH6u7EKuJtbdOCdLewkb2a13QSH:oGShjNlw30fG2N55v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662716718, "uuid": "2c71fe10-552b-48ea-8e45-312c484d9c22", "value": 4020736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662716718, "uuid": "d4f2700d-de45-48fc-8349-0d8520280912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662716718, "uuid": "54940b19-f984-4143-ac16-d302efdfa7ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ac47e8-3015-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662710473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710473, "uuid": "99068364-7c82-42fc-b172-6cfa9427609f", "comment": "Malware payload", "value": "c0060c0741833af67121390922c44f91", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710473, "uuid": "87ec747f-3c6a-4e85-82db-edefc86909d0", "comment": "Malware payload", "value": "d1bceccf5d2b900a6b601c612346fdb3fa5bb0e2faeefcac3f9c29dc1d74838d", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710473, "uuid": "783ab84c-798d-4617-8bda-9e4d6d6874bb", "comment": "Malware payload", "value": "622eb93e34445c752eeaa623ef9ac6978e58f2fc", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662710473, "uuid": "83a3e398-93df-4016-8bb0-c606a473e1f8", "comment": "Malware payload", "value": "031c8b8cf54bc90ac5c1161ee413fc121c690ec99914df242ca2ea56ea1d448c92b24185b5e308d362e917965ae8ef56", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710473, "uuid": "ec88573d-a092-4781-9281-377eddf71d0c", "value": "T155E4E155F2C16EDBE233983BE0B712821128FD615A45D64F60DCF20F36B26521E67FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710473, "uuid": "59d3a8dd-5f6c-436b-b22a-3137f1631092", "value": "12288:Xi6upuuCH0br1NInOlNT15kQfnxeYnWzAlNT15kQrxe9gP:Xi66uXonx5kA4KxeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662710473, "uuid": "65a3cc48-80e5-4c2f-9a94-bce3dcb4fab5", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662710473, "uuid": "584ca461-c02f-4f08-8e51-4b58135d3df3", "value": "application/vnd.ms-powerpoint", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662710473, "uuid": "57c05549-ee7c-44df-a3ea-bf1bd3cb8021", "value": "d1bceccf5d2b900a6b601c612346fdb3fa5bb0e2faeefcac3f9c29dc1d74838d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a7c824-3013-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662709508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709508, "uuid": "ee036122-5424-43ca-9a70-e2181946f5b3", "comment": "Malware payload (RedLineStealer)", "value": "1cd36877d5e6e6fafa38f1c9f21cedf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709508, "uuid": "c3d1b8da-6da4-4621-9313-1a596cd8b27b", "comment": "Malware payload (RedLineStealer)", "value": "d273fc08938b54321f5d01dfa9200573efdf9d6fb9a2daf038aedd9d1f85ad65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709508, "uuid": "458e44fe-57c9-4991-8089-14025dc4b27b", "comment": "Malware payload (RedLineStealer)", "value": "e02d4dfad2a1a82a5bc5f6125bb421a02c42d363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709508, "uuid": "908e17ba-0b11-4c70-b797-f8037f8de750", "comment": "Malware payload (RedLineStealer)", "value": "689e542e903912feadf574712e36999a43b07e09f9a39cf90d20a57a8dfeeb4f7f79cc46dafac224d332037b47d2dea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709508, "uuid": "c014082b-5473-41a8-811f-5becec90ec0b", "value": "T1E3D33A5827DCEE14D5BE8B79A47060518BF0E543F952F73E4ED150EA2E62B80CE11AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709508, "uuid": "9fd278b0-a8ae-475b-9ae3-7b77eaf9731b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709508, "uuid": "2395f35f-29a9-4d74-8d64-1dc852e9d4ef", "value": "3072:UYO/ZMTF5tgoYzdxIwqaasDVVCDFWLRPChaSSc6l:UYMZMB5tgomWwqaasyQpChc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662709508, "uuid": "e51058ca-6b2c-4280-b2d5-66130aefc6e4", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662709508, "uuid": "e4dce08a-c60c-4ec9-8ae0-b3d2bd01fa1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709508, "uuid": "dc5b1411-6ddd-4005-8157-608bef6ad5a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754dd2a8-306a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662746931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746931, "uuid": "6f93c8b0-8d56-4f94-88bd-aae721a3e63c", "comment": "Malware payload", "value": "cebd895e436afbb98221762821847142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746931, "uuid": "e188720b-4bb8-41a9-986a-e9de564643e9", "comment": "Malware payload", "value": "d2f972298617ea53b01060ca7cdb62cb2daf7328427e30cbeae865e681aeef54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746931, "uuid": "c9a5e872-ecb0-43eb-95a8-7969311dc975", "comment": "Malware payload", "value": "34d11d98fd53cbfd25f24d2ffc94c6ba1cfeb424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662746931, "uuid": "bdd2d1c0-73f2-4390-b509-9d312173a733", "comment": "Malware payload", "value": "1948fe0ea17219256432061a5a50edb87947dcc4f42de7fc00f6677f2bb589167ad31838c5d78b1b86e4daca2805fe71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746931, "uuid": "1a2bb2bf-24e4-420f-9dfd-5a74dfb3247e", "value": "T1CDF37DD8B2C17162C3B770B850AFA10BF176A9E5790C8C80F068E9E17E74A44A477F6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746931, "uuid": "53c69bf9-b9c6-4f48-bc70-6c0762708a8f", "value": "3ffc7bcd42b46da86fe7e8ca3dbed451", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746931, "uuid": "d96c7eef-9862-4f9d-83e0-777b9a20c890", "value": "3072:MCJe96uxIKhVIadwwn2A8JuCG/jkx5FTuBQsLEGmZg1qGzP:v69UZ5A8ecTuRJ/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662746931, "uuid": "094d94b3-f83b-4805-ba7e-cf3de5b016f8", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662746931, "uuid": "d7b368dd-d7e6-4698-9ac5-d2846db075cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662746931, "uuid": "c3d816d8-efac-492c-a16f-6bd1e5c65c2d", "value": "channeling.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392f2ded-3036-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662724496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662724496, "uuid": "91c25a14-b702-4bbe-84be-8c2dcebc021d", "comment": "Malware payload", "value": "38ed1d86d350bc7823592a058a1f4382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662724496, "uuid": "3020ec09-8119-42d0-a247-9805d55d5421", "comment": "Malware payload", "value": "d2fcf557f8c41d87591b29d5649f8380a45d37f6b7e9303e42275f150f6acbbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662724496, "uuid": "54bdae6b-2de9-4acc-837b-1d0fd4923893", "comment": "Malware payload", "value": "04a48fecfcc67aa93ea9929b6aa7d0d5431cdf41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662724496, "uuid": "36c2f788-d655-4984-aa6f-75359c169d42", "comment": "Malware payload", "value": "44b78d3e84656120caa187e802349b4168a3c252e0115aa3b0db34606f64c7247c7b7755d5623070587640b3cb450487", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662724496, "uuid": "da3d590b-26c7-4917-9c37-93a1edd455d5", "value": "T16124CF1DB9D0C872D4E249344474D7A86A7AFD621A34898F7B983B6F2E703D27631317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662724496, "uuid": "4effc9a9-9c36-49af-a1d5-9fee8eb50001", "value": "5d5b8d072fdd778d9ba9ec0c36bae15d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662724496, "uuid": "dcf19c24-1a92-43bf-ab7f-96ad4c72673a", "value": "3072:W5o0NqE8fmh2rr5bsF8udE/AGTlLwvXdg7f4yQA+0hpFdQmnXhtb2:vfa26naAGTlLKfA+iQERtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662724496, "uuid": "3380842a-f8af-45c5-bd6f-ab40226a060e", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662724496, "uuid": "b7c0bd60-2b4c-42c5-88e0-9241fcc73fce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662724496, "uuid": "8dee89f3-3d93-4b9c-aa5b-fc6a0558dea7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c569b7-3010-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662708136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662708136, "uuid": "f7b8b18f-c2c7-4379-abdb-596ed1987a73", "comment": "Malware payload", "value": "a2cfbd92ccd84353e8ec52b9f8e0b3f0", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662708136, "uuid": "49005500-82f3-4a94-b535-88678c7133fb", "comment": "Malware payload", "value": "d492a674cb6d01aff720855a53c19ff8abe423e3521bf0ddee8d7c168b468cb6", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662708136, "uuid": "df4b2b61-2dba-46bc-b691-968a0ea496b3", "comment": "Malware payload", "value": "5eef3d3c83707cb33c13d341a124b3a1ed554739", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662708136, "uuid": "fd083aa0-c4f7-4294-8834-514b7185dcf8", "comment": "Malware payload", "value": "b4facfd120eec6efaf572581d7a48374a91a25b4a7075ee9f5fc9ac790e49456b34c06a636940a8ab42a42ed42abf700", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662708136, "uuid": "0f07eae2-ca7c-4133-bff7-aae96ae04604", "value": "T13DE423ECF48177EFC804DA2A62BE5C3DA424BE57447460E6C288A54B7611CD53E6BFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662708136, "uuid": "1b15d850-f30f-474a-88cb-68f301d38d27", "value": "12288:7f2s/s5x5LXi+fcUDx9Gc0UUvAMRRczzHNx+LWjQC/vqPZMc4cd:Ss/s5x5LXi+fjxn7U4MRRczzHN0Cj6ZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662708136, "uuid": "f01af495-1033-4d02-beaf-2e0bdd5de581", "value": 672116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662708136, "uuid": "cabac448-8dbd-40a8-8277-a8b7ef37db46", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662708136, "uuid": "b1aa4a46-0e9b-4134-ba2d-0920e327989c", "value": "ContractXT67XPC#3.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d95628-3025-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662717222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717222, "uuid": "4d73a5bf-6d76-44fa-9286-65024a59555c", "comment": "Malware payload (Smoke Loader)", "value": "6ddab08dcffbd31c787698bf7f97c642", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717222, "uuid": "04cfbf86-b787-481a-b4c6-5f45761b597e", "comment": "Malware payload (Smoke Loader)", "value": "d4949538803a47befc8e6b8450a1e5a74f8c14b9a616cb1e54212cc983272e3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717222, "uuid": "d004ed94-2462-4bf0-896b-ab520b154c63", "comment": "Malware payload (Smoke Loader)", "value": "d34a5c7942536fa2a0cc16a6e231921ec422ce9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717222, "uuid": "8b96524b-4450-454a-ad9b-5c82b5631896", "comment": "Malware payload (Smoke Loader)", "value": "62fa86daf1e5ff87bff667207150c2bd0dd95aec8953f4b40822a8e1443c2770bdcce6412872c1336dbb5eea7ec3b377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717222, "uuid": "af32c95e-d3eb-458f-a064-9ce3ae972e64", "value": "T10624BF1175E1C872C4EA45314470D7E42ABBB8626A289AAB7B643B7E1F313D07B3531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717222, "uuid": "5bce0f5f-bb93-44c7-9e9b-4b38aec8cd63", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717222, "uuid": "9de77a4d-ac5d-4663-9499-a8fe2ed32139", "value": "3072:xb+aeJphJ4TT65cisr+LBaQa03DzIweNC9WfZvrDT:kHJ8foS03AfNYSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662717222, "uuid": "1cc0a387-994d-4629-bb11-76cc25137fcd", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662717222, "uuid": "580bc7bc-af38-4b1d-b0a9-5381976402f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717222, "uuid": "6e14384b-aca6-496e-9a95-54074dfbc6d6", "value": "SecuriteInfo.com.Win32.Evo-gen.27006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd8e5e2-3002-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662702143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702143, "uuid": "8327f96c-3dbd-48f5-bfc1-1448fe1ba375", "comment": "Malware payload", "value": "b7ad583979099b800db79a1dc6c7423a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702143, "uuid": "ce68e100-9286-472e-a3fe-8429bd2c841b", "comment": "Malware payload", "value": "d4a65beb44a941913e8a34d50f9932e45832a453725e58d6eb7ed3815ab4fca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702143, "uuid": "b46f31d5-14ab-443f-9c39-50317549ecae", "comment": "Malware payload", "value": "324f9df08052bb1c2c1062057f26ae065f6ef1bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702143, "uuid": "06bc52ec-c540-4d9d-8f0a-48682fedeb03", "comment": "Malware payload", "value": "684ae9a9905f789468bfcea43dcf0d09bb25b1325f298ed350c86d3b7104438d8e7fedc28351e4bf9ffede839ca06cf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702143, "uuid": "1b82827c-4ef4-44a4-a71c-409f85d46e14", "value": "T15DC52313B9C4CA62C9CB42304D1BC6640E39FC215B1690177366BB5E7E31BB26B636DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702143, "uuid": "26b73f96-45a8-465b-9c51-f4f5c1158af7", "value": "0a5eb17d5a79b2bf816053009748e271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702143, "uuid": "f062e0af-4460-4600-83c8-335a9025eba3", "value": "49152:LQDxO8/GZlXs06kXMtWvaiJLCQeD0hbLogisuBLwswQRNmksH:LQ8LFekXMtWyiJsDcbLoRr5hwUm/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662702143, "uuid": "4ad59003-ad34-495f-a5e4-c2f9060d7596", "value": 2584064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662702143, "uuid": "0425e960-83b6-48f6-9e08-db24f141a787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702143, "uuid": "8c6c631c-b3ff-4181-8622-382054d43fb9", "value": "SecuriteInfo.com.BScope.Adware.Searcher.10533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab2ca07-308f-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1662762912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662762912, "uuid": "97daed2b-2de2-4312-8b8f-b24e96fab6a8", "comment": "Malware payload (NetSupport)", "value": "8a99c89d6eab9bde288abc0e15d5701b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662762912, "uuid": "8f93b645-b8f5-42df-bb6f-391bf7495662", "comment": "Malware payload (NetSupport)", "value": "d6e42e2a61096c2e8cddc89fb51ccd964a573bb87d3a63a22a2becac0640f279", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662762912, "uuid": "bedaf8a7-9e00-449d-a274-135bdf8158e7", "comment": "Malware payload (NetSupport)", "value": "90c07c91f7376247f4523dd15230fc04da461eb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662762912, "uuid": "05e29535-9c44-4975-98b5-2d5ea15271f0", "comment": "Malware payload (NetSupport)", "value": "d93e2786abeb60d676a4f82b4dbb8733c76282aa9d312f8fe8cf634f7a7b20d20b62c388a8f1430544cd466fe86226a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662762912, "uuid": "27cbbe1c-465d-4e57-be73-d3a6d4763eca", "value": "T1EE24CF1179E0C871C4E245F08034E7E16A7BFC6216B5894FBB663B6F3E312D06AB5326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662762912, "uuid": "9bf50fdb-cdff-4ea8-a531-c55566d7fedc", "value": "9ec19ad11da368328b1ef380c14dc8d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662762912, "uuid": "1def6d91-d3cc-4a38-b05b-dadf66f925cb", "value": "3072:sS4twupuFqzGL5tD2EtDQLc18lh5XMj/+V+EBbsEcrxCFg:SQFaWvQLcuIY3crM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662762912, "uuid": "0db71d1a-b9be-4b20-a81a-97e95bbe53cc", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662762912, "uuid": "e4f6729e-39d0-40ef-9408-fcd1afece5f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662762912, "uuid": "e68d1df6-43a8-4a87-aaad-77d075ecf1c1", "value": "8a99c89d6eab9bde288abc0e15d5701b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97c4b6d-2fe2-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662688714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662688714, "uuid": "9087331a-40eb-461c-8bb9-4c8362a99810", "comment": "Malware payload (Smoke Loader)", "value": "a3f051bdf591c6d1def8dc9bc20c9627", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662688714, "uuid": "5054fc5f-785a-48e9-b99f-8b7ca028df22", "comment": "Malware payload (Smoke Loader)", "value": "d902a88b896fa15de8d51951e3964f6b87bcf916a7ec4e17eae9163b66bcbbbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662688714, "uuid": "5d727a3c-2581-47c6-a32d-5236599e3884", "comment": "Malware payload (Smoke Loader)", "value": "c5aab23ec7163596c0f6b271230168bf0d58f0da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662688714, "uuid": "4ea3a7a2-b3b9-43d6-a4cb-0a5c6667ada0", "comment": "Malware payload (Smoke Loader)", "value": "861b5e78a8242b1ff85bf4fc31e6a1dc4884ee923e5f19a5c8050911785876eed5a60820c37ed272207445226953220d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662688714, "uuid": "beb4e796-9514-436c-94d4-e47c57d84af2", "value": "T1FA24CF917690C833C5E34130443AD7A12E7AB8631E75884FBB543BAE2F713D2667A366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662688714, "uuid": "32f7060d-51f5-45b1-810e-bc576f2d6ce5", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662688714, "uuid": "d062b2a0-d870-48ef-b5dc-462f95b77e4a", "value": "3072:rUbYHtURgy50DT7JcI+36FI7uzR/HPi/kMK3DECm33LEkIE+dp:oMdLDTZFXzHa33QkId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662688714, "uuid": "500574d7-b198-4266-bda1-56eeae48ad87", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662688714, "uuid": "0be94df0-f1ea-4420-bd42-2326e04d840b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662688714, "uuid": "000224bc-a3f5-4cda-8fb9-3bf0a124b2d6", "value": "a3f051bdf591c6d1def8dc9bc20c9627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed07d206-2fe7-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662690867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662690867, "uuid": "d5380f4a-3410-49f3-b647-9ad7f485d1c0", "comment": "Malware payload (Smoke Loader)", "value": "43e399c927b76831f5ae1da86c16c2ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662690867, "uuid": "455cb51c-a018-4f94-a26f-72cd8ec15d44", "comment": "Malware payload (Smoke Loader)", "value": "d9379883da90a1b18835f668d81efe0bdeee2d88a42fd316d213ecaac0c852e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662690867, "uuid": "12a6f7f0-65aa-458e-aa20-64a6ce3682b8", "comment": "Malware payload (Smoke Loader)", "value": "3bae3b6daddf6af61dbb9d0e0d29eb8dd2ee6223", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662690867, "uuid": "81787983-3cb0-4b72-8206-4c3e2d81f4e2", "comment": "Malware payload (Smoke Loader)", "value": "5efa62092f7b6bbc2bb1287f0d0ea22e3bcace373b39a0a273d6240167053c120eb672e02d7103f59fc2fd8abc9ce599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662690867, "uuid": "2d6619cc-56ec-4e5f-bf4c-c31d09c75010", "value": "T1C524CF1279D0C831CDEE85304474EA946E7BB8229A78958B77743B6EEE303D1367631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662690867, "uuid": "d157a24e-cb83-4cb1-a868-69dffe86065f", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662690867, "uuid": "b3be0c1c-1713-49f9-8d3b-f08848a19e49", "value": "3072:HuIY2XV1CE5l0bFJcLQwXSuq0uApJJIb0ZETBkjbTYGxDClGWmp:Vlx5qbqQISuYA80+kfTYG/Wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662690867, "uuid": "38a1a136-b537-40e4-becd-e1a37590d2cb", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662690867, "uuid": "59e9acb7-c89c-4848-b650-adcf6f29bbc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662690867, "uuid": "70216609-9d80-4cb2-a507-9e0f32e72541", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60655e1e-2fea-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662691920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662691920, "uuid": "54131d4c-ed87-4453-b894-407025b26592", "comment": "Malware payload (Smoke Loader)", "value": "602f71931483299432491980a8ce7f4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662691920, "uuid": "08475ad3-629b-425d-a0ca-c7af2ec2e79d", "comment": "Malware payload (Smoke Loader)", "value": "d9fbbe9405cbd56f1e0336d3d36cdbb592a62b6bee1cef17d09055febba249e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662691920, "uuid": "8ba197a9-13c0-44ca-a2dd-3e10ae8a941f", "comment": "Malware payload (Smoke Loader)", "value": "194b9d43b82a4172f400153b96b9081185366f6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662691920, "uuid": "23b76b23-067d-41bd-83b3-778f8d839d66", "comment": "Malware payload (Smoke Loader)", "value": "8c583ee4f5fa5ca8ede8b29bcfc8111b3fc08e4d3c28acddbbea02972d668a12ad73f580c11593713a2e00d0ece31d69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662691920, "uuid": "25f9bc53-6434-4439-8c22-661f878e8576", "value": "T1D824DF51B5D1C832C5E224304434DAA13ABEBC62AB3B948F77543B6E2E713D036B6367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662691920, "uuid": "db21ff04-c364-456a-91d0-89a5f230c3d7", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662691920, "uuid": "dae5e61e-f107-43ac-8ec9-a838ced31982", "value": "3072:1fow+XCcl3lTKgwJc54nM8nyP7hMwIszfS9MlQnjDwwAHMck1KQKwp:aND3xJn4qjnz3Qnj/cbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662691920, "uuid": "4310db08-b669-4208-bdda-a27d823834f5", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662691920, "uuid": "a57e0818-2fde-405b-909a-711c2c1ded8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662691920, "uuid": "f4ee61f4-0f09-495a-bd88-d4d4b02eb36b", "value": "SecuriteInfo.com.Win32.RansomX-gen.32411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b5d127-3064-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662744520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744520, "uuid": "b998ec87-847a-4d16-b813-426fdf5401a9", "comment": "Malware payload (Mirai)", "value": "337accd4006843098e242490419f9dcc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744520, "uuid": "4c949833-56e3-4733-ba54-46005c23337c", "comment": "Malware payload (Mirai)", "value": "da7e4ee27475d3fc1214b509342c3130e36b7c8b58b4f69340a05ef4f9ea77fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744520, "uuid": "912f9081-8693-4333-a969-a4cf04b3ad5c", "comment": "Malware payload (Mirai)", "value": "cf6c744fb7fb1ce8f1668995c3b83aa93d44b973", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744520, "uuid": "3f80a51c-d442-46a5-81a2-be0f3f81a5df", "comment": "Malware payload (Mirai)", "value": "b776ffefdb947a7bb8c1fb95366d2ba4cddb06a93bd5933d8016d6cc19368976770700ac49cd8eb730d8fa542e51e503", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744520, "uuid": "8cd4da6e-70f5-4367-aea5-9348cebffd06", "value": "T1D663D759BF610FB7E8ABDC3705A91B41288C955722A53F36B970D418B24F24F19E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744520, "uuid": "b2de397b-d0e2-46c8-b17f-e93188c9617e", "value": "1536:9DTxZkgEFxOsp4Gsn2C7I0bZUZmlQmpb+10Wyk:9HxZkgepenlU2eD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662744520, "uuid": "86d9adc0-af99-4a78-860c-0469010946f6", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662744520, "uuid": "d395f847-9861-4aca-93df-44d35e4b22b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744520, "uuid": "d12ab7de-ff06-400e-90de-78b63b01c194", "value": "botx.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b131772-301e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662714218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714218, "uuid": "4833d3fd-570a-4b64-89a8-752afc276b26", "comment": "Malware payload (Mirai)", "value": "306415ea11c13aaa6602458839a354f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714218, "uuid": "fd693c39-9d6d-427d-856a-58d03880e00b", "comment": "Malware payload (Mirai)", "value": "db26bc76549c14d078b66ca7f1269ab51b3a46faebdfcc42ac421ada62491a8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714218, "uuid": "0a58d808-6e79-4652-a900-021c9d91817c", "comment": "Malware payload (Mirai)", "value": "4917b948bbb8f9a7b6d7a3396c056c87592095aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714218, "uuid": "713ea343-cb51-4775-b421-3764e968b576", "comment": "Malware payload (Mirai)", "value": "2cbd6755c2a011a1cc8a3fb14b49aa8e28290aeebba81c1bb0698e0281cba0e5b8324acb9f881cd8ad4d98cc7c7e1658", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714218, "uuid": "ede70ef3-a0d0-4276-aec3-ad97b7d8f390", "value": "T104D2F1B0B0912429C7F80C32B565C80AFB8F80F491EB3473EA01D79DB5E7357AEA5649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714218, "uuid": "083c968a-4ef8-415c-a9ad-59aee3591d28", "value": "768:mcyzoRvMGflSYu44RnpNbwyXB54H+NUy3U9:SoVxu44tpmC5w+No", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662714218, "uuid": "a87a3573-80dd-4da8-9186-0feaf91e5216", "value": 30440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662714218, "uuid": "d4904534-0abc-49b4-bdfe-dbe4d0423e4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714218, "uuid": "cae061fc-59c1-4d58-86c0-4d4c5117d25c", "value": "306415ea11c13aaa6602458839a354f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599771c5-2fdb-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662685466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685466, "uuid": "fbe23f40-4782-42c3-81d6-d5021b49c774", "comment": "Malware payload (Mirai)", "value": "4a67e527b3449008bcbd4fd7a6b769f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685466, "uuid": "9cd4caca-6162-4f47-ac68-d5971b6c993d", "comment": "Malware payload (Mirai)", "value": "dbf31f037314b7971001b48ed091e81de92945a6601477068edc21eaeaefdf71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685466, "uuid": "146717dc-9b22-4771-a02b-69cc40181d81", "comment": "Malware payload (Mirai)", "value": "b5f109f5995d5c9149c54872f3e2d61427f24dc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685466, "uuid": "145964b7-4890-456b-8b3d-d17dc71e2300", "comment": "Malware payload (Mirai)", "value": "46814184b727ca22fbde2ebf590d782a77216619252712b0305f193301562fd907710c64d1e74c554a2e7947e5de68e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685466, "uuid": "9da2feb4-2709-4fc9-a8a7-0613f04b99b0", "value": "T1FF9329B81995B27CEDF25079F81310EA2862061C3B9CD1E379C7507BFFB4B09616AE19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685466, "uuid": "06f68cc8-203a-4a7f-a7d9-658f7fef0394", "value": "1536:5VjYy1P4GWswaWTgJukc4EfIRg1+eHozJkS+AF21KIUIoR5nSr:7wGWTTFl40J+eHEJkSjFUKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662685466, "uuid": "c701c616-0f51-4aa6-8246-fecbdd69a216", "value": 91592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662685466, "uuid": "ec4a95d2-52bf-4ef3-a758-82e43c76c4b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685466, "uuid": "aedb20ec-474d-4534-9063-9115b9d17203", "value": "4a67e527b3449008bcbd4fd7a6b769f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a69ab21-3058-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662739208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739208, "uuid": "0ae3d8f1-3046-42cc-95b0-d7b54e371b1d", "comment": "Malware payload (RedLineStealer)", "value": "ba076a96f481e19f6bafa4084a848e9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739208, "uuid": "8df85b6f-030f-48c7-bf8c-3ce73e98a00e", "comment": "Malware payload (RedLineStealer)", "value": "dcdb1efb61ecf52af046b43b085cf53c8831b6d5ad890fd3e2d490265417727f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739208, "uuid": "1444d6f5-bda5-4898-84d0-3d3f1341c1e7", "comment": "Malware payload (RedLineStealer)", "value": "7b6e05c1e7cccae55a5841136aaa5efc1ffc26f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739208, "uuid": "968ed63f-d460-43d0-b373-cad4236735e8", "comment": "Malware payload (RedLineStealer)", "value": "e92113a9b0f1de6b2f5b4490c66958861889dd5b89ef81d265a94427763be310b8039b8d586c3942dcd25c1bf1756f92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739208, "uuid": "82ccd6a2-f1f6-42c0-8d86-2a8a93823d12", "value": "T19124CF11BDACC832C4A246304474D6E56A7EB8617AB8898F3764372FDE703D16A77363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739208, "uuid": "6924b4b1-bc47-4a9c-b397-c90e09328411", "value": "f2fff7b5726c9a0e6527dfcd912d5711", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739208, "uuid": "9eb4fcf2-76c4-4b13-9b22-bd24148c9696", "value": "3072:28MmyeUtnPj2/5MdpX0tK876Ts35sEI28QXnXq:rwbX/X0s2k5ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662739208, "uuid": "ff62839c-235f-4294-a6a1-7cfe3da306b6", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662739208, "uuid": "1dc963a4-702e-4c3b-8b3a-1906938381c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739208, "uuid": "93f7d774-fcac-42ac-870b-8b4691f39f9c", "value": "ba076a96f481e19f6bafa4084a848e9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371f775e-3052-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662736518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736518, "uuid": "d2c2bfc8-71c0-432c-b1ae-8da7b3f9750b", "comment": "Malware payload (RedLineStealer)", "value": "299396d55d67d5be76943a5d5f4ce403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736518, "uuid": "263386b5-5a4f-4cad-a90c-a2c4c89180a2", "comment": "Malware payload (RedLineStealer)", "value": "dce4cb3aa96c4a503f7a8bebe0dfe313b656edc55e26101c16d6bae61d6a1241", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736518, "uuid": "a940e3d5-657b-4e46-b34b-5f1086cd1a71", "comment": "Malware payload (RedLineStealer)", "value": "ad492f30fb17308f3a26a3566a6bd3d8265e9230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736518, "uuid": "b5073a31-9fcb-4ca3-bf9a-dab6db4eb811", "comment": "Malware payload (RedLineStealer)", "value": "46c554d879d50982c1e0ad01b1453a90b9fb8fadd344f0b9e07ffa38cecb1d6d8cbc250cd99aa08c8767d7ba9c3fb7f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736518, "uuid": "637be4c1-8cf1-4b4a-88d1-d3307a640753", "value": "T1CAB328A477DCD504EABF4F7178B1119443F0A6236902EB6F5EC510F91EA2B80FA11AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736518, "uuid": "a7e24e0a-9e40-4d45-b4e1-5dee4e7439d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736518, "uuid": "364756bf-f259-463e-ac7b-5f47f222026b", "value": "3072:ncvFBICYSpiMIDnSPzVxpHE043JrGQchrjTdha4EASNh:ncvW1yVxpHA9cFdha4jS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662736518, "uuid": "08f44576-7f0c-40b1-aa6d-b8ea364c3e10", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662736518, "uuid": "028f78e8-d736-4c45-88f4-1ff5b4c9c46c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736518, "uuid": "1573c37d-083a-4091-86e3-a33cddf783fa", "value": "299396d55d67d5be76943a5d5f4ce403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b2846d-3027-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662718341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718341, "uuid": "f56e4e4b-a8f5-487f-abd6-2fae660f8dab", "comment": "Malware payload", "value": "dc145802f53bc6030a24e0fe9d2ad485", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718341, "uuid": "54c44d93-fc12-4dc1-b7d8-75db5be0e1bb", "comment": "Malware payload", "value": "e1a8da57fc2607caa08044474475b29edcdc8fa19b805ef8ca46167f7b848d34", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718341, "uuid": "5d66c4ff-f70a-49e3-b329-ca77822c32ff", "comment": "Malware payload", "value": "4e4011da8613f2b0136f1f972c810f6a915bd208", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662718341, "uuid": "193374f1-f7aa-4924-97d7-f3a25549dde6", "comment": "Malware payload", "value": "f1005d8890e7825a751196664f5e52fa1ed019b508523abf0c16eedfdc6b525c733cc8533ca73d87968561b327e14d89", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718341, "uuid": "2afc3c2a-4a25-47f7-b35d-9d9c9e120970", "value": "T16DA2CF26D9698962E21567F14144138BF7BEA10DC0B7894F2C66B3CC4D536BD0FA3C1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718341, "uuid": "2e42d30c-b9fc-4514-8988-e1c5f2c344c9", "value": "384:tLL0PtzckZhUZ62rKU4uusF1BPd+I+DJRE6uzYwHF9n2mhwT4jUrflVWX8cdWPGW:1StzckIhKHulFvEzg6+YwHz20wT4ITcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662718341, "uuid": "a8562837-4baf-47e7-9fe0-f344a6768d30", "value": 23208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662718341, "uuid": "612fb22c-cd62-4919-839a-18fa5294f371", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662718341, "uuid": "07a63c14-1c8c-4360-9382-7c4c22af3be5", "value": "Untitled attachment 00005.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba2ef7b-2fe6-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662690167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662690167, "uuid": "2ff1d640-80ea-4399-a3a1-f49c4ce1b038", "comment": "Malware payload (Smoke Loader)", "value": "a4c722f98fd0d72a41039940fddc9917", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662690167, "uuid": "89268f33-6d9c-44cc-8eb9-8c491aee1fcb", "comment": "Malware payload (Smoke Loader)", "value": "e265d977bb1e72f963c776828c87ba34225c364431bf27e175acca98671d1c57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662690167, "uuid": "4454895c-15f2-407e-a519-0fbd81c07bf3", "comment": "Malware payload (Smoke Loader)", "value": "325a4619e2e322f8f45cf28f25918a55c9b7a6e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662690167, "uuid": "864f6bec-01ac-426e-9bf7-a6f1fa8ea112", "comment": "Malware payload (Smoke Loader)", "value": "d1a51db417ba23afa622385d7061c6784b74d9e92dd04d067ffd55ad7f2b78bfec763c14d859e664e1e2fc52f14b369b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662690167, "uuid": "95adffa1-1ec3-45c8-b2ee-d0deba658061", "value": "T15724CF2175D0C473C9F645308731E7E02ABEBC616A28864F7BA43B6E2E713D16B7531A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662690167, "uuid": "99e0684d-9bb0-434d-b80b-20045ee96916", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662690167, "uuid": "744b820b-e542-48aa-ac0a-c173fd0e9be0", "value": "3072:VSOtbyJDpbu3Y3YaJcVGZByMDh0ljfgOZsIGXgfapExtzBlTp+8qGibRKax9p:Zt+NUo3Y5GxWFIOmF9pEjz1+pGibRV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662690167, "uuid": "1e5f0e99-7394-423e-ac55-89ba236e171b", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662690167, "uuid": "59b057e9-df1f-40a2-b498-745dad514613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662690167, "uuid": "3f02fc28-03fb-474b-8848-c79790b1806e", "value": "a4c722f98fd0d72a41039940fddc9917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8297c506-2ff9-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1662698420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662698420, "uuid": "d9ab1317-df0c-42d4-88b8-89059ce39006", "comment": "Malware payload (SnakeKeylogger)", "value": "fe150b611f87ce38416120070b0c83c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662698420, "uuid": "782fc2a1-d5f0-4935-9ce5-ccc1d38591b7", "comment": "Malware payload (SnakeKeylogger)", "value": "e3555cc65ec783fa2aa5a0c5c565e2ac373487fbcffd83db2a014f40ac983d30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662698420, "uuid": "bf2ff681-284a-4484-9341-097969ed4e38", "comment": "Malware payload (SnakeKeylogger)", "value": "874a111afbb765814fb282ebaf097263a444a4c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662698420, "uuid": "1e8411ea-62e9-45a1-ae38-72343a2324e1", "comment": "Malware payload (SnakeKeylogger)", "value": "0f9c7dac796001b4b8d736a3e60db6183eb81cdb32dd40fa2b17a42b1fc07d4910c833b1cc07bc47288a1db006c3405c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662698420, "uuid": "41bcc084-eee9-4cef-8eaf-119b94db147d", "value": "T17F45084361804CA9D47740F468DDD43216A7AE88E57AC0097FDDBE6BF2F3B2110DBA69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662698420, "uuid": "5bf44ad5-f1d6-4511-aca8-1d012ba3d380", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662698420, "uuid": "deb0a923-9b06-4bcb-929d-12284ea84108", "value": "12288:K3dex1BWdg+jSEvuiLO0z/95ftCUucKdisMNocK2YD2E4Ep0ZFB:ge5P+lfJ9p4+KIlNo72YDl4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662698420, "uuid": "456916f7-2f94-45aa-a1d3-3ef89034e650", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662698420, "uuid": "e73c2c72-c797-4ab6-87fd-d5cc492c0615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662698420, "uuid": "df8dad4d-81c1-4620-8727-c8cc49201dc0", "value": "SecuriteInfo.com.Win32.CrypterX-gen.20023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb5120b-3070-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662749656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749656, "uuid": "6050e262-26b1-4aa1-ab0a-460d81acb587", "comment": "Malware payload", "value": "1b99c3604d4eb55f98c6636b0ce14b65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749656, "uuid": "fa96fd72-f6e8-4105-8323-42a063d4d91d", "comment": "Malware payload", "value": "e3b41c65b9ee28473b4487dc2879f7a2fe3ce33b52c1e4d351150a2f711c7026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749656, "uuid": "bfa4dd06-0b5c-403e-9371-bf86e96aa6c7", "comment": "Malware payload", "value": "28cd7c17f63e7b9648fca117c3ad4a05efb06066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662749656, "uuid": "c4f11bac-3f89-4cee-8283-709e75698229", "comment": "Malware payload", "value": "51beba68eb1795eab7a174b52afe355ced0351a694b2578ee7ffc0d66b16bf7a98d0800cf8e0980789b0c310e11d9c23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749656, "uuid": "f38f47de-9554-4513-b3b7-eb13a9e584c2", "value": "T122B47D8027F8852BE16F57B9E87114219BF5F807B2A7EB4F4540B1FA2C66B069D80773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749656, "uuid": "b7920211-cf63-4892-a2e4-1f320b9f9b47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749656, "uuid": "938b576e-52e3-4c0c-9394-dc8ea266a6f4", "value": "6144:sTEgdc0YuXAGbgiIN2RSBxddqWU8M2MYMFsZ/wcETOb8F991AAZcTR3X:sTEgdfYsbgdHMILODpJAUcdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662749656, "uuid": "30174bb6-f98e-49b5-85c3-7647c6044322", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662749656, "uuid": "71bf654c-dffe-41bb-9e12-5abff3fa4b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662749656, "uuid": "b05c112d-15a8-45e9-95ea-64f4d97b8c9f", "value": "xbatrat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f142c6b-3094-11ed-9266-42010a9c0072", "comment": "Malware payload (NetSupport)", "timestamp": 1662765013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662765013, "uuid": "0db53244-7b3e-48fc-ab28-a9eecc9dee95", "comment": "Malware payload (NetSupport)", "value": "350ebd03892359e34bf7e83eea88b121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662765013, "uuid": "db7e1cdf-136b-4dfd-a114-1cf087867275", "comment": "Malware payload (NetSupport)", "value": "e40d22332ea475ceef424d78960054ad7586f0f6e462c61400eb463612e591c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662765013, "uuid": "130d0a2a-e4ca-4917-a7e8-0e61ac3987b5", "comment": "Malware payload (NetSupport)", "value": "dc9735ec225124967c3d08cfa834ada7ffe7849f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662765013, "uuid": "e988f06e-cf39-417b-a462-ea80d4482b9c", "comment": "Malware payload (NetSupport)", "value": "dfddf0108ff71e5573e6b470c87be563b93c1a302aff99cfeb1e81429b2d0f4ca5b068b85868884b2990482608e74811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662765013, "uuid": "d7948e6a-6632-42a1-ada5-8e7d5a44fb0a", "value": "T1A014CF22B8E0C772C1B346358435D7946ABF74623A78A98F7B9427AE4F303D1627570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662765013, "uuid": "b1f9fa96-c133-4487-9489-11d91e7ffe25", "value": "d222372a7f8612f1284f3a88f8d20994", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662765013, "uuid": "8739b46d-69c5-4710-a154-b01614ad2d3e", "value": "3072:U4ojMl6pvQmKw+XuP/5lM8ADtxmPCgxQgP0T6ZBr6UcJrkx:XeBJQvw+Xuqx/XTEB+U6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662765013, "uuid": "7a89102b-cbba-4021-bd14-30c8f9f3b6d3", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662765013, "uuid": "1ff952fb-85e8-4b0f-aa4c-1195e2fe3619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662765013, "uuid": "751ec7b7-f4cf-4987-a875-4b21f03f575f", "value": "350ebd03892359e34bf7e83eea88b121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eefd47d-3056-11ed-9266-42010a9c0072", "comment": "Malware payload (MassLogger)", "timestamp": 1662738223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738223, "uuid": "84cc93da-c60e-4a17-b3a2-1b3d1a5b022b", "comment": "Malware payload (MassLogger)", "value": "6a81e1ecfdd0d555504d0718cf22e557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738223, "uuid": "9c43ead3-ab93-4a46-8eaa-15a5b9834fcd", "comment": "Malware payload (MassLogger)", "value": "e57050b46da3903b314d721bfb34e69ad18b8906d29b0193dd155981e5f37807", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738223, "uuid": "3a2193f3-c77b-40e1-b221-18e740673188", "comment": "Malware payload (MassLogger)", "value": "73ed263a3f8de8aa99590dd240105b3f6b737150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662738223, "uuid": "624f8745-ee2f-40b9-a9e4-db6c54336144", "comment": "Malware payload (MassLogger)", "value": "a26ff83ccbe7404ae25e0151023d5faabace4bb6287636b0ec371e56ad5360465a04b4951c76f0d7b858f7fb1aba1f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738223, "uuid": "1abaf288-6743-4bde-9f05-6b6fc3673869", "value": "T1A0153A0721D54DA5C07250BC64CCC5B34BAADE85E63BC946BFCD9CAFF592F2846D22A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738223, "uuid": "02fcb9c1-4aae-4966-a74c-ab76cd7974d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738223, "uuid": "f66e1982-ebf2-4df5-b63d-47da7d81e787", "value": "12288:Km2iNhdGxvM/Ht1+uRo3MRU/1gKv6BdDaLFgha6lBFbJXlG:91xG+HtcuRLig06TCFgNvFtXlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662738223, "uuid": "3057127e-9b20-40b1-b4f6-85e091696f2b", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662738223, "uuid": "50352821-ad51-42d9-a3de-c60d274d7450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662738223, "uuid": "b75b2d38-154f-4425-a5a5-c14d4e05f418", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e65b390-301f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662714653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714653, "uuid": "9a275059-51ef-4f03-b1d0-13d5ebfba0ed", "comment": "Malware payload (Mirai)", "value": "4acfd1aa213f9bd0fe2acf4ada532b2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714653, "uuid": "cf9651ec-be69-4c1b-876c-58a30f3d48a5", "comment": "Malware payload (Mirai)", "value": "e631e8f590f86c566f17056eed1c754d2d7b814e997f726480a5bdc7ee5a3baa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714653, "uuid": "f3e135ca-d3ae-423e-a39f-b572ed928c0e", "comment": "Malware payload (Mirai)", "value": "4faf46fab5c9bc0697dbaf41650d1a22792d6a62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714653, "uuid": "224134e6-83e4-47c0-be92-0fa71ce5030b", "comment": "Malware payload (Mirai)", "value": "ed40e9131352e351ae8613c897f4b3def99f92668ac5c1842e48371ea77408f8be64642c4c53519e033ae14f56d3a2b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714653, "uuid": "f11f0402-bb04-4a47-bc21-3cf3be8401b2", "value": "T1AE634BD5F400DE7DF48BDAFA9122491AF52163009E930F27AA37FD93AC62054BE4BC46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714653, "uuid": "4c900bb5-4cf9-47e2-ad71-ebd01d44dd50", "value": "1536:7zfegeAYmS4c3eSmWwpHRsMmNMDH6poa8+3BGyYNgow3v:7zy3ZkHRsMyaKpYqtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662714653, "uuid": "bfdea15a-e304-470d-9e74-638e80f95b12", "value": 73076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662714653, "uuid": "d5a3e7f9-75a1-46e1-a6bf-f52793d55c73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714653, "uuid": "cb5e4020-742b-444b-b15d-0e7b79156b0c", "value": "4acfd1aa213f9bd0fe2acf4ada532b2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa12029-3025-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662717224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717224, "uuid": "c786101b-6fb2-43dc-a95f-9a84a841f438", "comment": "Malware payload", "value": "eff75620a8bd87c3e5e78595e420bb02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717224, "uuid": "44be0e06-5dac-438b-b628-44e93b50c89c", "comment": "Malware payload", "value": "e67f384ddb1a0b165cbae4c93eec8eb1bd718e51a9ff5d24b0980d867b20c53c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717224, "uuid": "5963a746-255f-4ca1-961b-4e1bcfa1eeae", "comment": "Malware payload", "value": "0fa763321ce578499e9ab2ef812a0f8e6ae1013d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717224, "uuid": "f1d9118e-6817-4497-8534-fca62c6675cc", "comment": "Malware payload", "value": "43444eb68fc6578771d1af6a2557effb20a5031084a493aa374234f58292f68df7741f599ee83717569aa8df637c66ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717224, "uuid": "bea9d980-bd14-4052-82f5-2944c3085e7b", "value": "T19A84CF1465A1C4A8C3B00BF12ED2FB79D53C6DE21E0B194FB305BBCD18B559DB24A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717224, "uuid": "4ce83644-67ce-411a-8bef-85d8384f79f1", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717224, "uuid": "cf657fd1-9822-444d-8d00-b3edb0dfda20", "value": "6144:rGf+q+EeBseeqnf3UCRfeAI3c8r7zdy+dlbpv0AyJbkZvd8+z:wgseeiUC9UzDlbiAymdaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662717224, "uuid": "e1a391f7-5e8c-493f-9dfd-1d30b7545cbe", "value": 386192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662717224, "uuid": "1c4c48e3-0969-4a25-b71b-7622e7597c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717224, "uuid": "1bdef7ac-bb5e-45b7-b212-28b0202cd634", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.10604.10132.22073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7813d1-307f-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662756173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662756173, "uuid": "f4b7a8f7-7258-4b62-8694-0d6cb54deeb8", "comment": "Malware payload (RedLineStealer)", "value": "3205eb3344a4d974d0e1b9729cc33268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662756173, "uuid": "cc7e0fbd-3646-49c8-97fa-dd42ad81996d", "comment": "Malware payload (RedLineStealer)", "value": "e67f65a08f1d5690c66652b20ae9f34352436231a0a365c4a6ec45143a4df46d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662756173, "uuid": "6b5c4dc6-f2f0-4b88-b5c8-de2bce5c1372", "comment": "Malware payload (RedLineStealer)", "value": "2b588df9769ae39fdd2c6b288b6978b64a179c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662756173, "uuid": "d566e020-3931-428a-8846-84087064e2ea", "comment": "Malware payload (RedLineStealer)", "value": "595043daa73afcfa506b36863939cfcf2ab96db00c182080c1b88fd3b847825b51d163d2d86a5ac6742951920b49d261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662756173, "uuid": "1bdb7f83-b4f5-485b-a198-9fc0a9e3fa4b", "value": "T10C36122372955094D1E588318523FDD472F213298B829CFA7AD69EC739275EAF333A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662756173, "uuid": "0972ae21-b33f-4c4d-80f8-3c57ae92e05d", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662756173, "uuid": "5bb9637b-ef6e-403a-9505-0e51693f02d8", "value": "98304:5BTSWJx7Mvet2Fhh780QbYWuN2l5ug+2CxGzoyO+5jwH3Ir64QILp0:5rJJpwR5QbQNy5ug+lGjX5sH3KII90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662756173, "uuid": "35d96775-c4a9-403f-8435-2474eabd686e", "value": 5196752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662756173, "uuid": "1fe26b3b-715d-4ecd-8ba1-22c4d361326a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662756173, "uuid": "60c8cf81-4de1-4999-b524-328afe592aa3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140f74ec-3032-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1662722716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662722716, "uuid": "25a9f6cc-f91f-4fd9-a9b9-ad21cd5d08ff", "comment": "Malware payload (ArkeiStealer)", "value": "1bfbc076853fefb8375b767805b17f83", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662722716, "uuid": "261475eb-783e-4fc3-8a29-917613a7d6d9", "comment": "Malware payload (ArkeiStealer)", "value": "e6f32af1deec9f4ea14c9507c413349135cd26b59563c39acda47eb77b14b420", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662722716, "uuid": "06a27d0b-4833-4856-9ec0-87d6bb0a67f9", "comment": "Malware payload (ArkeiStealer)", "value": "a4c43b25067d70f78d69849d0f09a12c288107c6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662722716, "uuid": "94957471-daed-465e-85e1-f07a1cf01943", "comment": "Malware payload (ArkeiStealer)", "value": "6abf2929499eb979e16db678ba2eb4e2b514678ee14bd5b64a672dcbff024c3111511430f53b0241ed3cf002de587833", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662722716, "uuid": "c8832a82-fced-47d4-8ecd-1f7cabb44e8b", "value": "T18024CE52B5B1C831C8B215348070D7E56EBAB8636A38DA4F7744FBAF5E702D036B9312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662722716, "uuid": "f30732d5-9a2e-4995-8a4a-c2f91e44526c", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662722716, "uuid": "812cd81c-7f20-4352-b3ef-62fe8480d077", "value": "3072:hU99dU9FPecZjL65bWR0bBeixTaI3DM15tCm4BSBohxjxbD7/F7AOSXc:A0euKbvTaODM15fPKt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662722716, "uuid": "e55104e1-3719-489f-ae73-3e66e72bba00", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662722716, "uuid": "3d633323-fa22-4e9c-8eb9-a0edcf0292d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662722716, "uuid": "854d7c28-ea5c-41ed-b64b-97d12592e48e", "value": "1bfbc076853fefb8375b767805b17f83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c363fc2-2fde-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662686866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662686866, "uuid": "ac1aa4e5-58f6-40ea-8284-7bbc9da915be", "comment": "Malware payload (Smoke Loader)", "value": "d881172d9135cd0ed578952cda599e49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662686866, "uuid": "a4248ccc-ae34-4999-9fbb-9f385d04b038", "comment": "Malware payload (Smoke Loader)", "value": "e6fb897a53f94207c141e97becd73ecbdf471d34759e4edbce4b57c7ae26659f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662686866, "uuid": "7e760459-485b-47bf-bbae-0d1c9c698d39", "comment": "Malware payload (Smoke Loader)", "value": "373c1f2a8161abfc4973cac7403bc17fa86f2006", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662686866, "uuid": "d7edee89-acad-4284-8c44-f5581844c516", "comment": "Malware payload (Smoke Loader)", "value": "4796f53b809ae666d68ef0cab0e8a9e3379bbf82cd8ff9ced0501d8137d1196ef519e0633c9e0619c629ae5451a94d4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662686866, "uuid": "92be21c9-01bc-43ab-a9ea-6a40c23bfe36", "value": "T12624CF127AA3C431C4E745304075E7906A7AF8626A39894FB7543B7E2E313D22BB735B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662686866, "uuid": "d9a007a0-7cdb-400a-a794-762b0000a300", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662686866, "uuid": "c0a424e0-5918-4091-ba18-ff15e8fc4572", "value": "3072:CWtenFdeetbxcM5JcnV4PbXYW9GW/LwhZIJwHoeGmOvoVJeXCp:RyfdcMtPbXYeGceZ3JXSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662686866, "uuid": "310c880a-d5aa-4bc6-8be4-aaaec0828473", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662686866, "uuid": "b31b400f-9d5b-4f8c-89e4-ab2a5f1c7f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662686866, "uuid": "5d23d5ac-0889-47fd-b950-25c7651c56ea", "value": "d881172d9135cd0ed578952cda599e49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cc2706-3044-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662730820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730820, "uuid": "1656a0ef-6bfc-4569-b067-7d50e3e2f712", "comment": "Malware payload", "value": "6a1300ae53448e6c8a8a1b6502838edd", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730820, "uuid": "c2b759df-c433-4107-b396-a962527b119c", "comment": "Malware payload", "value": "e92f9426d971f0c150b17d8ead5c9da146bdf48f03fcec7071609cf362bfe211", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730820, "uuid": "288ff90a-990f-4a03-9bc8-89177a0df7c3", "comment": "Malware payload", "value": "90e803e78c423edc57044edae0f55131c10bb7d3", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730820, "uuid": "b4923fcb-5d0b-4da7-8be8-0db62d536f0a", "comment": "Malware payload", "value": "479288f0b80a39bad05aa9bfb143bc40fd58f391fb0071323e0b315405296fc5aaa4ea6a1cb6cacd7f4118e22c81c2e0", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730820, "uuid": "94d1fb1c-2737-4324-b5e7-020eedfd23fc", "value": "T1D1D11A3D1F0183A47E6F5B223126D8819B77A45A74C343EBA0009F796F14721EFA2DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730820, "uuid": "b239f557-f66a-40f6-b120-53c80a2c8aa4", "value": "96:pH0ToqW5y3ty8ZSmGOnnRi82pZiup6l/+emmEBYx5COYdROausejCmnIvchzyh4M:t1qEy3ttZKOnV2p0wWFY6IsokldG8Re", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662730820, "uuid": "e8a0a02e-a1c0-4ba1-8c97-18295ef7af54", "value": 6482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662730820, "uuid": "cc2afb3e-6791-4ad7-bf3b-00ce9e2facf1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730820, "uuid": "c41be9fe-6dc3-4c79-9c9d-544084c65f8c", "value": "Document8045.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb88a40-3064-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662744527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744527, "uuid": "a98955ed-c699-4813-b557-7e8fa1aa81aa", "comment": "Malware payload (Mirai)", "value": "dbaf6d7a5ddeed82785952392b3e0796", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744527, "uuid": "a30398c6-dd9c-412c-a586-85181c046195", "comment": "Malware payload (Mirai)", "value": "ea9bd2721b43bccbb02f385c44c0b6d1705519e4e445a45e8fefaead87423352", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744527, "uuid": "771c7f47-8d70-44fe-8eae-ed530e4cfa95", "comment": "Malware payload (Mirai)", "value": "ac65a0a659e32e8a949a5e921e4b74b3ca7af10c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662744527, "uuid": "d522a095-7b30-413a-a8c5-bd8a76d1f63c", "comment": "Malware payload (Mirai)", "value": "c57deacd60127c233583660ab876f327bab66869bfd60064447d69d06d1653f9583045894cdc75112eba56f25a203224", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744527, "uuid": "d1c0228b-50c6-4945-884e-0434d594282b", "value": "T1E0D34B46FB818F13C0D61779BAAF42453323D791A3DB330659286FB43F867AA0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744527, "uuid": "7ce2a56d-f0b6-4a6e-b087-2cccdb4573d9", "value": "3072:FpcwfWJvwe2L0jZBS6UFBKe2kvMjeGJSzVaM/9omywPoIlq:FpcwfWJT2UHS6UFBl2fDJSz8M/9omyw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662744527, "uuid": "3d6d890a-d77c-41bb-a25f-54dc4893d865", "value": 131723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662744527, "uuid": "8e13a1cd-0111-4c39-ad2a-5c504f0893b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662744527, "uuid": "91525c1e-3080-4b2d-89f1-4bf320cebef4", "value": "botx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3f29d6-3033-11ed-9266-42010a9c0072", "comment": "Malware payload (Tofsee)", "timestamp": 1662723322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723322, "uuid": "0f9bfa84-18c4-447e-a095-2dcce8e7f242", "comment": "Malware payload (Tofsee)", "value": "e3cd13fc8c5dd1ea1ffc66a1e2b7ba40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723322, "uuid": "068bcd8f-4d90-43f3-9fc7-6d7e4682c7ab", "comment": "Malware payload (Tofsee)", "value": "eade9b26302f962ba5ef6595af726808d6454e2b058ebc144dec23f36ae57fef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723322, "uuid": "da74a051-256d-4d29-89c1-7c198b65124e", "comment": "Malware payload (Tofsee)", "value": "fa9ef10afa16d509c88a2455a2313c9a72351a24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662723322, "uuid": "6ff69e96-08c8-461f-853c-0d3de741aed3", "comment": "Malware payload (Tofsee)", "value": "3fe259957bb54974596dbfb277f2fd3ae88142e7d8e5b743cd8b7ded089ff42bb6f06435f0bf5a43a29a1807d492e9c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723322, "uuid": "f2820f1a-f79f-4d3b-a1c3-4a7fa9521c41", "value": "T12E24CE21B5F0D472D2E685301434D7AC2AFABCB21A75A84F77553BAEAF703D022B5316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723322, "uuid": "76072adf-b560-4e4d-8ed3-762ba6206c07", "value": "5d5b8d072fdd778d9ba9ec0c36bae15d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723322, "uuid": "973a6809-a0d7-4a4a-a265-90aa8a1c4c0a", "value": "3072:DqOTzRpKZp5Fr5FRsw9zcYtF7k1IRxDz2:cBT9Rp0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662723322, "uuid": "7d47eaf4-2cf0-45a8-b5cf-cdb803df653f", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662723322, "uuid": "89d1c90c-730b-4647-a4e2-d065594d0dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662723322, "uuid": "b4e0a6fb-49e2-49cd-8e5d-9927479c5650", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375605ca-303e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662727929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662727929, "uuid": "128e8e78-be91-4f1c-9013-5bd57c1ae2b3", "comment": "Malware payload", "value": "610def88fa432553f911e0e6e7458d7e", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662727929, "uuid": "e3db0f1c-2e16-42c6-8470-7e36edd9b161", "comment": "Malware payload", "value": "ec16c9672b26e63ffa77e33a099fa29e53233dbe3157daf45767f4bab1642f61", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662727929, "uuid": "7cd5836d-175b-49d1-a686-2f26aa11363d", "comment": "Malware payload", "value": "ea08706373d48e2e9de01b1ffb14d9de151d1442", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662727929, "uuid": "0088c8b3-3d60-458c-bfcb-aad74d49eb3e", "comment": "Malware payload", "value": "1853772344804ee6385aa2d0d8a29a48d34ebfa2e0a792e009d9fb97c10cf9677f8487e6ec6bf7eae54b5090ce51beb4", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662727929, "uuid": "5a37da51-e83a-4f65-8f4e-4821a8c3dd39", "value": "T1D75292250B10C864BE5376BA361F8490B9454D4A795C6589AA06DBF8FC01F24E9FECB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662727929, "uuid": "105c47f9-5167-4d74-99a5-9d1b2e6d4b5b", "value": "192:eVUFeP4iR5kAbFgxXG548PCuLPzeI0lWCs2jFQDOqaRmdLWnjTC:Lcg+kw0EB6g3z25QK2ijTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662727929, "uuid": "fffcf3af-44d4-4295-8860-31142b28f953", "value": 13726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662727929, "uuid": "e6e54b1c-0873-4fba-b498-2c2d4a7f9fce", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662727929, "uuid": "465991f2-089b-4870-b432-c83604c9fa68", "value": "Data##.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b6d7b4-3076-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662752146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662752146, "uuid": "044dcb5b-50c4-4523-85d4-9c066d7eec16", "comment": "Malware payload", "value": "85cc19142e21ab630aeae7fe30739ee5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662752146, "uuid": "a0618bd1-632f-41fd-a66a-64706b718f09", "comment": "Malware payload", "value": "ec6ae1eb0421ad161c99fc586e43d6b7509f5a41e85bb5a3b3490d97034aa062", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662752146, "uuid": "07e52561-bdce-4e50-bf6b-4c5ca149ec1a", "comment": "Malware payload", "value": "939550700e73670a322e6b33d6ca1820522911ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662752146, "uuid": "2d5236ff-3662-4046-82a2-9ac064363025", "comment": "Malware payload", "value": "795bf1d2dd0bfbd98041e563631e5c7b05f9f6c9bda7403f38c5cf8f37325b65450d03b96f490f102ef29fc433bd6388", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662752146, "uuid": "729a6d71-5b15-4111-9e6d-c85fb7d8944a", "value": "T193149EDC766434CFCC2BC8728EA81D64E660747B930BD253A09766AD9A4CA97CF150F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662752146, "uuid": "514b8cb2-380a-4d1b-9530-2e7c57123ee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662752146, "uuid": "2f08b6f2-0ce7-42c8-9113-ad3d489f9b5e", "value": "3072:z/NDVyWpgNw9syMyjPP0apZjnXJiubkyP5QalYEQs2lWgW87PAt+M4pLSxlHyuYj:hUPNwuUj8azZiMBQa+KgTK+M4pLSxlYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662752146, "uuid": "08d900b3-d6d6-4baf-9c4d-836fe6c1e523", "value": 193968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662752146, "uuid": "ff668adf-d35b-4cfb-ac8f-2bf3de2c6cbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662752146, "uuid": "dbe565a7-0f35-4b35-9f8a-5051a1dfeddc", "value": "awb_tracking_invoice_090920220000000000000000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5002aa94-301e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662714226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714226, "uuid": "f3d12b5e-dec5-49f9-aae4-bd94a9949077", "comment": "Malware payload (Mirai)", "value": "55b74cb4bc8ebb5891f02819107659ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714226, "uuid": "f9dae720-7936-4b4d-9ca3-b6d2b10f3c87", "comment": "Malware payload (Mirai)", "value": "eca45d5f8677c10a2205eb6b6a538cb51cb3f77a181236defa287ea60fe0b344", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714226, "uuid": "6092de18-5b4f-48f9-aa50-a45f70596c92", "comment": "Malware payload (Mirai)", "value": "88720285fc6b7fde5cab6245d06de92a1be4c48d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662714226, "uuid": "6f1c75ff-4ad1-4712-8d54-65baf29165c7", "comment": "Malware payload (Mirai)", "value": "a78b191eb70a238b80704466ad7a4ff4fa498d43350d38cb4396f76259279fb08bfa40f2598c46a6b144bda1cb1a06b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714226, "uuid": "40509d69-85ec-4abf-9cb9-45601d94c043", "value": "T1F9E2E17EDE296DCBC6CDDCB9939F16238E6821C5102BCE84A3719D84B72B04F62540BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714226, "uuid": "f5ee1ef5-f187-4d19-b4b6-f71e463a7961", "value": "768:FIaQ92Tz3xYJ1fMenHzzAn8DkDqZN37S+MWTNe:hTzhYDfMeHzTkI37TNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662714226, "uuid": "4ee76d9c-8871-4d3c-a5c9-30d4b36a35fc", "value": 32756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662714226, "uuid": "82216d44-aea2-4c00-8e5d-e62eb91f87f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662714226, "uuid": "91806ece-7a86-4633-b7c3-d2ba23ba6046", "value": "55b74cb4bc8ebb5891f02819107659ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d439124-3044-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662730677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730677, "uuid": "05d2feab-0b33-4353-a2dc-7b63c2b14f85", "comment": "Malware payload", "value": "cf78caca1237dcc03fec8737d201df91", "object_relation": "md5", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730677, "uuid": "ff036727-71ad-4bec-952b-2c780f7840f6", "comment": "Malware payload", "value": "ee14270f6fd443edaea6a7e4a12d67b8f1a3debe3c3e5f280480db40672c6b26", "object_relation": "sha256", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730677, "uuid": "07289063-455c-4b68-991b-f3bac6b4c33f", "comment": "Malware payload", "value": "2e840ef80f40a64a6f2d02e58d560a1692d90466", "object_relation": "sha1", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730677, "uuid": "70aba582-5cac-4fe1-8745-c6f8b0a2d392", "comment": "Malware payload", "value": "fd9f5ea1814514031f77c41e83d237f3d8a49328ab48a38c89e3316569e893a78a6b0bb6db9c35b5be450fdf5c1d2446", "object_relation": "sha3-384", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730677, "uuid": "dd5e2485-0470-4ee6-af9f-6d32c7b203df", "value": "T179A4AFD568AF8046E884BCF05096B7735BDDBDBB2F09CAE71B541D2BE8312C191264EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730677, "uuid": "48e0b8dc-f99b-483a-a882-3d4371cce91b", "value": "84df75911ee4a4dc00765ff38f6b934c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730677, "uuid": "137e18fb-5e05-47a7-9519-6698bd626496", "value": "12288:nDFhSg4nkx/LMw27kcmgexU51plXKixdvKXsmR:nD3S1T6YhxlNqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662730677, "uuid": "82ef1435-1b64-4e46-933f-05e3bed1ac49", "value": 454780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662730677, "uuid": "cb844b0c-d639-4d7b-8cc9-f49b1d04d341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730677, "uuid": "c37b77c2-a76a-4c7e-a063-abb69c3fe478", "value": "0509.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae77667c-303b-11ed-9266-42010a9c0072", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1662726840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726840, "uuid": "c7d656f1-1f5a-41df-9587-55fdcb47f6ae", "comment": "Malware payload (ErbiumStealer)", "value": "ebaabdf5285a1090878505a7c7736ec7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726840, "uuid": "ae96d83c-4a81-49ac-bd84-df693daaa2aa", "comment": "Malware payload (ErbiumStealer)", "value": "eec9517a9aaa43f9960212117b331b73f7de2760c181ca31f3576cb65d7b011a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726840, "uuid": "ff01d837-5f55-4042-8641-6b806f5ca5c0", "comment": "Malware payload (ErbiumStealer)", "value": "6bf1f2d4a9cf30067b7a9d5bb4698c9a76bc58b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662726840, "uuid": "e86bbca5-365e-47e3-894d-6e5c42cb137a", "comment": "Malware payload (ErbiumStealer)", "value": "5bb852c180e66f4427ac769151539bbe67df0a88a4928d259ef45bd07c6f4e9835198939757b54a895a8c41b85ecca45", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726840, "uuid": "4a95f027-93db-4d8b-9adb-49a47d2daff7", "value": "T1E0D58E31E643D061D9C524B0EA7DBFF26C38992487B860F7E6E40CAAA5254D1733FB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726840, "uuid": "e7ce20d7-df35-452b-b55f-38c6814335f9", "value": "c0d46b7ff0e53996feb53e4ba78f033e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726840, "uuid": "835fdc23-6f2d-438d-b40d-fbc7590efa4d", "value": "49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcL2ek:P1Kqvv07noI7lOOYcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662726840, "uuid": "654a6eef-bd87-4f1b-bac2-10c344f210c1", "value": 2877952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662726840, "uuid": "0b4b2b5f-bc23-419c-b911-be2a1b25611a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662726840, "uuid": "58527829-a349-42de-af3e-a0c517ec2d77", "value": "ebaabdf5285a1090878505a7c7736ec7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e379f092-306e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662748833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662748833, "uuid": "01d51059-4161-4d41-b441-8558c9d2ed80", "comment": "Malware payload", "value": "ffdd65013b75a1b0d89eae8ffc14af2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662748833, "uuid": "c34a4cec-dde5-420a-9bf2-6e9c34601f11", "comment": "Malware payload", "value": "f0b94dac29d072d1b6473f80fa74c4f9b0831b9439f8670721c6c5b5a93c6c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662748833, "uuid": "41e6aa0c-671e-4bf4-b451-64cf7d8d6632", "comment": "Malware payload", "value": "8046bacdfffd9249402788b49add906619301c6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662748833, "uuid": "dd5a20aa-87ac-4269-8be9-6932162c4664", "comment": "Malware payload", "value": "f97b0051c890125815ca00b68bdcab42cd6d39916e57d36cbf467d5f2929bee7a84c2444e1f9540eec6a942d04bfe1ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662748833, "uuid": "b4b12cdc-b2bc-444a-9166-3d9a3edbd810", "value": "T1E324CF26B5E0E832D5E746348438E6D82A7EBC621A74994F3F553B6F2E303E12635353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662748833, "uuid": "6af531b1-d662-4625-b402-f20f8a900c9b", "value": "d222372a7f8612f1284f3a88f8d20994", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662748833, "uuid": "6df0fee5-6c89-4d39-b9ef-6be3bd7b2d91", "value": "3072:R4KBFjmTPk3/3H6xzz/5osPw7H+NefT/T5FDg/aXMEOE9oAo1wx:KA3fHczWsPw7eYT3Xo6ov1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662748833, "uuid": "a7b28528-f0da-4492-b76f-107a69a06d1f", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662748833, "uuid": "db8f47ef-4f9d-4a2d-83c2-c48b02381eb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662748833, "uuid": "40bc79c1-b58d-44d2-b606-86e465a004cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515f9839-3080-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1662756319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662756319, "uuid": "44bad863-1158-45a7-b33d-ed567eef51f1", "comment": "Malware payload (DCRat)", "value": "542fb83e248cda67f5f28eeaa2949e91", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662756319, "uuid": "7ad1b2a8-db86-45c4-9875-dbbaf10b8f29", "comment": "Malware payload (DCRat)", "value": "f1aa98847830596c1ed4ac1b7713d3025a5e614201c7ec9ef18245d11b4c4547", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662756319, "uuid": "cec9e9de-9377-4524-bfe6-99c999924677", "comment": "Malware payload (DCRat)", "value": "b0eac614e29d2f352211c6f4901c9a2a2a68b740", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662756319, "uuid": "64aad6e0-b458-4ab8-9545-ec4b02c961b5", "comment": "Malware payload (DCRat)", "value": "b3f1d3aff2efc8687c9eb5689c4f9128af2b87b57af32e834b23f063f79c31282464bd845d953a68e84fe84d601c4285", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662756319, "uuid": "6d046c9c-af03-42da-9142-8eb409cf89c2", "value": "T131658C117E44CE11F0185633C3EF459857B0E961AAA6E32B7DBA3B6E15123A73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662756319, "uuid": "c4397964-4b2a-4fe5-b10c-e97a756b7d9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662756319, "uuid": "5c43bae4-f51b-43df-b37a-6438140a729a", "value": "24576:PT/pW8ayYby0MEoBvzdmshBCuY+3nMT5rTcafazmhXaZC8W8t7Hu:PzpLe1ME4vxmsydwvCF8tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662756319, "uuid": "d28b5ccb-dd74-4be3-82d8-f99384790cdb", "value": 1545216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662756319, "uuid": "982878b7-256c-49e3-b6c5-6558da4221cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662756319, "uuid": "3c3d63a5-8fad-430a-965c-cb273a72ec6c", "value": "542fb83e248cda67f5f28eeaa2949e91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316025f7-307d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662754977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754977, "uuid": "6b8b4912-06ca-4b6a-a3fd-937253353487", "comment": "Malware payload (Mirai)", "value": "714dc96bc96bcc5c992340a105515ae0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754977, "uuid": "1d7bee7a-a976-4f3c-b748-d0cbfdd77b77", "comment": "Malware payload (Mirai)", "value": "f1d51e8effc31023ebd49db2de37fa0f3f4ce67d5ae7de462cdca0719a876bac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754977, "uuid": "ba4688de-560b-40f3-bc38-d01d444ab7b9", "comment": "Malware payload (Mirai)", "value": "b8847bc11f07f325230216b51bc4159c218f799d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662754977, "uuid": "da7fcf8a-c2d1-4276-a7af-8bca94febbb0", "comment": "Malware payload (Mirai)", "value": "401de385b9641a796f8c13335d458362d89835a4c2be25b3448d1eca7aae0b8806009b1264cd6d2a44f34bad2a252b6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754977, "uuid": "00379c73-a708-4194-ae42-96ab0d288ea9", "value": "T162E2E002906F8E66E43F8935ACAF1D0B946224563090EFEBD7D9397EAC70F3C3594919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754977, "uuid": "913da8dc-5edd-4d85-a73a-c631c32d2437", "value": "768:pxhPp8EmVfHaxyVabslW9rg0Z6d7c634U3ooinbcuyD7UryqK:pxhPpofHCyV4sw9rtS78Sunouy8mqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662754977, "uuid": "4d0b26e0-724c-4a2d-b883-277d6506c8d6", "value": 33568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662754977, "uuid": "e4d5cc21-cd6e-4536-a722-9a1b73c0f9a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662754977, "uuid": "a27273df-971a-4a75-afed-7380de78a61c", "value": "714dc96bc96bcc5c992340a105515ae0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f7d7a9-2fdf-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662687102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687102, "uuid": "19441e48-b27f-46f9-af81-9ee2ed4c26f0", "comment": "Malware payload (Smoke Loader)", "value": "dce80c48700d84760fcd138dffab2af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687102, "uuid": "81abe789-4242-4a0c-879f-5621c5e38ee0", "comment": "Malware payload (Smoke Loader)", "value": "f226da2336fcd31d640f8ab4af39c163747f730885c382767f7553405c59443e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687102, "uuid": "6ab02816-2711-4e25-8d9d-bf3ec28987e8", "comment": "Malware payload (Smoke Loader)", "value": "a3f39d1c577589ceab577db1733c9fb18ec2e097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662687102, "uuid": "60a1b74c-bc41-424a-b3fa-e26a089b5175", "comment": "Malware payload (Smoke Loader)", "value": "fb737697a15c438fc0418cac6417b210d83297feaa72956ccf6a15989493a7621228e7ba5feabc688456d952896f82a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687102, "uuid": "0bdbc750-0c31-4e6a-9d2a-1f49f4c4dc21", "value": "T16524CE12B5E0C871D4F241704031E7AC6ABFB8656A38C94B7B547B6E7E313E12A79327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687102, "uuid": "aa20bd49-bd3f-4bd3-a345-719e59a60ec2", "value": "b99f18fdee2a56d1879b58f035fa58cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687102, "uuid": "67f6f1b3-1cb0-40e7-945d-e2fdbbccf767", "value": "3072:T1IK2XC1J5wxKKJcL4dE2JYRbgsJQ4DSD8mQ/jqwWBfp:23K5KKEAEaEQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662687102, "uuid": "c056bdf9-6d76-4f7b-9321-b409d75f29f9", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662687102, "uuid": "028944ef-45ef-4ea7-a31d-7bfa8e35c96e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662687102, "uuid": "a32ff3c7-9227-4ae9-bff5-f3ca8285c335", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97aab63e-3002-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1662702321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702321, "uuid": "8b591b5d-0c87-40a7-b788-5b1d274741c4", "comment": "Malware payload (AveMariaRAT)", "value": "2f8d14b46282f97d0c0d22688a5e9c48", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702321, "uuid": "ced11f35-5ddb-4d4f-9e83-1fccc8c83d36", "comment": "Malware payload (AveMariaRAT)", "value": "f24d707fa75b81ddd51ff597f98cd38951ce0558cd653b392bca75c15fdeb1ed", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702321, "uuid": "40ee29d7-28be-473b-8d88-f2bb946213c8", "comment": "Malware payload (AveMariaRAT)", "value": "695fcae40c2327c5bd31c8a89233d5a30c146436", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662702321, "uuid": "36402b51-b1d4-41a0-a011-3d7f26b2e504", "comment": "Malware payload (AveMariaRAT)", "value": "0208c47d62a8a8ad1f5adb1b7f5e2cfc727c50930e0a5587b8847f8e336c2fd0526ce48093f65eb7f52ca6be37ce6005", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702321, "uuid": "c5eb40de-091c-43ce-97c9-61ac97d72c1e", "value": "T159258B017CCDE939F7481836A1507E7567F26C46CC12B29E359CF4DF227CC6A2B2A296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702321, "uuid": "86d3db57-27fc-4d20-960e-24d6cdf293b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702321, "uuid": "5867b091-6893-43e4-97c1-e389efddeba7", "value": "24576:McK3GFOYT08rI/hNK4dcjSxeV/HT5CaA:q+yhHI7/HT5CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662702321, "uuid": "04a3c8a4-f9cd-4e3c-ae39-bc4018a4ada5", "value": 979456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662702321, "uuid": "1c2a92c1-e352-4c6b-9efb-79b06454e1fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662702321, "uuid": "6c26779a-25bf-40a5-b885-90d5ba85d29b", "value": "89104310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f31cd87-2ffd-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1662699944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662699944, "uuid": "d3e2791f-d24c-4fa0-b8ee-dd891f082dca", "comment": "Malware payload (CoinMiner)", "value": "3eed6e24cd893894e2fd631d3021b187", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662699944, "uuid": "45f565a7-f4ae-4995-91a3-a9adcdcedb48", "comment": "Malware payload (CoinMiner)", "value": "f456da0a6b3237fc4f0cd0c2ccc440acd6fb56377dab0d37b86f777f4fe1bd7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662699944, "uuid": "6c037428-3a55-41f2-91a9-50001cce09dd", "comment": "Malware payload (CoinMiner)", "value": "bc857485b6dee1d7addf69869480a245eb7ce77f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662699944, "uuid": "b3debdf7-6dec-48b9-a72f-9b7bb32830e0", "comment": "Malware payload (CoinMiner)", "value": "bbf2b06dd41cf7b4888b4d2f19983e3ee338b8ba462d530f93265afab6f693afef8938eca422a550003ba4a5b8cd87ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662699944, "uuid": "e16e6a28-7cdd-45d4-b0da-bf330aca2648", "value": "T10024CF21BBE0C871C1E25A348435D3D43A7BBC62AA788D5F33543B6F2E702E16675366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662699944, "uuid": "234a2862-03e8-4f15-9125-461cbb2245f7", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662699944, "uuid": "213d8bcb-96f6-4351-8f5c-274537b8068b", "value": "3072:xycRnnIy6BLd3X650ckCWMRcRHwxuBjPojodh5:PRiLdFckseHwxuFModh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662699944, "uuid": "f631a266-1b19-48c8-92f8-ff3ff1817e45", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662699944, "uuid": "4dcfd35b-164f-4033-9a01-187d2a708792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662699944, "uuid": "0718d0f8-509c-4068-b065-29c3f0e3bc1a", "value": "3eed6e24cd893894e2fd631d3021b187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ebac0d-3013-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1662709398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709398, "uuid": "04d98195-feb6-49b0-8551-726400dd31ae", "comment": "Malware payload (Smoke Loader)", "value": "5498939cdba1d0671e7266dd797cc8d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709398, "uuid": "0b743ba0-7e63-4bdc-9e09-bee7d856cf58", "comment": "Malware payload (Smoke Loader)", "value": "f4b92f9513750b94b08a36f4802657ef22790784cd75fbd425d967fd5f5085e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709398, "uuid": "16191d78-be00-4775-a75c-ced4fdecfffa", "comment": "Malware payload (Smoke Loader)", "value": "327dcc0151995c132c40c70deb7715cc5e21554a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662709398, "uuid": "7af1806e-2a22-4412-a2bb-67055170bc41", "comment": "Malware payload (Smoke Loader)", "value": "68bea87926a4637dd4529d7ef3888da10bd204cdd3644c47a9c10cadb266f760138853838a603591f2179dd9d132d594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709398, "uuid": "7be85e09-93c2-40ac-862a-f8711e684920", "value": "T1E324CF5EB4DCC872C4E245308034D6A46ABBB82A6674998F77683B6F2F323C16775317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709398, "uuid": "539de7ac-0dfd-4283-a192-283a91fbbb84", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709398, "uuid": "0afc4cd3-6207-4e7b-b177-e8bd51a128a9", "value": "3072:9rdZhx4Hg+el65TYv7vk23G/0pUhjEsSBM7Ta3/6tAf3:3OgfNvzk23C0yhrIM7Ta3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662709398, "uuid": "84a696c9-32e8-45f7-9921-17462a49a275", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662709398, "uuid": "517fd87e-2fb4-4381-becc-31211aa52557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662709398, "uuid": "5f4ab751-e8b2-4273-87db-f86815354b26", "value": "SecuriteInfo.com.Win32.Evo-gen.20849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831b4e10-302b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662719895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662719895, "uuid": "20a3369a-a1da-43ab-a7ea-c903527c195d", "comment": "Malware payload", "value": "ab3df5bbb576a642cd7217eec843c1bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662719895, "uuid": "caed56e9-86af-4970-b8d5-bac02d560192", "comment": "Malware payload", "value": "f857890d674a9d4abd8ef6d735c7c03eef0a75777c64cb4a62917d12b68dcbfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662719895, "uuid": "e3b587e5-c986-4c44-b927-64faf55e9c9a", "comment": "Malware payload", "value": "6b80852cc646780846f39f3aeb49a33efcf58fe1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662719895, "uuid": "febbc529-965b-4d5b-9877-32113b80c793", "comment": "Malware payload", "value": "35ba3167c99cd653a90d3637ea69edf59cfae1509712cbf4c0ed32447ce31d7c296671e21fbb1f0b54699374a2711ceb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662719895, "uuid": "ee835b64-d101-4818-ad7e-04ffef34a183", "value": "T12674BF627650C1D1D1A56F33F51B88721A367D2E1A30910F2374BF2A3FF9683D929B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662719895, "uuid": "fb886546-1573-4259-87d0-e18d951aa4d0", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662719895, "uuid": "b6759dd1-95d6-4134-b9a2-cc734ee795ef", "value": "6144:0p+gg5PJgKl4jw8pmRdIwgX1EKOrAULAM1WnGN522/zL:UigKl9yIdwlEXzWGff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662719895, "uuid": "db0c5305-0937-4819-bd17-8bc169c26187", "value": 363840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662719895, "uuid": "1d945877-048e-470c-bb38-b565e2d5db6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662719895, "uuid": "33fe5242-b867-412b-81eb-b4ce3c31d4ab", "value": "ab3df5bbb576a642cd7217eec843c1bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462e7583-2fdb-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1662685434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685434, "uuid": "dadd98f1-01f3-4ecc-b67a-6f3ccb38294b", "comment": "Malware payload (RedLineStealer)", "value": "5874b7cecc489466aa7b2e6f15f9e015", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685434, "uuid": "baa137c4-c7e0-477c-8266-3d0d2ff76abb", "comment": "Malware payload (RedLineStealer)", "value": "f96cd73f1247afe82afaa6b582c2944951f23a7e8f7514fcb9f0fbf851b2bfce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685434, "uuid": "791f75ab-e059-40a0-baf8-70190690c6bb", "comment": "Malware payload (RedLineStealer)", "value": "65c1d5f0805c80b797ba0a07734e4c37a090dd82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662685434, "uuid": "384a1a43-fa00-4bb7-af3d-7771cea6b0e5", "comment": "Malware payload (RedLineStealer)", "value": "87bb2318172d75120006a4ae8a56c427bb55eaa25b0060cca3b12ad16107c3b1968e0c84855a4d5770d727edbc9736dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685434, "uuid": "c9920558-aa06-4405-a73f-0d9c0159224b", "value": "T115B3396477DCD904E6BE8F7078B1119543F0E2136902EB6F5EC510F91EA2B84FA21AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685434, "uuid": "f5b812d9-3647-4fa1-8ff8-3e9d964c4ceb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685434, "uuid": "3b57002c-ca23-486f-b647-9937b7d6f5b7", "value": "3072:XcvFBMCYspi4IVpx1xng7ty023Jt2QcFrjTrho4EASNR:XcvK3Rng7tg/cprho4jS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662685434, "uuid": "9e91e92a-ac48-4051-b4f2-a584530d8368", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662685434, "uuid": "734ed070-f183-4fbf-b326-626c57ebb318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662685434, "uuid": "fd1ceeca-3b63-43e3-9b29-2209117b15e6", "value": "5874b7cecc489466aa7b2e6f15f9e015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b108107-3026-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1662717627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717627, "uuid": "3a3cbf23-7111-4c6e-843d-6131ca2cf215", "comment": "Malware payload (Formbook)", "value": "7af0d42847a6c293a5792bc985991db7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717627, "uuid": "6f2ecd61-3d07-4d50-9657-19f8880a76d3", "comment": "Malware payload (Formbook)", "value": "fabf08da20fd8737e3fa9f8955422c8b12d14ca6d99fd16d13cdf5eedea58c46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717627, "uuid": "a4bea8b0-d49b-4e8f-a617-a7c6316678fd", "comment": "Malware payload (Formbook)", "value": "25a98dd42fc45f8bf61010ce238465c118911396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662717627, "uuid": "10046306-51fd-4427-a9a5-887d6448fa8a", "comment": "Malware payload (Formbook)", "value": "2fe928d0677dabe12e32c32b5dfa83f0a56b6b79ef907da6390a6294c71f3288e0158903d4169ae9364e5875251e6fbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717627, "uuid": "d99e4f94-99ac-432a-b08d-3b6c2054269e", "value": "T19935190721940BA5D07253FC20DCC1728BB99E45E63FD945BFC99CEBF592F2846D22A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717627, "uuid": "6b94e1bd-18e3-437a-8c51-6bc1b7643cb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717627, "uuid": "f22d49bc-a766-414f-9655-c2747ddc0e8e", "value": "24576:BkxmXun404azwb4J9Rfv3Fc98ymgiTkpn:Bkxkarzwb853gZm/YJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662717627, "uuid": "0c3f2190-3896-4fd1-ae7b-1ab48c87a15f", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662717627, "uuid": "54691e7e-0192-46e9-9abe-bc899cc1c501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662717627, "uuid": "0d0ead98-eb25-4a10-8b58-02b1b5058ef2", "value": "Re Payment confirmation against Pro-forma INV# 001PR2022, INV# 003PR2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48afcb1f-3058-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662739125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739125, "uuid": "5686105e-8e38-43f2-a1fd-e69168f6ac57", "comment": "Malware payload", "value": "e33d877aeec8818d72035377f935768d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739125, "uuid": "7c47025b-d30a-4234-9c75-96b416be3e26", "comment": "Malware payload", "value": "fbf66aa4641ee40b89b7adeb3479c0e3366991ebbd22c513e25223ac62116141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739125, "uuid": "882fb89d-dbc4-412f-bbbd-c9370083c025", "comment": "Malware payload", "value": "4ac4a0a50c9ef6da3054bd5323661f02d586c61c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662739125, "uuid": "caa60098-f0e9-4403-8a35-edb0d7c73dbb", "comment": "Malware payload", "value": "80a30dafdc6a4c2a7f2a47cf9d196d86f8677d9060cd3d5ca2e76ac8fc8b0fb2e2e526cae2fe625b60b7a21e9e41f5b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739125, "uuid": "bbfc4d74-194f-4434-a4c8-9a9d4f3641f5", "value": "T1F7063389EF296376D13A6830281315CCD1B109922EB5DAB72FE5678979353BED0B7303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739125, "uuid": "c09b7397-e558-48ab-a01a-651947d0a9da", "value": "c21097c2852315e171a310c6ddb24202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739125, "uuid": "b8dc55a6-fc8f-49b4-9b5d-961ec7e5b67f", "value": "98304:w9s1MuuckDr8MzdvX/Rn69WFTrKgVo5cPUjPPKw:wBuiDr8MRXBjF3NWcPUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662739125, "uuid": "55f3e626-6847-4f35-995b-2ec2053103de", "value": 3910656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662739125, "uuid": "04c0efb0-6936-4a1c-b64f-30d02dc76ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662739125, "uuid": "4181e531-27d8-458a-a0cb-4546ac97ff25", "value": "SecuriteInfo.com.Win32.Malware-gen.30674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6071ab8-3053-11ed-9266-42010a9c0072", "comment": "Malware payload (IcedID)", "timestamp": 1662737241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662737241, "uuid": "712b554d-caa9-4324-923a-0574bdf26d71", "comment": "Malware payload (IcedID)", "value": "94c90a08262f15574b39eada9d0b041c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662737241, "uuid": "8206eae2-c2b6-49d0-b0a7-b87787f4088f", "comment": "Malware payload (IcedID)", "value": "fc09f20a9c60dec0abca50f80f47c27c9e888e43ce43c8e636ea2a9d9ea350a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662737241, "uuid": "42179375-99ef-4f24-a1ad-480d9e26d7b5", "comment": "Malware payload (IcedID)", "value": "76aa13af04a059e699a3f880831c1b0493917fbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662737241, "uuid": "f2e1786d-e422-40fc-ad17-de0bce7778fe", "comment": "Malware payload (IcedID)", "value": "dfe0cf2b70456502286c20d1b5aecb953d38bbe303cda57a0633ccb44c84118a97ee0cc7f64c0e00812d38420a4c51a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662737241, "uuid": "344b98d1-73dd-4e12-a6ba-801cf2518cad", "value": "T10AF3AEB0E380B634CC3BA1B2A5AA37D9717131C9FE068D44D5DDD99700E7A8BB1B09D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662737241, "uuid": "9a7b4123-2a94-4c67-ae1e-a7d4f3773a33", "value": "31e9ae7ca381062d39125d4cb3af19ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662737241, "uuid": "54a1faeb-5f49-4579-9df6-0320b8494577", "value": "3072:YmNsOmuc/fJLhWmxJ83igoaNYPDzZwvtn2MH3Oj0rC2Bc:dK9jJXhYJGaBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662737241, "uuid": "0874566a-4899-41d8-a92d-973143d5fb14", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662737241, "uuid": "3dde6ec7-a7f1-4cd0-acbf-5da8cddd42a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662737241, "uuid": "09a46d76-a68e-4e93-a882-3fc3556fb32e", "value": "58KBycsUsB7B.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e657b6e3-3016-11ed-9266-42010a9c0072", "comment": "Malware payload (DeadBolt)", "timestamp": 1662711043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711043, "uuid": "272cde48-085c-4d06-8ed1-01f3b45f4b85", "comment": "Malware payload (DeadBolt)", "value": "db885d6fa6a57485e7befb632ff28256", "object_relation": "md5", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711043, "uuid": "e085b004-0742-456d-9142-0e23346e4101", "comment": "Malware payload (DeadBolt)", "value": "fc2c4fbbe59d850431e0fc7c8c96882ae482609f2433acbc40017be968a79b8b", "object_relation": "sha256", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711043, "uuid": "06d53f5f-eb41-48a7-95ad-4d13412be585", "comment": "Malware payload (DeadBolt)", "value": "027a6e5cbcdc1e77dfbdfe1a7ef84c21a4d656dd", "object_relation": "sha1", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662711043, "uuid": "6642aaeb-1ddd-4627-ae6c-7441ac6b40f8", "comment": "Malware payload (DeadBolt)", "value": "f1f56bc4c47885f063f76a4ac3640e8f187bbd53beb576525f6fe3092ec5249c00e0f98db66c45426afb51e7afa37988", "object_relation": "sha3-384", "Tag": [ { "name": "DeadBolt", "colour": "#DE0FB2", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711043, "uuid": "710e9b8f-a02e-445b-8b0f-90e6761de540", "value": "T1F12523CE860F802B6C0137AC17469690D6D2F36FA6585A611C1AB99F7B31D531AFE03F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711043, "uuid": "7a90bca5-dd26-457e-bf02-53637855e8b1", "value": "24576:BtUUToj/FjBb4UhVVWg+zkCG6Edff6wCzZHb:v38jNVMUhbWg+zkCG6aMxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662711043, "uuid": "eb1a1e58-4083-4f30-a75f-4ba5c872fc74", "value": 1003776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662711043, "uuid": "90f3f370-34e2-4d4a-82d3-c3a0ba7df45b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662711043, "uuid": "1079e55c-ae88-4a35-b205-78171c9abd26", "value": "fc2c4fbbe59d850431e0fc7c8c96882ae482609f2433acbc40017be968a79b8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1cffb7-3043-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1662730224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730224, "uuid": "e2d89f01-53b3-422d-b2f9-753c35108747", "comment": "Malware payload (Loki)", "value": "81f761890347677f68f51377a90088d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730224, "uuid": "248f3c3f-58f0-4104-bdf6-633398cc8ff8", "comment": "Malware payload (Loki)", "value": "fcfbe1b3a8e7b3832a008ccb6d9ec0bccaa7f768a492810f856410d7eea048c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730224, "uuid": "1a060c53-8a8e-44ae-97e4-61bc149083d4", "comment": "Malware payload (Loki)", "value": "096be0d863167aa4dab09ceca613b86f53377148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662730224, "uuid": "fc7570ba-edad-476a-9834-8fd216fbeb25", "comment": "Malware payload (Loki)", "value": "59e6dbd3aecc02c64b9a492c07d5cb2158d9eba79133cd78a4bd32b939cfb5e3674ca0cdba34e3753c1db8cce5f2e356", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730224, "uuid": "ba11627f-126e-4344-be14-fdd7967d7284", "value": "T185153A0721C54DA5C07250BC64CCC5B34BAADE85E63BC946BFCD9DAFF592F2846D22A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730224, "uuid": "d351b3a5-49e4-49ff-9510-58c71ccd6477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730224, "uuid": "453dcdf5-b811-4b43-98d6-3ef9501bb1dd", "value": "12288:Rn/mA2iNr3dmxvzb4DiVhW3tQAw+fQMuZi8Tf0R8kTVWYIqW2:Rn/91VNmVjF5f0+kJWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662730224, "uuid": "eed5ca0b-1868-498b-b622-1c61dbf673ca", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662730224, "uuid": "25da28f8-aeed-424f-b163-81e3d8aa11a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662730224, "uuid": "caf22f2e-5592-44cd-997c-009e3e41707a", "value": "QUOTATION 64546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3121cb9f-3004-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1662703008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662703008, "uuid": "6304ab96-f14f-4405-801e-59b4fd8d6f08", "comment": "Malware payload (Mirai)", "value": "f295b40159baf5645443d6e35bc95c3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662703008, "uuid": "9310cfe7-30bd-4eb0-985a-624066fdc511", "comment": "Malware payload (Mirai)", "value": "fd4d3c52b4da717a28759437e60d9af87bae7faa2a0a9202d81ea0260f63156b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662703008, "uuid": "8bc2a233-2dcd-4b86-a4af-cc490a1617aa", "comment": "Malware payload (Mirai)", "value": "7858ba7e1dd10858b62b6afd918bdb8f36d803b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662703008, "uuid": "299e0c43-5b38-46f8-a452-12475061cda5", "comment": "Malware payload (Mirai)", "value": "b868cd3652ce231bb7ab58962075e7e7b30c168c52712d45bfcd64e698753e07b95aad1314314a2aef2634d427007550", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662703008, "uuid": "c89f9d46-4a0c-4e18-a7c2-05e8b8b17ab3", "value": "T1BCD2F13C70955D15ED00B2379A778D8F8158F882CFABE266158B0F253F6B3D666A2C34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662703008, "uuid": "e1919891-0497-4bf7-8d6f-03e145152cf1", "value": "768:eV5QFVdGsNVDkflv7+9MMLFwgYoXObDMAH+989E:ejQFV5kfRELFwgYfM2082", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662703008, "uuid": "3c8e100c-3355-4bd3-803a-bfcdfcb770ac", "value": 30224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662703008, "uuid": "331e0041-ce27-48d2-9d54-9fca787d0b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662703008, "uuid": "7d7478d3-366b-4520-9417-656902d71aa9", "value": "f295b40159baf5645443d6e35bc95c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff00a85-3067-11ed-9266-42010a9c0072", "comment": "Malware payload (ModiLoader)", "timestamp": 1662745660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662745660, "uuid": "e469e952-4864-44ee-830b-cc0c0ba5531e", "comment": "Malware payload (ModiLoader)", "value": "57c242b8773d84a2bbbd0bce804fedbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662745660, "uuid": "ce7af40d-7d5e-4e5f-94b6-6fe141ef5697", "comment": "Malware payload (ModiLoader)", "value": "fe323cd5a46b973a6e0ade0cab099d0f929351820421393b29c2a63df6cdd527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662745660, "uuid": "1838a15d-de17-4945-83d3-62ea033fdf41", "comment": "Malware payload (ModiLoader)", "value": "f5024d3caadb3753ee4ee6a2d86c9fee6529f73a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662745660, "uuid": "b9644fb8-dc4b-4694-8103-749912c51b79", "comment": "Malware payload (ModiLoader)", "value": "b250bb480b65953a483e3d37aeea97a9df869f5c5cdd649362043742c95532f6045d0da2d5d8cce29678d63b7930596d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662745660, "uuid": "f7007627-6baf-4c65-9394-c282d1fd6296", "value": "T19915AF13A960C872D9116F359C1BBE685C2EFF102A5C698E75F86D89FF36B41381B342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662745660, "uuid": "105cdb42-39a7-428c-a1f8-4e412619c944", "value": "b9e865dbab68672dc86bace50ed643d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662745660, "uuid": "23fdca69-df26-41fb-83bb-c7a3d39524f8", "value": "12288:PcZI0RpZLWuz11zDo3A0eMqM1PyYiDuB6ZGK7jq8OMEI3c41RMCoqlkXWt9Nt1/Z:P4PZKkn8feMqMY3+6HyLwrbMr7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662745660, "uuid": "a0723661-0044-4880-8e4a-7a2a211b7470", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662745660, "uuid": "515eac53-ebd7-43ee-9e46-7e12b3f8f545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662745660, "uuid": "c6ba4e54-4bb8-4994-9845-eaa934a4d8fc", "value": "SecuriteInfo.com.Trojan.Siggen18.41399.2610.1257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88906cb-3021-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1662715717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715717, "uuid": "a8b3c0a2-e283-49d6-9c6b-49de0a8477ac", "comment": "Malware payload (CoinMiner)", "value": "3d09b3a529a699338f7932223b357372", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715717, "uuid": "5667abd4-da25-4f00-b397-71077242edce", "comment": "Malware payload (CoinMiner)", "value": "ff81ffadca4321934eb5717361e5c696a2dd939dbb92a004d8b3efeb7cc6dc3b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715717, "uuid": "86db8e25-5a3a-410f-908f-4fa8070e6c05", "comment": "Malware payload (CoinMiner)", "value": "f76d4bdeb41d75a5c79135128dfa110125ac2f63", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662715717, "uuid": "eb9962c6-133a-4110-acb0-a2e39fac1d5d", "comment": "Malware payload (CoinMiner)", "value": "d1895502ecffb7f46928711371e2f2cb6a5f4ae376f98970446f56dae166673e89c21e3601dcdb3bdcc7575c5c91b662", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715717, "uuid": "5acaab5c-3b39-4175-ad74-585b1b950d45", "value": "T10024CFA2BDE0CC32D5E245308074D7A46E7BFC612A34558BB794BB6E6E302D02AF5357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715717, "uuid": "869648d9-f75f-4dd4-aac5-18b2418f042c", "value": "5f01abba712e2454333b4e9c03c9ed2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715717, "uuid": "f8fa1335-05ae-4314-8ac6-f2339c47e5b7", "value": "3072:Ps4PwupuFqzG658POKkl5m7TFMNlyZ3FduQkDbQUcfaTUbDVv:3GFa5Lm37ZycJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662715717, "uuid": "2bb92847-670a-43c8-8803-3d9a4d81c285", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662715717, "uuid": "eb475ec0-93ac-447f-b3cf-43fa7530f820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662715717, "uuid": "4d877b25-b007-462f-9fc4-d8f8d5d0e893", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6a555f-3053-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1662736930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736930, "uuid": "ca55cb73-3913-4903-b73a-9be80c7ccab7", "comment": "Malware payload", "value": "7faa223aa1328ec1dcb70d993c23e844", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736930, "uuid": "b1e34226-519b-4251-93f2-5996cd0ef24a", "comment": "Malware payload", "value": "ffa5b15bc096c99154accf4e22b15f18c175cfca1480fe08afc47031efd0337a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736930, "uuid": "89da4cb8-98cf-4d83-8d2a-2f25cd8a8cb6", "comment": "Malware payload", "value": "a0ea58ecf6802e892798b8d897d3e59f0e4a2484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1662736930, "uuid": "7bf129a6-3b6b-4cf8-a513-9e87bf2a36a0", "comment": "Malware payload", "value": "2987b64a5ffd39ba39817d1b097780c5ac353121a7735b870fb72abee23f8f702ec105253994caef46093d59c69e6a78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736930, "uuid": "9d9e2333-ed47-44f1-9422-6ef039261ab6", "value": "T19A65232071D0C2F2C9FB253544EACB381D3239A4077A64E776DADBEA2E157D1A3361C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736930, "uuid": "79d164c6-3e8d-4b1d-a3ec-2a0d2f597eae", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736930, "uuid": "867d290c-2139-4688-bd1d-ed998f8011c2", "value": "24576:Ck7HTrcBI6hANu8/a5hBfIZhqsakcSOEIMiBF7d0WXVouuh0GnAaT6R1TLutdu:CkrTAB9Au9jBfwhPcSOnM6RDXG0OGR15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1662736930, "uuid": "d32d3dea-e1e5-42a7-89df-e88010753ac8", "value": 1466568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1662736930, "uuid": "3eeea2e2-c434-4657-a59c-35d4fc8d34cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1662736930, "uuid": "dfd04dce-7999-47f9-8b69-7b7eb0719e84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }