{ "Event": { "published": true, "date": "2021-12-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-05", "timestamp": 1638748981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3b8e3ae4-537d-4c12-b4d2-d3787156240c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a8dbc6-55b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638701587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701587, "uuid": "4145385d-43d4-4064-b786-373c978c9400", "comment": "Malware payload (CryptBot)", "value": "0685451b429ceaee9f9e1148c00102de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701587, "uuid": "d066ef14-b5d4-4f54-a70e-a16d7c5a1a1c", "comment": "Malware payload (CryptBot)", "value": "0048a842c9fef02c08fca5f6cc9da46393240fb155876461f26e4c6d57e28f77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701587, "uuid": "96a97036-f7fa-4452-85c2-96b28ddbe1d4", "comment": "Malware payload (CryptBot)", "value": "27f37c5542a358c3c616b4a8f3a91ce090f4fd75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701587, "uuid": "ac18ebb0-f00c-4916-8269-34383df2b59e", "comment": "Malware payload (CryptBot)", "value": "dc5295ef2867038e00814a2f258f91d35b87ea800a878007fe609b7c4d19aa26685f2bf0209410568e813b82aa7730f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701587, "uuid": "40773be2-383f-4d5d-a703-12f5e00d5f22", "value": "T17984CF1172D0C033C09665768865CBB29E7AB47417A66ACF7BD85FB90F243D2A73630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701587, "uuid": "a7a72b69-0b47-47e1-9e5b-848b1ab137cc", "value": "57414c9b174f8e0ff83324cb2c99bb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701587, "uuid": "b454967f-8581-48ed-b916-0f5cb5034de2", "value": "6144:OQb52XA3WmGYNIniwZSOL29kCy0YKEN70AV2X8PONSZp4gYENj:OQbkMWmGKKisSOS9kCy0YKExzi8/ZeAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638701587, "uuid": "4a4f41bc-2f1a-4031-a337-609c7bd73206", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638701587, "uuid": "3609a99a-9663-4d14-8eeb-949d26d1914b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701587, "uuid": "ac90e4e9-2e78-468a-9c4b-e45aaef24b96", "value": "0685451b429ceaee9f9e1148c00102de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be63025b-55ac-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638696095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638696095, "uuid": "80b9b28b-e8cb-48a6-8b92-efd709bec944", "comment": "Malware payload (RedLineStealer)", "value": "1cd146179221cdb8064810dd2d5d39ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638696095, "uuid": "c226462c-8879-4f13-a3cb-2283769e4be4", "comment": "Malware payload (RedLineStealer)", "value": "00e8ac11d71f2448d10354a50ca9268778eb5e19dff458f54b47745bd9e5f665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638696095, "uuid": "dac4ee6f-6c06-498a-a8e2-6429fc78619b", "comment": "Malware payload (RedLineStealer)", "value": "bd968e76c77c101be6280d8bde37c08f7b321510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638696095, "uuid": "c3d73852-e129-490c-8463-901982e77a08", "comment": "Malware payload (RedLineStealer)", "value": "f57f1cf7d022b70a982e774fd98f28da4c0aac777bb5c2fb75700636a3951e60df8511300bcf3152365bdee2ac3fc52c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638696095, "uuid": "a33008dd-891e-4c66-92b9-c3899fb6f5c7", "value": "T14E15F17733CB63CACF674DB2F2540B295A5C8973316214BAB0B0A1A7CCA4E7A4D57538", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638696095, "uuid": "3e54cb15-0134-4180-ae36-f783fd5e4141", "value": "6e87def9f63882a48e57bcc8b42eb197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638696095, "uuid": "a9f36183-6b59-48d2-8a29-fd1deca7a581", "value": "24576:2/IfKa7IYsBRSGhTlBU24yOUC5DWBbtus/2bIwmj21:2/Iya7HeBu9UCcBUs/28xy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638696095, "uuid": "49afbe65-f135-40db-a748-b6d84955764b", "value": 946352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638696095, "uuid": "23e70cec-6f84-4c0d-b2c0-a217eb78bbf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638696095, "uuid": "3c056b84-55c1-4728-b2eb-fe3e5221f706", "value": "1cd146179221cdb8064810dd2d5d39ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ec3900-55ab-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638695756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695756, "uuid": "bc3ce57e-d817-46dc-878d-8eb408402187", "comment": "Malware payload (Formbook)", "value": "d348e2f9fc600771a412318c5d9538bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695756, "uuid": "e54fc948-c1ad-4032-9ff4-2f61e5468e26", "comment": "Malware payload (Formbook)", "value": "0123fdb2e8de200e6fa07cd5c254771143b7d9fea4f6895077b4f609fc5ae1cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695756, "uuid": "a1a4fb3d-0030-46e4-b29f-cbb909fb069e", "comment": "Malware payload (Formbook)", "value": "68aadeab3e1a19816bae26452c18a3ee4d435ba7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695756, "uuid": "a56c4fe6-4ec1-4a1c-8d44-ffc6e11a7762", "comment": "Malware payload (Formbook)", "value": "50f4cb7f4ce142dc9917c7973f958be213a45dc92cc56904c4700019339db1c436203b97fe40459657c264a3f84cd432", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695756, "uuid": "f0cf6965-b443-4737-8bf7-c73ca77756a7", "value": "T19664122B76C849ABE39B4D7019F5737ACBB2A25C15190F0B4B609FBF3D215878A0439D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695756, "uuid": "2ad2801f-0ecc-44de-86fd-4101462e637c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695756, "uuid": "487014f6-e867-46de-8c1a-d3ec9cff1f34", "value": "6144:rGi3xKBKtHI1b0pTUMUVV1BmajTgGMnnbKO2p8Eo9gNn9M:zxKGHzxlCV1JjOnbKyEo6HM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638695756, "uuid": "982d9a48-d896-413c-abc8-d23a679ab771", "value": 314098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638695756, "uuid": "d0e130f3-7e2e-430f-b938-63a1f188515f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695756, "uuid": "6fe53b33-ab11-4c69-b3fc-d779a320d32b", "value": "d348e2f9fc600771a412318c5d9538bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31eacb4-55a1-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638691459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691459, "uuid": "2d45d255-a816-4685-b962-fa54365c238e", "comment": "Malware payload", "value": "18e7ca3e3dd4c7cbfb8b5f90ac0f8af5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691459, "uuid": "1ad53df9-a072-4b36-9a18-a9973ffcd275", "comment": "Malware payload", "value": "016bb4e99c30d6eefcc414bb556c83aa5e6390dcd1cfeb2ff55980d0019251c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691459, "uuid": "3c728af2-371e-4826-a963-136190d4f34a", "comment": "Malware payload", "value": "578adcad403fbcafe524001e57b6528daa2389b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691459, "uuid": "a42fbbee-240a-4a3a-a636-907fde8d092e", "comment": "Malware payload", "value": "19c372e7cfccdd5f0c71d7dde5f20be65b213dd2523550373bc69cc9a604e3ea8b7ce53f6edc8f2ba9b60f9243c11054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691459, "uuid": "31d56b4d-0f66-4e2c-ba6a-9f02c0d95e64", "value": "T172B39E483F58D747C61D8F7688A2C0D223B0B93B6E87DB67BDC023DE263B15425179A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691459, "uuid": "1bd2f809-9895-4917-9132-de8997ade497", "value": "1536:Olypj8SsvEo/EKcatNw185ItcxsDiygBUrk/52h163wL+Upzv50h11OHtXauY4d7:1wSs9Bc1ztcx6rDJ+gT5071OHVa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638691459, "uuid": "6152430f-09dc-424b-8a4c-93fc74234e90", "value": 117284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638691459, "uuid": "b259145a-8a0d-47d1-ad02-3033a29c5c5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691459, "uuid": "ebb02a2f-c231-4190-b343-453bb28e727a", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0894ef-55ee-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638724440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724440, "uuid": "44868378-295b-4232-b275-65254071ff89", "comment": "Malware payload (RedLineStealer)", "value": "95e70003cb165154c3daf12ba9dc7faa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724440, "uuid": "6b7982b6-4c10-4a77-944e-68f378d5f808", "comment": "Malware payload (RedLineStealer)", "value": "02cec089880632fb2de88fe23d014acaae5d9c427bfdeb81f41b29c885bd27d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724440, "uuid": "354be4ef-13b5-4f6d-bfb1-c825958a2bd9", "comment": "Malware payload (RedLineStealer)", "value": "254231df2db01327f47c04ccb5b08495bd3b0eb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724440, "uuid": "c8d55ab5-137c-4a9f-a71c-9c9700a9f145", "comment": "Malware payload (RedLineStealer)", "value": "302161c6432bd0468df6c346c7fbdb8d69ddfdbb9202d17610d5c1bc0af069ef2c7092dd5b45c4437b5c27288b124aec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724440, "uuid": "6419b601-56c9-42cc-b1dd-16654a71eb63", "value": "T11994DF1136C1C072C19764B68D25CBB59EAA74711A265ACFBFC84BBC9F387C1972630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724440, "uuid": "cfa48e2d-093c-4f48-a5d4-25c211dc5c46", "value": "1b81e8f7d77881f7dbd36488c7ba26dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724440, "uuid": "14fbade7-a16f-46ef-a114-905c7cc5f250", "value": "6144:fbIYB0B2hW/eZnLvAQcJDfiQQPh2NcQimPX2nrJY2y:fbnRhWoLLgTbQPh2ri7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638724440, "uuid": "27bdac1b-2a25-4a39-892b-8128af23cde7", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638724440, "uuid": "7ecf15fb-4c90-4d6e-9b00-6f9beb2a887b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724440, "uuid": "d92614cb-967b-4f76-96ba-03476b347f18", "value": "95e70003cb165154c3daf12ba9dc7faa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612f991f-5605-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638734164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638734164, "uuid": "1cde5eea-a9e6-4e47-a9a4-02e5889cdcf5", "comment": "Malware payload (DCRat)", "value": "a0fe54de111e388ddeb921093e78648d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638734164, "uuid": "9115a889-c956-4121-aba5-a92f2814c87f", "comment": "Malware payload (DCRat)", "value": "03cfd77fd66317ec9548edd89164c567958f3d955f96682816cf19c7237c75db", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638734164, "uuid": "b559a114-23e1-43b6-b597-3d5deb1f41f1", "comment": "Malware payload (DCRat)", "value": "a19f4c0afd758eebaaab0f0b13b4167c3707fce1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638734164, "uuid": "23e95ed4-31b1-44b4-be74-f49d8e60177f", "comment": "Malware payload (DCRat)", "value": "9a67307d1a1d8770263d645b24aaa7945a93896cf00937a36c7fb4ad8b6253a0357d145985d5fd90d71b321f09fe0166", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638734164, "uuid": "8143159b-56cd-4418-b2a5-c8a7c842987d", "value": "T1CD456C123A44DE02D129173BC6EF405583BCAD457A62DB2A7E6F73AD25513AB0E0D8CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638734164, "uuid": "3807461e-c626-4f2a-8c62-7e50bae2054a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638734164, "uuid": "e67a3cfc-7812-4ec8-8db0-a38efc0221e6", "value": "24576:WfD0xM0PfkpQULK/ZVAQNaqEtwHKWOb/fCrSr+4:1604jLKQmXHbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638734164, "uuid": "8dc586c8-4049-4bb0-a510-a9a26283880e", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638734164, "uuid": "2adbab87-7a8e-435e-9dc5-2b6e67029dcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638734164, "uuid": "de3c8579-14ec-4018-9c2d-88323c7485a7", "value": "a0fe54de111e388ddeb921093e78648d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4977d977-559d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638689457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689457, "uuid": "2f2fc5a6-2447-4ab4-9310-a83d6afc068b", "comment": "Malware payload", "value": "14212f094f8e20da33ee0b0b859b92a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689457, "uuid": "d911c0b2-b644-491d-813e-03bb3fada6ec", "comment": "Malware payload", "value": "040d6aa01453acf912fc61ab1ee92a2f790c99f53c80add20698e96544d95a24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689457, "uuid": "4aa661a9-19a4-40cd-b44d-af1e3e733e2b", "comment": "Malware payload", "value": "5f40a6fd6e223acd7158b74be7961f75d5d3da99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689457, "uuid": "c6ed3ed1-9267-448d-bf3e-631c555c4697", "comment": "Malware payload", "value": "574997addd0d5edae31a11c205ae2b8a201dac0ce5bbb4e6f16ae84baf07392945d8da037585165439e7219f75ac3872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689457, "uuid": "23cf3c9f-9880-485a-a032-f680b68c04ac", "value": "T1A56622AE6148379CC41AC4B4C533FD46B2B6221E4BF9A5BE71CB779077D7020AA46F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689457, "uuid": "57554651-3d14-4274-b6ee-84b37c02e0bf", "value": "b8094ec45d06653ce5ef80d4c40851a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689457, "uuid": "ae982b78-b7da-4dce-be0a-16fa5c365bda", "value": "196608:bcp6oiRqRnG1oehiLkM2RMzK7teRK7Yy:bcplaUMiPMOOeo7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638689457, "uuid": "2558d3e5-e866-474f-b81b-fdbda2f66d5f", "value": 6590976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638689457, "uuid": "91ad5e6f-1574-47ba-b258-801b47395553", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689457, "uuid": "13262db0-ec43-49b9-b476-b56ccf315021", "value": "14212f094f8e20da33ee0b0b859b92a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9f1610-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638722617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722617, "uuid": "7ad61f9f-5d74-46f3-8f39-2597839dd2c0", "comment": "Malware payload (Mirai)", "value": "4622a52d9fd968018ad4c7b4eecbe9c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722617, "uuid": "2b3ced1d-9651-45e3-ab13-befbc63e2bcc", "comment": "Malware payload (Mirai)", "value": "04178bd89bd252ad882bb9d38bc2be80288b7575270675c2587cfff4afefe8c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722617, "uuid": "a7a82fc7-3a38-49c9-b8bf-cca228ea642a", "comment": "Malware payload (Mirai)", "value": "652c8242c20c98ce552d229ee40099cb1dcb4fb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722617, "uuid": "45124fde-998b-4608-9bec-5f9931aa49fe", "comment": "Malware payload (Mirai)", "value": "15b60c64d7af8bbb22e359a8fa79a4c95d39962c3891d0e97bb0fc9993e685d067b2d84be133a55226bec2a2991e0a74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722617, "uuid": "ccc1c6de-1187-4272-ba15-698068feeb5c", "value": "T1F3044A05DA809B17C6E23BBAF79B428E3323975467D733058928ABF43FC27995E36015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722617, "uuid": "42ecfd4b-3e50-4b91-9bb5-c29df68a56b8", "value": "3072:0V/Yb/dnp+eQPGp+37T/a+Brz/5TPibksbfh7A45hLaO3zVbYM/9cFommw3Bq/1A:d+v/a+BrzBTPAbfhf5hLaO3z+M/9cFoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722617, "uuid": "e74d7b5d-17ae-4a16-b55c-fbfada148300", "value": 180200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722617, "uuid": "39f65a3b-5fcd-429d-9044-ec70aa57dcf5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722617, "uuid": "ffff0d6f-b8dd-4e7a-a900-74c40538c5e6", "value": "4622a52d9fd968018ad4c7b4eecbe9c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f975cb-55ac-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638695818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695818, "uuid": "dd61f398-2537-4563-b973-a760055b435c", "comment": "Malware payload (Formbook)", "value": "bc1e02654c209a6a8bac1114714e28d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695818, "uuid": "440486fc-6e2b-414d-9006-7ade11b531b5", "comment": "Malware payload (Formbook)", "value": "041f3f888d5db058bb92e459a72fd55ed5c6aea6ffbfdcad620896d67c4a5c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695818, "uuid": "88db3435-c3bd-4513-a6a6-5ee2f9155a6e", "comment": "Malware payload (Formbook)", "value": "f04b3ce4e1ac91731d46d93c4e30335a8ff7385d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695818, "uuid": "74e0700d-e2af-4fc0-9ad9-3025f624f2d2", "comment": "Malware payload (Formbook)", "value": "612d8274a9406bb89cb46542e1f38ec0ea72c4da00703ae822d9b05e25f0cab0fc1b129e66f494e81a035e5c50c8c755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695818, "uuid": "17407bde-43ce-4f58-9f34-8abf4e23102c", "value": "T199A4E1D2C045819AFA760F72903A0D28025BBEBA7CBD705E1A68765527F33E7052BD1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695818, "uuid": "05ee8b27-c2e4-4d9b-909b-2bdb9d440367", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695818, "uuid": "5932a0f3-dac7-4f28-aa0f-40b5e4cbabb1", "value": "12288:hzVpAgOllAwvj5RR2QYFPatAzq10Q7TZO/9r:hZu9lAwvj5b2QYhatAzO06kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638695818, "uuid": "ddf0da67-8a0b-4904-a77d-29110d259b92", "value": 478451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638695818, "uuid": "dd0bcaec-2c09-494f-8150-9bf38823cb30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695818, "uuid": "d5b0e443-fc17-4700-8ea7-f44bb9591b13", "value": "SALARY_RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2623056e-5611-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638739219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739219, "uuid": "41a02d25-488e-44a1-aeea-041219105803", "comment": "Malware payload (Mirai)", "value": "81972faf6bcd13cead897ca12b1566fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739219, "uuid": "0bfb6b3f-2e5f-4343-b50c-fa564eb28afe", "comment": "Malware payload (Mirai)", "value": "0420549ede2c7e841357fbf00b197864574a8abd094999076366065013f8cbba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739219, "uuid": "6657a0db-eca5-4860-917a-bca6bfb3ef2b", "comment": "Malware payload (Mirai)", "value": "3133bbda23cc628cc0843fd6ecba1b6f204b9dd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739219, "uuid": "11b53049-e11f-4447-b61f-8fd187890131", "comment": "Malware payload (Mirai)", "value": "62af787cf9fdc2d689596ef8957388bd1631da6694afda8e297ad50d5173e7e82b3f0393f4264f160fb4a42248238e60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739219, "uuid": "668681ad-e4e6-402c-843f-23d0229b3b2e", "value": "T1B533298A64112E6DE9D79CB980664F0EDE141220B493171BB3BBFEC33933394EE66509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739219, "uuid": "060fbe2a-9858-47d1-8a51-d77076fb4a80", "value": "768:daYTrPWlVLoueg2meCLPUCLww/UnPwabfWjWJPqDAV7sSux+f1prO5tv80eruv:davboRg2meQ8CFUNbfLJ57sSOg1pK7nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638739219, "uuid": "80e66914-1ede-43bd-bea8-71d6947baae0", "value": 52824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638739219, "uuid": "2d14a725-5e2b-4517-a4fe-e0729eb6251c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739219, "uuid": "41559596-c9bf-4c33-8f1d-e7a515ebadaa", "value": "81972faf6bcd13cead897ca12b1566fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c20ddde-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638693864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693864, "uuid": "e7df2d99-54ee-4c42-9c69-ff88665097b6", "comment": "Malware payload (Mirai)", "value": "f9716dd0ef5186f29fd1ddd368125836", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693864, "uuid": "0f9476fa-727e-4567-94fd-f863dc86cf42", "comment": "Malware payload (Mirai)", "value": "0493b3b00fcaf46dcb895cce57c6677ab9abbd9e8b49487cfc49389094587125", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693864, "uuid": "a63f6b3d-12d9-450b-8a74-abed0edeeb0e", "comment": "Malware payload (Mirai)", "value": "e49e24ea0399c4696a703e5efcf35779b2d61e4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693864, "uuid": "5b5cf8a0-da25-462a-8d8b-b46931eedf94", "comment": "Malware payload (Mirai)", "value": "8defb58ffb4345e126af633bc142db01f57729d15033cc840216c9a109889ff3532b8449abd37271bcbbceac7e97c6c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693864, "uuid": "1793b831-e450-4365-9cc5-942282b14226", "value": "T11AF2E13CA3039939D9BAC4B9A19B1BD16BA70FC362D1D80EF814548B5F4A36C7C99CD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693864, "uuid": "822ece45-7265-4289-97d5-c9212230649a", "value": "768:vSZ7PDEH4cB+MEOj/LDBI/JCwaicqB4/QsznJgGlzDpUYsEp5:aZ384dD2DBI/kicqBwVzlVqY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693864, "uuid": "156b0f4f-3778-494c-815b-4cf870e69cb7", "value": 34376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693864, "uuid": "3c68ac91-3b5f-4e88-b4be-f3ef7337e5c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693864, "uuid": "8cae4b23-94d3-439a-a4d9-181712785639", "value": "f9716dd0ef5186f29fd1ddd368125836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c45d14a-55dc-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638716520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638716520, "uuid": "596dae46-3f3a-4d3c-a92a-be2c947ef6a3", "comment": "Malware payload (RedLineStealer)", "value": "1dae79c76126431e73a9465c6f5ac95c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638716520, "uuid": "0fe54f2a-a067-4939-92e5-3d199ed218ff", "comment": "Malware payload (RedLineStealer)", "value": "0575a7431f07b940e6757d2cffbf1ec4fba829f173fc95a4df953a9ef10994c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638716520, "uuid": "43a62051-247b-4995-bff3-922ff115b5b8", "comment": "Malware payload (RedLineStealer)", "value": "d6d33d3091ad7977c38d892c1fc13362143206ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638716520, "uuid": "da30e666-9b3f-4607-8077-b27d6c25a171", "comment": "Malware payload (RedLineStealer)", "value": "a37dd668d2c8cad75931ebd092a11be51af8d9be75e1031a498ca14190a193fe69b1d9a98f09f46445083781d86b9e0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638716520, "uuid": "0292872c-27a9-425e-a9ca-c360363f858b", "value": "T15D65330B5B6295C7EDDB8CB4F823EE2BCC1A1114A5083BF67B3900CFB5284565B5C9A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638716520, "uuid": "0323016a-e9f9-44b5-832e-9146004c40d9", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638716520, "uuid": "a113d33c-3182-4187-b0fd-73ecabae7b5e", "value": "24576:OYlFj1aFVoipA7fC79TTae7+WPBBHbtJ9RtkEaHNYK3Kzg6ra:OoZaFVTWCFTz1PjpfNaZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638716520, "uuid": "3d2159ef-0a5c-4c6a-b0d5-06538aea2e5b", "value": 1518080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638716520, "uuid": "a86ce6f0-ac29-40d4-8e60-d4ad0f8bf301", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638716520, "uuid": "b4645341-8cfe-4f87-9a6b-19cee5df6ae8", "value": "setuup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b4100f-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708194, "uuid": "1591f3d4-64c4-4ddd-82d1-a7d9ecbd460e", "comment": "Malware payload", "value": "cdca43aa550e92d2bb38eee24d224a92", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708194, "uuid": "dbb18fb3-6ba5-4850-98bb-885da7c52e99", "comment": "Malware payload", "value": "074a76a37c0c46394b3e7af9bdb31f529b3703539aeb6d870e61fccae8aa01cf", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708194, "uuid": "a8a0f482-7d8a-4fde-aea0-400e7f55b70e", "comment": "Malware payload", "value": "57e6d7b0d2646b48c56cb87d50039572ac51fc4a", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708194, "uuid": "267a82bd-3508-4be6-973b-1c399d3dfd11", "comment": "Malware payload", "value": "76956c14cf48fc07d07333fb1e28c3006930ef8639c3d24a0c0563af78bdb4ca685c51e81718a272a0f62f62b4993134", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708194, "uuid": "f99841a6-3eba-4e2e-84cd-d9fdc89b12a3", "value": "T18DC533109AD016C9E594CF2F2F9C5936047FEFCA78A4EDD392D28BF1114FE86A962470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708194, "uuid": "08bd9376-cb24-4e7a-b559-beb829a48071", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQR:G1wwAjzIQOMK2GNKslgus10T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708194, "uuid": "135ddf9e-4bf7-465e-9084-07136a3535c2", "value": 2707456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708194, "uuid": "7974919d-2087-4cc4-996b-2b0e99737d0a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708194, "uuid": "7c7319ce-bebd-4ba8-a0c3-eff58cb42acd", "value": "074a76a37c0c46394b3e7af9bdb31f529b3703539aeb6d870e61fccae8aa01cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3d88d4-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708198, "uuid": "2aac54fd-7a1c-45bd-8af8-2d50e04d885d", "comment": "Malware payload", "value": "f81e6f03a1ba891a895550d686c1e49c", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708198, "uuid": "018af2f8-a40b-4a39-a23a-44bb1bfc6c90", "comment": "Malware payload", "value": "07b0169b180e3e9aceb23475867f16b4ed54992b18ffec15c53ea3a25b8ff120", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708198, "uuid": "3a0fbd13-61f6-4474-a6b6-8cd81d5bb4d6", "comment": "Malware payload", "value": "ca3c789a2f5133438994e883600e83599107db48", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708198, "uuid": "2a05b941-9363-4f29-990f-c5e2ec8512e6", "comment": "Malware payload", "value": "2986d7178b61a6264a31aa7df4fc3bbcf4e0b12eab2c5fe91301e7e9806931987eccdc315a7cdae2479ca8d030f50610", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708198, "uuid": "1441a755-bb42-4522-b768-1182f162ff07", "value": "T199D533109AD116C8F598CF2F1FDC5936147FEFCA78A4ADD392928BF1100FE85A662474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708198, "uuid": "76cba7bf-77e9-4d30-9a9f-98f97dd53651", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvP:G1wwAjzIQOMK2GNKslgus105", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708198, "uuid": "ba53a302-0206-4cf0-867c-7ea9e8e9c17e", "value": 2760704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708198, "uuid": "0e91b7c0-c0ba-47f5-8e2d-016582dab44a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708198, "uuid": "4b7b7b45-ee25-4a7f-9992-7cfcbdf3ccdd", "value": "07b0169b180e3e9aceb23475867f16b4ed54992b18ffec15c53ea3a25b8ff120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870c96a1-55da-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638715759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638715759, "uuid": "2e738507-f05e-4be3-a8cd-3bb1b9938e0e", "comment": "Malware payload (RedLineStealer)", "value": "2bc87a9ad768070676676654252ebdae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638715759, "uuid": "c96a36bc-2578-4450-bdfb-dc76a7008f7e", "comment": "Malware payload (RedLineStealer)", "value": "07de0324fd15b8dab3b0c9e4345a2ecc0d2bc0c806f6702cda99e480e9d6506c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638715759, "uuid": "e46ab699-c90d-49b8-94c4-50bc1a81beb9", "comment": "Malware payload (RedLineStealer)", "value": "e769f41e2b36b7326b692c27fa8555d55e3fdcb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638715759, "uuid": "969f4fe4-2c46-4800-bb1b-aa236987b630", "comment": "Malware payload (RedLineStealer)", "value": "93f3616766e6d49c07c11d45c99dcd1a47d14e4cc5056b050d6c724731cfc05dda5af198116ed52c90937627de2fcae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638715759, "uuid": "25067aa6-d1c2-4192-81a4-797e2a53735b", "value": "T17356128DEF3875BFE288E4F97C5661900D4E2C1D036C61AE275CBB9A027051171BBE6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638715759, "uuid": "62242a12-7062-4111-8d5b-f55f3289fbc6", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638715759, "uuid": "02be51b0-4818-4d5a-9eac-c27550c37226", "value": "98304:6ax5Ip3dfp0isEy6QULX7WIxLYjDTPsAci55ufOJq8NlslJCvmiH1SZr7eU+ATFO:6axMpsE2w7PlYjDxciSmJq8Nls7e8r7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638715759, "uuid": "a724e5a5-8ee8-4098-b2ab-526d3a3abc05", "value": 6243980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638715759, "uuid": "0a937938-3794-4a4b-8a15-0e906f00c3aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638715759, "uuid": "ca8795db-dfdb-442a-8d66-e666c527ccd8", "value": "Fortnite Hack Mod v1.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6515fa72-5610-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638738895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638738895, "uuid": "9619dd4f-bb86-4dcb-9569-fc6e4cb1236f", "comment": "Malware payload (Mirai)", "value": "d58e7f79dda7fd533d6daba83f16aed1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638738895, "uuid": "177c809c-9bc1-48d0-bbac-19946e61a394", "comment": "Malware payload (Mirai)", "value": "0863b5ce025882aff6c2862c59e51486998e986be8d38457b1a2fae41e124a63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638738895, "uuid": "4a5e9717-1a75-457b-ae89-17f750a43653", "comment": "Malware payload (Mirai)", "value": "dc9e2f03c30ae6e8ed31ec71266b507b7048db0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638738895, "uuid": "ef2cf278-66ba-4b02-aef1-cd9dd7934345", "comment": "Malware payload (Mirai)", "value": "a559e98ba0b0a262ea82f4e53b172ccba99e499999619ba250c4520348daf5154b58fd763132f80ce7c0153ebb00971c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638738895, "uuid": "802ac468-5376-4734-8b6d-6ecb66a51e52", "value": "T116C2E0B828046530D3700539FFADC5875BA7D1F482F431151A500AFE964B596B9BBBCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638738895, "uuid": "fdab1eda-d640-4e0a-a52d-e8c69eb88d8d", "value": "768:xRSa8ZS/L6rze3OXrFKg9KZrqoDuYPs3UozYb:vSjFJXZBCJDuYCzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638738895, "uuid": "580d7540-77c0-4e36-bb4a-c53b64859ab1", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638738895, "uuid": "b6a49670-e40c-43d3-8f12-51f0c9fceccc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638738895, "uuid": "c81ce324-fe6e-4dfc-ac1a-38c0b77822e8", "value": "d58e7f79dda7fd533d6daba83f16aed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c378c05-55e8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638721727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721727, "uuid": "f0a43da5-2e3b-45fc-8cbe-f48ed63575be", "comment": "Malware payload (RedLineStealer)", "value": "34aaea3da5eb1de28c2105419ba2d28d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721727, "uuid": "5cdf32f2-5953-4342-b5a1-966c57600738", "comment": "Malware payload (RedLineStealer)", "value": "086adff5d4c7d463878ca94751dc2f51e4e9d8f0814d59fa502f6a5c3b7be659", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721727, "uuid": "ff509ad0-52e2-4e41-9f0c-3405f187d77b", "comment": "Malware payload (RedLineStealer)", "value": "826f09014d4f5cb399590d40ce3ef19c2f07606d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721727, "uuid": "20ef64aa-2382-43a2-8305-f6c58cc06f74", "comment": "Malware payload (RedLineStealer)", "value": "717e65c65b559f7c64e66dbba18e59c84ab01bd245403da80f1886ddc590addd682272e4891ee2aca46c84e054e4c0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721727, "uuid": "4630fda2-1dd9-4d9f-b4c7-fa35316297ea", "value": "T1536533986F0609CED305A9F607A9D0DF8DE9221BF9C58E7FE6525322884974BF43D0E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721727, "uuid": "2d313422-baa0-4980-aac0-b8c37baf0541", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721727, "uuid": "8bd5c0f4-eac1-4ecf-bad3-3f8ec84e7621", "value": "24576:0XVQFvhb1XihGmK7SM4HDN+P3hMOnXp1f1u3gqrrSlroaJdiF8kEaHNYK3E1ZOeO:0XmFZb1XB3tgYPxMOnXpp1+rulJji6Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721727, "uuid": "a5222bc3-d44d-4a67-aea6-03e88c6cdac3", "value": 1535200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721727, "uuid": "0aa82fc9-2587-43e2-b66b-9af635933746", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721727, "uuid": "fc822e0e-9c82-4a20-899b-1cec8d5d74fd", "value": "Trainer v5.1.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f7c74b-55c2-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638705393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638705393, "uuid": "28ee5937-bd74-42fd-9fd8-2cc99733184d", "comment": "Malware payload (RedLineStealer)", "value": "afaa0a1d412eb3e4f9d65aaf38b5a854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638705393, "uuid": "4511b848-1422-4498-9251-7b52e8085fcb", "comment": "Malware payload (RedLineStealer)", "value": "0a1843c1744835bbc1a8824d4e7000f44016f374e5f6826ad996d5eaa5098a98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638705393, "uuid": "506a7162-868c-473e-b2ec-6ed495cb9460", "comment": "Malware payload (RedLineStealer)", "value": "d241b8bf5ba6073f7e018f04d9c6a834a4e0d92d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638705393, "uuid": "10e56514-0675-4d3b-8291-7b983eee62c0", "comment": "Malware payload (RedLineStealer)", "value": "6156f694be37651bf20e1fbef4a4498dfbe13f8f638d9f756ce99def0b671b57d09511f43748ded6033288d33d0ff1b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638705393, "uuid": "7186c664-06d8-4e5b-8366-7c5a5ff0f43b", "value": "T105349DC276E18975D0917E318C66AAA05B7BFC12DE60910BF678979F2FB33D04632316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638705393, "uuid": "c889e22c-a5b2-489a-9806-9f4b9d0b3342", "value": "d1a94cee27a98fbb5af97cb40abb5c8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638705393, "uuid": "50ab2c4b-035c-44a8-a2ec-4e02a48369f8", "value": "3072:gdz/GNbtg5wPbp+TsLPTrnoUUViou9o+hsZVggjcGkNIVqI/sxkgaBCh0pZa9uDo:gd6NUT474ZuEb7ITsqXigaXwVfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638705393, "uuid": "6c6c5cda-a52c-4c71-baf8-4dc03f1d9b75", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638705393, "uuid": "23416454-a3b3-4284-bd6d-00be8b766f10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638705393, "uuid": "5f3f0ef8-4c0e-4362-8ef4-f4896da4af48", "value": "afaa0a1d412eb3e4f9d65aaf38b5a854.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9887e5-5590-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638683801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683801, "uuid": "ac468425-49e0-4cda-8ebd-0bc06916d413", "comment": "Malware payload (Heodo)", "value": "163b367cc89694c7e76abf51b93c51e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683801, "uuid": "035fcd59-ae4d-4e1b-ad39-a2d3309ab8e4", "comment": "Malware payload (Heodo)", "value": "0c663288c8b876e7e197740ec515f764f6fad86f508e12cd6068c6c94491e0ca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683801, "uuid": "cec98719-6aff-43d0-be70-74eb45ce258d", "comment": "Malware payload (Heodo)", "value": "581414fca94bcb9ad623cedc2c3d01fb65491b24", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683801, "uuid": "e4208c7b-ddd9-4f49-9205-562aae3d0b69", "comment": "Malware payload (Heodo)", "value": "9f160ce83be0958f4115ccc936b91e14e139c2cd2d59718b6b60b50d393e4ab6e0c1fce16b4b1bc193158e6d7272f44c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683801, "uuid": "7c8c915a-8d40-4d0e-9f0f-9407b14eceaf", "value": "T11D645B01E211A139FDE710FBC6FB48BD99AD9B00234869CB92C96CE5E7564D53C3262F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683801, "uuid": "12b0f0db-3f1d-4f5a-9fdc-430db54f2182", "value": "6144:5e6h8j0hicbUpw5cD1zCHVysjTSDs0gduETZBTqmyGVWHmw2MnvXkN:5e62IbUp6cgHVysjTEs0auETHl4GbOXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638683801, "uuid": "e9434c57-a2c1-4bbf-baf6-f1c3ea8468dc", "value": 309368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638683801, "uuid": "b3b22777-960e-4072-89bc-af7bbe045ad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683801, "uuid": "8d9796d6-3826-4e4d-b068-b624997c9efc", "value": "emotet_exe_e4_0c663288c8b876e7e197740ec515f764f6fad86f508e12cd6068c6c94491e0ca_2021-12-05__055637.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b118df5-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638693889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693889, "uuid": "0e8bbbbc-4d0d-4d2e-9db2-7cc3ffac08d0", "comment": "Malware payload (RedLineStealer)", "value": "d26d44e3fcafbda2412ab16ad267d7e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693889, "uuid": "21c6a6df-ff61-4030-ad1a-66792ecb7bd6", "comment": "Malware payload (RedLineStealer)", "value": "0d154b0c19a489e7dffbf6683f0c691ec52c6c57ceacc6fe716f124d54091504", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693889, "uuid": "a090354b-b646-4b52-a450-3086c413469f", "comment": "Malware payload (RedLineStealer)", "value": "ab1e7a00000bb5fd37c1c812ba68e9a661912f1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693889, "uuid": "5821166d-ecb6-4bd2-a3ad-9e0515be522f", "comment": "Malware payload (RedLineStealer)", "value": "5f86f74df48f80167d892d37b617e1f5e27076a9fadb3957d49f1c26e844bafb12086598e8876c9b3ef4e26d08dd6133", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693889, "uuid": "cc2da8f2-93bf-46cb-8f3d-d09c8c0c4fd4", "value": "T1378533764F420A3AC13503B5DAB9F484A765E82F02DC89BFD85F6226740DB01E4BE95B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693889, "uuid": "472a83c4-5f3c-47e8-9e2b-ddf6f1a33b8a", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693889, "uuid": "4a4e9d0a-50c2-4acd-90d5-56e4bc537649", "value": "24576:vjVLywoQtQmbGEbXtsyS6Ckui/ZxbHOjhH+BcleaTaMtYbkEaHNYK3LGrh:JrtimtsydHui/LbHOlbAaTaM2NaZuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693889, "uuid": "37a8fbf5-2c9b-4536-a958-b3159b4e3758", "value": 1755648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693889, "uuid": "9ca34a10-7778-498e-83fd-fc0a68dccfa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693889, "uuid": "aa0d4180-8833-4982-ab55-70ffde77230c", "value": "d26d44e3fcafbda2412ab16ad267d7e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11d8e96-559e-11ec-96a4-42010a9c0029", "comment": "Malware payload (LimeRAT)", "timestamp": 1638690114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690114, "uuid": "d1d41ad8-55be-48e8-ac85-4c70f83509ff", "comment": "Malware payload (LimeRAT)", "value": "cfaeebad37470c096b090d3ade763601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690114, "uuid": "803a4a76-d686-4756-b4d2-dc5938e0ff94", "comment": "Malware payload (LimeRAT)", "value": "0e69af9159b216996061639ebb6ab0a2a4ef9e1cf02be2053c9f1b3aabecd9ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690114, "uuid": "8f8d5c2b-0de9-4dad-a788-fcba348cc5f4", "comment": "Malware payload (LimeRAT)", "value": "b69fed6c53653aeda2d25b8f5b4075bcfaa175cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690114, "uuid": "893cf8f8-4a51-4c91-940c-dd0f01b7089f", "comment": "Malware payload (LimeRAT)", "value": "3387baa0446d55c6e2526dae54af722a3f652c0c58cc4d821abab328c331eca211c8c48a3657d9483c56f8b2bf488163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690114, "uuid": "eecba6c0-5de4-4f2c-9e89-6b620c08ef1f", "value": "T186258142AD621CBFCB03D6BB01A7A9B3F6C7A62963B6B660E93C4D50C0553113D5C9EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690114, "uuid": "fe9c14b1-39d8-4415-9e42-505cb5876506", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690114, "uuid": "e6f2bd90-fb0e-491a-984f-bde2383d903c", "value": "12288:lOEuiIwphjANUqQVtA4SzdeGinmBcjaLObEqBIhdF5PAJcltveohVz5nXM:npnmrUIhd3iuGUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690114, "uuid": "5bff9c15-b6ce-40bf-899b-55abfa586640", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690114, "uuid": "9137f10b-717f-452a-97d0-c00993f142d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690114, "uuid": "d6392781-e748-44ce-880c-73d577b49194", "value": "cfaeebad37470c096b090d3ade763601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931a0b14-5597-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638687003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687003, "uuid": "0e180d04-a689-4c5f-a43b-99cdfdd3952d", "comment": "Malware payload (Mirai)", "value": "97110524554c47013fe6186a3a55a15e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687003, "uuid": "a228b3d7-f8d0-4bdc-859b-d11bb859d165", "comment": "Malware payload (Mirai)", "value": "0ec82b6c1c1caafb1b4fbf3dd880f1485dfcf285c4f892bdfc8bc4b655db902e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687003, "uuid": "6849ab57-bfce-4262-8af6-eaedbebb8153", "comment": "Malware payload (Mirai)", "value": "a8e5e15dedcc6a1fc7852f0712b892836d75861b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687003, "uuid": "7d1bfa5c-5786-41d7-8dd0-3f8162e48e2a", "comment": "Malware payload (Mirai)", "value": "533e8c494ab4b6c81ba9b2e81d4a02124eacfaacb6e0685932d1ff48f1c0b746938484c3f1386c8ac4247dce4e19426a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687003, "uuid": "057e6671-5cfa-432d-b769-7fbcbed96781", "value": "T17633F121F8A2AE21CA603A7B6079474373B1707D571F2152B1148CA6D5F698583FF3EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687003, "uuid": "aa272512-0506-480d-ba30-4e68d0f64ddb", "value": "1536:7OEsmmxbILUFVZA3icdDVqZBui0Kce79LymxrxKpXqAW3x:7OEvm5ILUFUVVqZ0Kx79LVyXZW3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638687003, "uuid": "9d5b460e-53fd-4eee-8be8-67901f987e7b", "value": 53632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638687003, "uuid": "c61f2a78-ac65-4964-83c3-8596c76060c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687003, "uuid": "bbd167ef-2123-47a4-9f64-b5c973504430", "value": "Tsunami.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a712d1-55b6-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1638700287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638700287, "uuid": "bcaef0f9-0cbe-49fb-8308-fa9c97f79428", "comment": "Malware payload (Amadey)", "value": "8925a721510375d1594c219c020b1ea2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638700287, "uuid": "3bf88b82-8ffa-45d2-bca8-f556cff9bdb9", "comment": "Malware payload (Amadey)", "value": "0f4458429fe8bf9a086aa075472cf541cfb59e086a803a81de1fafa2423eac73", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638700287, "uuid": "35a4256a-12cc-4c53-b1bf-ee022ca5fc47", "comment": "Malware payload (Amadey)", "value": "1d0f38528101016d9dd5f68f96c984283adb76aa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638700287, "uuid": "f3542e6f-0ea4-49f1-bede-ea5c2cb1b778", "comment": "Malware payload (Amadey)", "value": "4689463c689e4e087e2a0109a966a4f9aec490c9e400fd77ce74a2d92712d7fbc6c0f6e47d2076998cb828686552ec88", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638700287, "uuid": "fa33759a-75aa-40c2-8855-c6e72747d4a8", "value": "T1A854AD1132D0C432D58729768525CBB58ABAB4302A666ACFFFD41EBD9F207D1A73530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638700287, "uuid": "90d48f03-f083-454f-a5a0-7c0dd94e2582", "value": "57414c9b174f8e0ff83324cb2c99bb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638700287, "uuid": "325b3cbb-b02f-498d-ba85-f99c3945c0c1", "value": "3072:XXOnifz6+kxF/ALYxGiZ8t6GJi/PdgcEkSjrC3MBeF2TvqsQMxG56Xs:nvfvkLAsZqa6xfa3MsFcWMP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638700287, "uuid": "ee390b9a-8376-4b3d-8b72-f9322dbe73c5", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638700287, "uuid": "5c370a85-89ef-4465-84d6-34a4f7d532a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638700287, "uuid": "521e8acf-788b-445e-b057-3611bb063a35", "value": "8925a721510375d1594c219c020b1ea2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015e48a6-55a2-11ec-96a4-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1638691483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691483, "uuid": "d0393f7b-2451-48ef-8bb2-84fd1f8e7c3b", "comment": "Malware payload (QuasarRAT)", "value": "ea98a0f6663811bff8a9ba6c1ef6f13a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691483, "uuid": "2c847459-9d10-4b62-b2de-8799c1ae7abf", "comment": "Malware payload (QuasarRAT)", "value": "10bf0fcaf1272674e3c53d375d7ded2e1b17059c86a23746fc3c6384131c3432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691483, "uuid": "d4591a4e-c48a-420d-ac32-b38bf1f085b0", "comment": "Malware payload (QuasarRAT)", "value": "d0baa31bd85c12a66b06a2d6d23258316331096d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691483, "uuid": "a8f1c7cf-f0ac-42f5-9fb0-a8160091c848", "comment": "Malware payload (QuasarRAT)", "value": "6344ef7a89dcfe109aa4bee62810a90442bf01a1ddcb60c045d48c3566645d20e03b1c593d6a9ae365d796b9e7b13fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691483, "uuid": "18337827-c226-4f77-b4d8-c3d4ce86cf9d", "value": "T1EDE25D6487F229CDECA2AEB0DF79CA00B7B2ACA4552C4B1FD1543DE61577300D6538BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691483, "uuid": "2ae89c9b-2448-4a1b-aeb3-af9af8bd2131", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691483, "uuid": "70e25067-46c8-4432-bb64-7153707cc963", "value": "384:scM1J77F8fr5/LpbRuj2oKsgEvMcUGTTTTmASg3FFFFFFFF7idlQTWAgkW:scMLF81jlyMMFFFFFFFFaQ3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638691483, "uuid": "d524edef-df7e-490d-977c-054eede51dbc", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638691483, "uuid": "71a49224-d153-413a-af76-92b55363a45d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691483, "uuid": "655801a7-bbbf-42f0-b9cd-d3f6251c4dfd", "value": "PurchaseOrder_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a35a358-55e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638722046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722046, "uuid": "e090f681-a228-416a-94fd-2d68e20f3368", "comment": "Malware payload (Mirai)", "value": "e0d788ace36c900b39b1068c9f555f1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722046, "uuid": "08a121ac-fbb4-49eb-a60e-b417725f1509", "comment": "Malware payload (Mirai)", "value": "1185c73c7ae1690979b1a4d8516803f0a82912b279c113d1b9cec243992953ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722046, "uuid": "0c9d2bd0-8815-470b-bd76-6a58be6cf24e", "comment": "Malware payload (Mirai)", "value": "a2be437bcb03365c9e0e2b7d9baa8a108a00e3a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722046, "uuid": "83ebd23a-9693-48be-b2d9-0594ffc6762f", "comment": "Malware payload (Mirai)", "value": "c9590b7c4f294b7c5519a22a89b062d712cfe6e0b3d07f34b3bb2b63bbb5b66256ed7a3d52009da318d7d4ea68599dea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722046, "uuid": "4244b78a-005d-492a-9caa-5bbc4f38e5bf", "value": "T1C65339C5E5C3E9F5EC000978307FABB29973F53F6474EEA6D7D92523A941A02A10239D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722046, "uuid": "275d90e5-5ba9-4b12-9291-9af92aa2a81e", "value": "1536:K0DId8DDJoQn2chgyRCkoPOaBgA0XpuGgNBfYRu:zDI+6QnNgyRCkoP9BgA0ZMrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722046, "uuid": "9a32ca51-90b4-4aeb-86e7-944b29fd8a51", "value": 62224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722046, "uuid": "18760056-a709-452a-b2f4-d17e8d16f89b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722046, "uuid": "d032340c-fe9b-4ecd-a916-74f05e6a92ab", "value": "e0d788ace36c900b39b1068c9f555f1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c33e65-5575-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638672512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672512, "uuid": "47d5d75f-5149-4b8a-b3ee-d14110f3f534", "comment": "Malware payload (GuLoader)", "value": "a333d0d52b6aa1f3949e8f0c088f23b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672512, "uuid": "16239417-42a6-40ad-873d-bc18dcdd256d", "comment": "Malware payload (GuLoader)", "value": "125fdd6ece6bef31be73fa219aebd74708a750bddc944ea481bb07f7fa7ceae9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672512, "uuid": "39464635-b434-4837-8b65-b0475645abc7", "comment": "Malware payload (GuLoader)", "value": "b02be35cba74a537ca937e7c87dfc95ea197a6e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672512, "uuid": "c3a09703-a6a3-482f-8361-a6f87ef3a1d3", "comment": "Malware payload (GuLoader)", "value": "9719ef543bfcb343711ee274ca0187a82599e0ac3aa23a8bc87b9184bdbe0144efe30ecd3e446f0afd3bf5c2a1df70e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672512, "uuid": "416d3730-08e9-4263-9f7d-09926812bb0a", "value": "T1C1D3E110B3B1D87BD9B1073109351B7BBFBBA52621605FDB17A0AE4D7C72580CE2E6A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672512, "uuid": "fe00a83b-9a52-4664-9b06-9f23a70f71c6", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672512, "uuid": "5c90e50e-a36e-404e-a6e1-f423e967c462", "value": "3072:gbG7N2kDTHUpou4ubJ4Iz6SicNEdiZXzOcMgSCoJ2:gbE/HUjzz6SiaEIZXyVzCW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638672512, "uuid": "58045205-abbc-40cf-9839-027d7f8b228d", "value": 130162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638672512, "uuid": "66894ca3-d4bc-4bef-93c3-7c3d2072e29b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672512, "uuid": "298e7225-5d08-427f-a178-b77b3731bc90", "value": "a333d0d52b6aa1f3949e8f0c088f23b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041d610c-561c-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638743886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638743886, "uuid": "6133876d-def6-48b3-a3e9-76b644399829", "comment": "Malware payload", "value": "43ef0684e801e0157975db9a1fba57b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638743886, "uuid": "f02ef755-61b2-44bf-b322-0156da36ffe2", "comment": "Malware payload", "value": "12aecfe71ce5369d934b1e3994e59fbb60cc1b42b7faf89625d43150549bcc5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638743886, "uuid": "c5f96825-fe82-4222-a347-9792c853a181", "comment": "Malware payload", "value": "d0065781ab0b9ef94e79cd6b8b24c6ac693d3e09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638743886, "uuid": "b87e99cc-c22a-42a1-9455-cd1aa8147a3d", "comment": "Malware payload", "value": "1968b986093a011cee62d1b41197535ba573719190952e7802d4acd9c26125720e00903432ca1f0a909e1afaac89e7bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638743886, "uuid": "05ae49bb-82ae-4e86-8bd2-d1accdb7deef", "value": "T1AA65338955086F0ED61E97B0AC1737D1C02C4B16E7F12A3E746B1E8F4B1C9A8DE7C266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638743886, "uuid": "99571b25-1917-483c-a549-26a1f462d8c6", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638743886, "uuid": "5a44048a-f1f7-4446-97e7-742e5c9f74a4", "value": "24576:J2cuceEbCDs36OOgw4tqwXaETDLJYm4WVT/9yQ4vfbBCfZDpN3kEaHNYK3nEB:4cVbCDszDwIq/gDLJYux/9y7bURpN3NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638743886, "uuid": "1dc98340-deb6-409c-b42b-bc6e29b4687f", "value": 1509888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638743886, "uuid": "dff34698-6fa1-4f48-abd0-d75eced1a063", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638743886, "uuid": "363045a5-b658-4a09-8be0-8c244d09b0ef", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36346ef0-5626-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638748265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748265, "uuid": "0fa93394-b107-455a-b664-ec14fcfebf90", "comment": "Malware payload", "value": "8a5d639e5272ba4a825d7e332190c396", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748265, "uuid": "9e4710ea-90aa-4f43-890e-4d480e63bb63", "comment": "Malware payload", "value": "13b517e6f044437c0299415b2fbdea097b8c06abbbf542e7de438600dc750e2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748265, "uuid": "37354408-3224-4906-a0ee-9b9969e2b2a9", "comment": "Malware payload", "value": "c1ad8ba3a662a79307213e8c9035c99a88010994", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748265, "uuid": "615cbf02-6ea0-45e1-8d1d-805706e1a722", "comment": "Malware payload", "value": "c1cdc9f1259e155c50ab764d5e2d0cd46503b5a515d4755047d29b478708d8a2021d844b63aab81b89026be47788de5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748265, "uuid": "7035626a-824a-4e0c-9006-8ab39591b8cc", "value": "T13433F809294380B3F1058939D2C586D55FFE6C0337E3B4BFEFA606495AE129C51BAAF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748265, "uuid": "62510767-aac8-467a-8c4a-397fd7d4930e", "value": "f9ee5c2ee39cde185f350e12a0e10473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748265, "uuid": "5cf084c2-f1fc-4b7e-9f0b-52aafb4e8b41", "value": "768:dBU2FgEGQwiEmD1T3HwrWkuF9kL+VN9RhaBZ5srFI5:A2FgbQw2D1T9kuTloBz15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748265, "uuid": "8a5b110d-732a-49d1-8519-f75ace89ffa0", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748265, "uuid": "02f68335-ba3c-41ed-8b7b-4a2db5be84e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748265, "uuid": "9b26c65e-e2a9-4288-bdb9-3e139c5e2c34", "value": "8a5d639e5272ba4a825d7e332190c396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e4e727-55a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638692544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692544, "uuid": "af8f9ecb-2a3a-41e9-a90c-ea62a063c921", "comment": "Malware payload (Formbook)", "value": "50457159f17f05caaffe059b812a34b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692544, "uuid": "073b1b40-5806-4e17-a248-a85226f81978", "comment": "Malware payload (Formbook)", "value": "13d4188437fd7caf662393052ef82808bf70cdb5e31fcc2f162ad2dffad377aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692544, "uuid": "48edbd95-00f1-4b26-8414-bffc11f489d2", "comment": "Malware payload (Formbook)", "value": "1e714a93492ed274ffd977454327ad203ab5350e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692544, "uuid": "6054051f-d430-4531-86e2-e180e5b7c490", "comment": "Malware payload (Formbook)", "value": "08bde2508dce136bf9411b2521bd49760b1ae19e6b74942ccb3d29944eb9b156b2e4e5f54cae5577995a8ff6ef373867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692544, "uuid": "f88c5bb9-1d51-4de2-b711-1668e86d9888", "value": "T1B364230CEFD4C267F7254971DDF647A687BA9484409D022EAFB41FBE3A7665903202CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692544, "uuid": "1f830c58-aa6a-452d-8aee-f43fe7811b04", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692544, "uuid": "4ae9d633-a28a-4d56-aecc-959ff4d2cf86", "value": "6144:rGiFz3RuO7DbGGmH3uNOyb2HOh0STed7gB7ZaEPlrtIvhAC7+P1KoxU3qB3pAk:Bz3PHGGY3ukqSOpUGZauleZfynAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638692544, "uuid": "4801a5cf-46b6-4edd-8e82-27403978a8e5", "value": 330871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638692544, "uuid": "891a0ced-69e8-4a36-a1cf-a7dd94ea7f2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692544, "uuid": "cecfc79d-94b4-4676-b776-bc57fcebf22c", "value": "50457159f17f05caaffe059b812a34b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d70092-5625-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638747827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747827, "uuid": "fdc121cf-ca47-453f-88c1-73dfe19430ec", "comment": "Malware payload", "value": "09f61b2ba8d637f736eb599816f87b0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747827, "uuid": "e0ef0911-1778-4700-84ec-45d992ad2cbe", "comment": "Malware payload", "value": "14bb993965825a1464638f718cfa97503ff6765e8913b9e2282ad0ee43971395", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747827, "uuid": "57f2f79d-0352-4491-9a18-b65a96d84a8f", "comment": "Malware payload", "value": "19709b7299c0202362aa43911a944c60498f22b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747827, "uuid": "6397f7e9-2a14-4877-81a5-3c7c1fa3a9d6", "comment": "Malware payload", "value": "11d75b77d08a1507a6f1d71a103d9c567f40d8139ba5e66e63a67b0e7fb4539643576dee1cd1eb7a05c82e4ed4066cd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747827, "uuid": "157059f1-55fb-46d8-8464-ec6aff7cb1bd", "value": "T1EB75332F29F53F15C05A9BF9A73D27A293646AC9308580F277B94C42D4054BEB73B1B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747827, "uuid": "b515328b-ea6f-42a3-85df-af2366988553", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747827, "uuid": "91dbf54f-ba71-4626-82b8-3b3a52f75e86", "value": "49152:8HS4l6zbkj/iBhr6W3DpPLys4UiwOXNa4AYSb:8plbO6WdP2dwO9bUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638747827, "uuid": "13d85634-7eb3-48d5-8904-d8de21f169c4", "value": 1647840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638747827, "uuid": "78330909-d23a-4cbb-98ef-1e8ad44f3fc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747827, "uuid": "9a8d30ac-e454-4b08-95b4-f31a77d13656", "value": "09f61b2ba8d637f736eb599816f87b0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbb41ff-5584-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638678966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678966, "uuid": "ae5b74b7-058a-4b65-86c0-06c7a8d5faca", "comment": "Malware payload (Gafgyt)", "value": "a5328fc74b40ddc331a0b5254b576f8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678966, "uuid": "86f3b713-b77b-4c16-8aee-b285559862cb", "comment": "Malware payload (Gafgyt)", "value": "15a98d7dce106f4c2f855f9bb24cb4756e41c48e8432b236ea593ddcb49e9ba3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678966, "uuid": "946f78f7-b3e9-4f4c-b60d-224f3f9520be", "comment": "Malware payload (Gafgyt)", "value": "897c753929db8d41b70c33fbd1c409aa44199d26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678966, "uuid": "7e230bb0-c03c-47f1-ad08-b408f024af83", "comment": "Malware payload (Gafgyt)", "value": "f9b9289e76d50a412c99cf3977531cda44c4b30156a77d3173430d29f95d48321dae96fe4def156e252a74aa551843cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678966, "uuid": "0f062870-f434-4cf7-885a-f270310bcd1b", "value": "T172B3F641D6648627C2D32B7BAB9F434D3336AA54A7E737095528BFF03BC27981E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678966, "uuid": "ef16fa6e-3c47-4fb5-a26a-829f3a46f935", "value": "3072:3gv6IOcdFN+k2iy8MFOvMIhfH+jCR+GTcmaQnKBXCYW:3p9Wjy8vvzFH+jC5cmaQnKVCYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638678966, "uuid": "435a8b2f-2af4-4fa5-b6d7-326f05a5d684", "value": 111569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638678966, "uuid": "50958240-6892-4c2a-bdfa-547bdb430f71", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678966, "uuid": "ac5dbee4-fbd0-483e-b3c8-d97982367203", "value": "a5328fc74b40ddc331a0b5254b576f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef544dd4-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708203, "uuid": "f793834e-f964-4dc3-b353-e6f764fbbe12", "comment": "Malware payload", "value": "67abe4277e2840766c32b9d38d68ef7f", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708203, "uuid": "0c6be023-48b6-4cdd-90a8-5f5959995244", "comment": "Malware payload", "value": "1610ce302c7e6512799455e8b1f983274563bd132d3023b3cbaf5c3e26fd4559", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708203, "uuid": "9a9a6fa2-e3da-4ee7-81c6-57b5e29fdb4d", "comment": "Malware payload", "value": "08c4d1a8403b54f4e785fe7476f442039ef0fa39", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708203, "uuid": "f15bcec0-1a18-46d4-ab55-dc66cd23c994", "comment": "Malware payload", "value": "1e951011a8cab2ff6ced05e3d0e3c6d72e32fab6e03447fd6fa2af3d58e83a352ff0ff6474bf844402e6a6b9c2583f1d", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708203, "uuid": "ac4afe65-cbdf-4f40-a88c-5e3f3b25d1da", "value": "T190C533109AD116CDE598CF2F2F9C5936047FEFCA7864EDD392D28BF1100FE86A966460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708203, "uuid": "da53bb32-2c79-4180-b54e-3bc0638be574", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvh:G1wwAjzIQOMK2GNKslgus10f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708203, "uuid": "9f4506f8-1e1c-48b8-88cd-ad322de82b15", "value": 2732032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708203, "uuid": "f30b89c3-9269-443f-ab2b-9ff6f703b288", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708203, "uuid": "8c1a4ef9-e8ca-430e-adcb-ff0120c99c2b", "value": "1610ce302c7e6512799455e8b1f983274563bd132d3023b3cbaf5c3e26fd4559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab78f5b-5566-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638666105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666105, "uuid": "b7db9d80-2b45-40e0-bbae-d1fdfb57d46a", "comment": "Malware payload (CoinMiner)", "value": "3590cd0211742a869177f4641e4172e1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666105, "uuid": "a884733f-0c9f-43ab-b4d4-089c4c5620b1", "comment": "Malware payload (CoinMiner)", "value": "1727f053b510b8de505a6f8ca1f7a7214ca1525e556a600ca890af00eccae81d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666105, "uuid": "4269def3-fd5f-4f07-9775-c1e12fcc7744", "comment": "Malware payload (CoinMiner)", "value": "67385b620d490aeef09c77f025be8f0628a76717", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666105, "uuid": "8a8ea29b-ff33-4f8b-adbc-56c9056b0031", "comment": "Malware payload (CoinMiner)", "value": "62e2e6c82b667ea7cac60f5fa48ca5dda3e0a3baf1da5fbadaa6c53df056a8ff7194691f19e12858ce9e775673c94562", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666105, "uuid": "29fa2249-261e-40f8-af97-457b4f65b2e5", "value": "T1A0D423BECF3EC386E56C600BA77C9281A49705B40D4461E95FED4FA0BE198901FE9E74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666105, "uuid": "35255f4f-3833-4bc8-926a-dfbc34eb8531", "value": "12288:WtpKqDGiha5fB5sxXPHR/Z4XTXCuUqVH7iY4e5dgZTEHSJ3jMJfXS3mpX/:Gyjk/Z4DXtJbRTETEHSJABX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638666105, "uuid": "b012049c-7e62-40fc-a8c6-dbd063b69421", "value": 638744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638666105, "uuid": "7f0521c8-7701-48ff-894c-f551a9f8da69", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666105, "uuid": "ee30e835-605c-40cf-af3a-9bfbb9bf32f9", "value": "\u5b9d\u5988\u505a\u4efb\u52a1\u5355\u88ab\u9a9727\u4e07\u804a\u5929\u8bb0\u5f55\u66dd\u5149.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8531f42-5590-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638684140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684140, "uuid": "2b816a75-4a89-48ad-a164-f3f6b7336d10", "comment": "Malware payload", "value": "43b7ea3296aeef4d140be92a018ced65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684140, "uuid": "a9249a5d-25ad-42bb-85dd-51393526ef67", "comment": "Malware payload", "value": "17d168f4fb143f50d6d455c8a11eec0fc9948afdeaa0a46bb38a84cd850e4ac8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684140, "uuid": "49755996-9f75-405a-958b-e4928932832c", "comment": "Malware payload", "value": "d9a1fd0f324ac4fef05ac3d0a464a43f963b71bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684140, "uuid": "0e25816c-42cf-474b-b850-f6e73f8e5a9c", "comment": "Malware payload", "value": "0420faee8f2058a0221e8e5899a2abcb22c0c1940b67d55c2b8895dbb66ae861f1b6c4a208e4150105880739c0649e57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684140, "uuid": "3375320c-b8ab-4b74-aeba-056bb5157c56", "value": "T17F255A06B8919F52C6C036BAFA2F539573270B58D6F6F30699144B383FC799A4F3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684140, "uuid": "a39fefae-ac97-4310-b59c-667a99613e09", "value": "12288:vf54iYqmS4Mh2pIzp37Pe6MoQUNpjfekSEw8v1fqgPv1nc4yG5x9uNKxf2uWacsQ:35nEYdFNpbekSEw8vDukxfR3c3WUQ78n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638684140, "uuid": "81b8678b-951b-4095-8f3e-27f1c5c66171", "value": 991604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638684140, "uuid": "ecb3cc9f-0a7a-44ca-9f35-6be0a2abdac4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684140, "uuid": "95e7f64d-75f8-46e4-94b4-4f1f7f0b5600", "value": "43b7ea3296aeef4d140be92a018ced65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9122b0e3-55f9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638729091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638729091, "uuid": "64ae26f5-b061-43de-9c9b-46cd1ad2c6b9", "comment": "Malware payload", "value": "eff02b48b48c512ff6173b686fb2df88", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638729091, "uuid": "848c4d32-35f4-4308-b1a8-e13941c4df40", "comment": "Malware payload", "value": "180fad1713c547b24d1030295f4bcb3d775f5a62274a084fed3d9019de908a57", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638729091, "uuid": "0c8ab581-7ef4-4f13-85b1-4ae24075f278", "comment": "Malware payload", "value": "99e81c9291278ce9ea90d55451a7aefb97d38e40", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638729091, "uuid": "3c40d7d8-99a2-443e-84f1-1ba6b9d914d0", "comment": "Malware payload", "value": "52c655d358d1d864d4ab42dd46ec6741a634a1e31d579711ee7b25cd01cc4fead5b263eb05858656a05f303f6e25b876", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638729091, "uuid": "7eb35053-77b1-4183-a026-5c1bd5c33a97", "value": "T1F161871AF887D10C9F792317ECD3C566FF1B801B9DA21058B1ECC2495B208096B6CB9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638729091, "uuid": "87e01039-4db2-429c-9151-a4a9b906e174", "value": "48:AxT48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVO++NpBq:iGhrffvIypvK0elkEYZ8++xEzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638729091, "uuid": "2f08a46b-e8a0-4659-a574-7f71c9c210e2", "value": 3367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638729091, "uuid": "dc1fab24-dd89-47f5-a849-b9984654f1ee", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638729091, "uuid": "3182050d-86df-46cb-9067-d07e95499373", "value": "SbWw1SxL.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d0e937-5618-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638742527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742527, "uuid": "2600df0e-9f51-4013-a9d0-5d7c363793aa", "comment": "Malware payload (DCRat)", "value": "a21474a9bcf5ed1a05c556ad52b88232", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742527, "uuid": "a670dcfb-131e-4311-a03d-ec908d1f2733", "comment": "Malware payload (DCRat)", "value": "19891d4317d21efa3e924cb6df49816448435f1270df4ef4d23fd981ab1d19f9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742527, "uuid": "32c7b82a-90db-4f77-bee9-0fc4fabbbcd9", "comment": "Malware payload (DCRat)", "value": "66eaa0dfd346226bf16055f818ddfd7226f0b936", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742527, "uuid": "77e2003c-51ca-4491-85e4-196ed642726c", "comment": "Malware payload (DCRat)", "value": "9b528e9d5a7fa6f45fe0add7bed491700ec254de23c4ced976d3a8f15384815c4307fe7eb167402e41ab3c3cf0364fd2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742527, "uuid": "1eb910f0-0e83-4e3f-9b2a-072f4e4dfb3e", "value": "T1E0456C123A44DE02D129173BC6EF405583BCAD457A62DB2A7E6F73AD25513AB0E0D8CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742527, "uuid": "43a47e4d-2b60-432e-928d-366c0a00fa36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742527, "uuid": "c8bf8749-fda6-43b9-b2fa-bfe6743b4c19", "value": "24576:+fD0xM0PfkpQULK/ZVAQNaqEtwHKWOb/fCrSr+4:N604jLKQmXHbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638742527, "uuid": "692c0b62-351e-47f5-bc89-2c899e38436a", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638742527, "uuid": "3184c1a2-b8f0-41f6-a3ef-90d10ee1353c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742527, "uuid": "10480831-6da3-4526-bbd7-6c07e06f3b82", "value": "a21474a9bcf5ed1a05c556ad52b88232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e14f7d0-55a0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638690672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690672, "uuid": "ec9bbadb-7b52-44dd-be6b-29ee64ab777e", "comment": "Malware payload (Mirai)", "value": "d57c28da413dde71b35fc181269dd3da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690672, "uuid": "df6f8a0f-9ae0-40b3-b3d9-8c7d3b06de98", "comment": "Malware payload (Mirai)", "value": "19b3b42501f3ad767b641952b64c0a70863198e7774133e8d60f22b81f4aea57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690672, "uuid": "e7c22201-8dd5-4307-95cd-ac0d382621f8", "comment": "Malware payload (Mirai)", "value": "8cf2a3e45b6c5a9d1c675cc1ccf51a6ad50944d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690672, "uuid": "16802576-81fb-425c-8273-af6cb82aef7d", "comment": "Malware payload (Mirai)", "value": "0dda5e1694e64ccb4e785d82ad961c1d8c5db5e0ad08315db1953559e927d8a97f73d968a325aeffaf1cc3ddc017a2e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690672, "uuid": "daee9bb7-16c1-44c4-bb53-07a815eb54ef", "value": "T1B3736B31AD792E57C1D0A03B42F34765F2E2178F29A88A5E7DB10D0EFF34A94641727A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690672, "uuid": "ae323eb3-756e-4a50-b7e1-343d70e58377", "value": "768:Sa7dAMIZ1oYbbw19XBfyxMQoo9HKny9V7WTiaFA3iXgmSBW3ZWfDgwMPSGLO+Fdi:SWdX617bbo9XBfyJ0g8ailSpfHQbupgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690672, "uuid": "2a65b1c1-c822-45cc-ba6e-30317744a5c3", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690672, "uuid": "9c31af43-8f51-4da3-b042-a136cd686b95", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690672, "uuid": "20c6006c-0366-4228-a4ff-bdcebe1d9f4d", "value": "d57c28da413dde71b35fc181269dd3da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8131cd5f-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638693845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693845, "uuid": "f4bdbd08-2683-4a8f-9192-53715e639734", "comment": "Malware payload (Mirai)", "value": "242cf8e5344c6c3847795d991844ff6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693845, "uuid": "4eb27d47-8a2e-4675-bd49-be71109cd8d9", "comment": "Malware payload (Mirai)", "value": "1a71200b11b11f277f6277cabdea693fa0e20a0b0a37985da37827c1a733aa9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693845, "uuid": "a7a11f45-000c-4399-b94a-7edd66d210cc", "comment": "Malware payload (Mirai)", "value": "19496b8b034d35c837548d864a5dd0d9aea789e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693845, "uuid": "eb6d864c-235c-416a-b57d-26dfe6ae775a", "comment": "Malware payload (Mirai)", "value": "017e6ddd904a62088208ca9c552d711d0f7af61f27af4ffd5d54bb6b2f7567f52328e54e2668295c32e0c883824b99f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693845, "uuid": "5e088902-296b-4541-b503-b877f24b5914", "value": "T1E8F2F1837041D911FAB1CC32EDBD43C673C96F79D769D72AA61208DCB8D224612A8DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693845, "uuid": "5f3003b9-2e86-489a-a1c1-a4dd6daaea2d", "value": "768:R2QtA10nJvlSF9LA7xYIeL+BQSXxbBjBAx6fb9AyMGhgnwycq3UIkK:/+16vM9LzExN+x6fBAflTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693845, "uuid": "37d38838-759b-4d54-92e6-68fc07eee00c", "value": 37060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693845, "uuid": "fcf6de41-91bb-4461-85cd-ff878081141f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693845, "uuid": "789c355b-934a-4e7d-bbfe-55831405acb7", "value": "242cf8e5344c6c3847795d991844ff6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02d0fff-55ec-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638723559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723559, "uuid": "7be5f951-8dac-4f07-8c4d-eec1a8287d27", "comment": "Malware payload (Gafgyt)", "value": "be43f900ecc1cf21ba4f8250a179bd92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723559, "uuid": "e0c946bb-e7d7-485c-a77e-24db7cf12f4f", "comment": "Malware payload (Gafgyt)", "value": "1ab844659b45ee81d26c6c54f5f82f44bab382dc94605c44fe257347343cc7e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723559, "uuid": "ee6443b5-f8be-4178-b416-7a8f8516365f", "comment": "Malware payload (Gafgyt)", "value": "7739d22274ea2b4707993f4715cf9ff2dfa880a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723559, "uuid": "ecbdf2e1-e50f-4aa0-be13-0666d9d234e5", "comment": "Malware payload (Gafgyt)", "value": "de6fd17ba6dd15ec12eb65e1d18ccbb693cd8e741fe9fafa9944e98a0f09531f45116197384d9beb7086b22dbef5866b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723559, "uuid": "2bebf2e6-afa0-4d7a-b9d9-e04b5a316ffd", "value": "T130B32901E4518727C1D2277AB79F865D37322BA893DB33215A347BF82BC279D1E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723559, "uuid": "c01ac60d-e8c6-4459-b869-77c45c8fb876", "value": "3072:MPkl1NaxGMgTt9Ov1/B+CBDpQvfCbmTQOWsXAOn:zl1NaxGMgTA+CBDpnbmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638723559, "uuid": "622d70df-e929-444a-895a-a6b7b95c8c7e", "value": 115111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638723559, "uuid": "e4d1dfa5-73c3-4d8a-9fa9-e9d91c2eefae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723559, "uuid": "0ad656f6-ad47-454a-aa36-a9a592f3222d", "value": "be43f900ecc1cf21ba4f8250a179bd92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f75b53-561d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638744713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638744713, "uuid": "1bd0cb93-5760-4e49-ad53-5e1d39a90c58", "comment": "Malware payload", "value": "d9684d4c03ac118b9120262d340dcdb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638744713, "uuid": "cc7e3bce-3b02-4d33-a585-b3be49820958", "comment": "Malware payload", "value": "1ae23f0ef7e87606cbedc68a7c5bc45f995462d13cac3907a2a5f344e8cc3f2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638744713, "uuid": "462fbecc-40ab-4aa7-b309-edddb7c12441", "comment": "Malware payload", "value": "ba8bde97c41365753654e2a5a2ef440bb98a2cc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638744713, "uuid": "04cf210e-cee0-4ef3-95dd-e90ebb5b88fe", "comment": "Malware payload", "value": "3c37180589d96fc7d256f1e71809a2c4739c494d1e47034b8974713403003b8921df61b9bd5e7fc9966ec0ab2bd00e64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638744713, "uuid": "4916191a-6dc6-4ff8-bd33-0e98d506849e", "value": "T1DF7533B186856E02CA2F747CFD382E33D157C3A70A90504A536D7E6BB8750A1F88D5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638744713, "uuid": "e7d1c021-eef8-43a1-b9fb-a3dab8b883c0", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638744713, "uuid": "91c7a296-a59f-4c89-8734-88f817e4e3a4", "value": "49152:KJ0uFPbPe6EdfNE/V49PM+frMWcqseC1mNaMLE0:Itlb9EViwPM+Arv1ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638744713, "uuid": "b40784f0-c1b2-4f1e-abf2-897aa9d4f921", "value": 1596128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638744713, "uuid": "94c6bf72-417d-48fd-a947-6ddad8cce50a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638744713, "uuid": "bd887baf-7a0a-4475-b873-b0c8de916e76", "value": "Genshin Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f72cbe-5620-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638745824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638745824, "uuid": "7ca779ad-320c-4e50-9457-30269d4bde40", "comment": "Malware payload", "value": "3917293472695243fa50340d244b9b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638745824, "uuid": "0a475d89-2581-429c-8257-3c21475b3aff", "comment": "Malware payload", "value": "1b6596918d25eb3270b2aee4d82ea309c1402966e81c9179f4af29fa20c6f7a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638745824, "uuid": "4a23c8d1-47bc-4ce3-9fcc-8d82bc8b8720", "comment": "Malware payload", "value": "bb6a42684654e62c632edb112ed12138b799b100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638745824, "uuid": "7401e623-4803-404f-9f1b-e1d9e058b231", "comment": "Malware payload", "value": "4f10df2bb4b7f3366f76d1c64bcab72ba82df857871fe44c27f9422ad8a525d8b830996ff146a57c4fc6e737ec6372ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638745824, "uuid": "8f7a2e04-8330-456e-82d7-02396c3285f3", "value": "T1247533E9BDDD7425D2CB523834EF7E9F6230F128DB54B46A2D07067C1A26903B119BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638745824, "uuid": "76463438-b03d-4e67-adee-5766349cda3a", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638745824, "uuid": "d4f9be25-0317-4662-9c85-e3da1839e0eb", "value": "49152:t/nBMvXHG/NSVQTfD52H2H+ZDAGlOG1dmYLNaS3GoV:5BMvXHqGmt0vZHvdl5zV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638745824, "uuid": "cde5d3bc-7303-4791-b132-f55daa7078a0", "value": 1679080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638745824, "uuid": "72c8191e-e7d6-497e-b0c9-2cdf7925e8a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638745824, "uuid": "cc78489f-b965-4bf6-a5bf-acbfe86b6c58", "value": "Omnisphere 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf50e8de-5584-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638678944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678944, "uuid": "e3c485c3-4eb7-40d6-b33e-2ce38a0485dc", "comment": "Malware payload (Gafgyt)", "value": "ece27211cccdab4e2fcd5bf75eb8428f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678944, "uuid": "4bbaeea5-e51e-4841-b924-cdc7565e819e", "comment": "Malware payload (Gafgyt)", "value": "1bc344e555d67a79a1969853204b2144df413280825a1b23adb9d1edc4e4ffee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678944, "uuid": "cad59fa3-a180-4779-a892-61fcb1ef61d3", "comment": "Malware payload (Gafgyt)", "value": "628397ac2e99e8be40f55267d51be5d771dda57c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678944, "uuid": "5f514d2c-4000-42fe-9d0f-fb8e012f4268", "comment": "Malware payload (Gafgyt)", "value": "2bd746db773ae20e43c31a0deeabf87ed755a71e013bfe536cfb234fc382628215c6185fc4c609089ae7e01e16eca24c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678944, "uuid": "209a20ff-bf7f-48df-aa46-b7aec852a669", "value": "T139A35B53532D0693C98B9AF02DEB27F183AAECA022B25245950EFFD41773BB05056F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678944, "uuid": "26411c87-21a2-4ebe-98d4-e1edefabf57c", "value": "1536:mEuxi1gB9suI/dJuwNT0LzObEGD8FrsWdLrKnlc8ImsBskFZnBW:mlsgBg/WhZG9lem8skPnBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638678944, "uuid": "4b8abc4c-98fa-4e9f-8537-1d6265f24254", "value": 103876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638678944, "uuid": "5bc03ebd-4324-42c1-bfbb-1bad64556110", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678944, "uuid": "4f0a6301-c738-4305-a55d-a437a484b7d8", "value": "ece27211cccdab4e2fcd5bf75eb8428f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fb3e5b-5616-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638741636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638741636, "uuid": "f12625d5-1379-4e09-b2e7-8ada8987e08d", "comment": "Malware payload", "value": "8aa0e4ac30dec0f35ea15cc9d8e73d72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638741636, "uuid": "e2e7fd88-bebf-4718-9d2a-b1641f21a3f9", "comment": "Malware payload", "value": "1c1462ffb96a54d81ebbc3b661c1ec65c37a675ea8df760395d04a444ceb26b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638741636, "uuid": "12491319-7b9b-4e3f-8d61-854de1e0b320", "comment": "Malware payload", "value": "2635633352a8c07f0dd7b92f439a26ff810c0b5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638741636, "uuid": "cb4a593f-dde6-4ab3-afd7-9c1d1be0bbd9", "comment": "Malware payload", "value": "82f3a4b3b54850dd3930a901bf39e488f2e0c95d2287eb621545e68fe0067465802d4090f2c6debf053260faaf82a0f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638741636, "uuid": "a11d2563-25ba-45e4-97dc-bb3e6da35cde", "value": "T1E4841428687FC05940E3EEA52DDCA8FBD99A95E3640C743701B4A33B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638741636, "uuid": "520d6919-b590-4956-9f77-9ca8f8638e0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638741636, "uuid": "c000c0f0-a2a3-4171-bc1c-58606824acaf", "value": "6144:MwEbNiGoHqrFQWq70eKzut13kqydX4QC+ITo:1EBiLHqrFQWq70eKzutNkqydX4QC+Ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638741636, "uuid": "8a7366d6-1684-4893-a893-f554bb099fdc", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638741636, "uuid": "63c701b3-2bdb-4933-9433-c933fd443908", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638741636, "uuid": "167e5db7-c8d3-4fab-8368-e82dbe541338", "value": "TechnoGamerzModMenuInstallerV2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4326cc39-55b0-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638697607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638697607, "uuid": "55171837-ed12-4c81-939b-90a74575a46f", "comment": "Malware payload (DCRat)", "value": "ace2c8b48d4a50ba44b919ab8fb3eeb2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638697607, "uuid": "fea4a6f3-7af9-4290-bce1-05836e1983e5", "comment": "Malware payload (DCRat)", "value": "1c68c373082b359f47dc885cf4ca68342195f48b83c14c7992697becf4d22035", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638697607, "uuid": "c5de274a-9c63-493d-afa9-434dd7850a92", "comment": "Malware payload (DCRat)", "value": "de4b8349853e839e4072a4031926d2e0c6c5f651", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638697607, "uuid": "704940cc-f5ee-4dbc-9f70-71aaf7bdc7da", "comment": "Malware payload (DCRat)", "value": "6574765de0d78ff28c9b83776fc45d53783a8b1073e49bf65fd2be698487c2d1ba7cfbbabca28aedc146ab322e1f709f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638697607, "uuid": "84ad80c5-14c0-46aa-9ee4-e28438beaa3c", "value": "T191456C123A44DE02D129173BC6EF405583BCAD457A62DB2A7E6F73AD25513AB0E0D8CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638697607, "uuid": "69e311f7-9b22-4c55-ad58-ac83d05eef64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638697607, "uuid": "f5f6c5b7-03b2-4fe9-80dc-0b9b56e6aca4", "value": "24576:mfD0xM0PfkpQULK/ZVAQNaqEtwHKWOb/fCrSr+4:F604jLKQmXHbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638697607, "uuid": "20045683-df3f-4eb1-a66c-ea8a568f6795", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638697607, "uuid": "61880f2a-207a-47ce-9237-50ce899e1705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638697607, "uuid": "c492fbfe-2dae-4928-af03-884595f447b1", "value": "ace2c8b48d4a50ba44b919ab8fb3eeb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6242ac4-55e7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638721476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721476, "uuid": "0431582f-f2ea-442c-8e34-3fdd7358be25", "comment": "Malware payload (Gafgyt)", "value": "e951a2bcdc902d92b94deb4be9fc7faf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721476, "uuid": "685ae3ab-dc82-48e9-ba24-f4254fab8e66", "comment": "Malware payload (Gafgyt)", "value": "1cc9f45016d4b19f297b256f553f58dc326d5edaec44256d598ba0ec50e1f7f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721476, "uuid": "5775aa12-70db-49dd-bd55-e05d4c953a11", "comment": "Malware payload (Gafgyt)", "value": "685de14b927c61a2e9cfea35303f9cd2505eb9e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721476, "uuid": "2aab09d3-b6c4-4028-8724-66df95e73fd0", "comment": "Malware payload (Gafgyt)", "value": "dde0ac23b264db67ae8444fb7f0476703b574d66b5188c56d28569d9ae000ba20a09280e159be395103edb7f23b9a333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721476, "uuid": "7e346f90-de78-42b1-a089-1ad2db8318e7", "value": "T1D7B3942A7E12ABFFE168823107F75F70879522D227A19386F26CD7181E7128D1C5F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721476, "uuid": "1a41db7d-1910-4363-9d00-22e0d4d46e8e", "value": "1536:P7ju1Tepq+XLYh2rKVneDLNTTeTUdAOkirQYOlAUmkiSFxfC7xbXe:WsQiLNTryOkiNOyUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721476, "uuid": "9be6489f-2de2-429b-b253-00e5fd273b09", "value": 117386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721476, "uuid": "15649d00-af44-4c3b-b66c-9c3a106eb177", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721476, "uuid": "dff97cc9-2490-422a-ad58-8bf60603c0b5", "value": "e951a2bcdc902d92b94deb4be9fc7faf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896bcff9-55f9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638729078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638729078, "uuid": "1374efce-2234-4a52-b83b-861853839f11", "comment": "Malware payload", "value": "db5fe2fe65a2da0a63d33e5c68fe77ed", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638729078, "uuid": "f8c50f91-7c38-40f0-ab7b-40e0960ef4b7", "comment": "Malware payload", "value": "1d9b6d4039d357fcc109efeefbd1f97a47cca6113159eb2ad9c9b1afc70a0a76", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638729078, "uuid": "d85fcdb4-0985-4059-9a09-636f2d886589", "comment": "Malware payload", "value": "14afb07c25a20d3aba2cae2db356f9117c22796f", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638729078, "uuid": "e28f09f1-ed48-4d6a-b52c-e392002919a6", "comment": "Malware payload", "value": "e39a2c2cc89c71bda81b8d252d7e003851e31f9435912d4b9c482ab6a5212ff6a3f08308dc88e44513ca2830d0daa8f9", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638729078, "uuid": "e86fb213-9d3d-44c1-b32d-90c7a4bc1934", "value": "T13E51860AFC47D14C6BB9236BED87C662FF1B811B5D96100C75DCC2495F20809A7ACF8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638729078, "uuid": "57d69591-9465-44fe-b3a7-355f954c0931", "value": "48:AkD/48OjOLuDQjvUKmc4TQ7QZE96pAUYRAz+oyWKLrj6l1CelkEJmZK620oGhl4X:nWChrffUypvK0elkEYZN8Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638729078, "uuid": "100d7523-6144-4e99-bf50-9711d7b8ecf6", "value": 3164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638729078, "uuid": "e3106107-823c-4fa5-8f01-07c05a7fe622", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638729078, "uuid": "b8e9f15c-a91b-4bfa-872a-a5404288eef4", "value": "s7znV8xF.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66eb2119-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638693801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693801, "uuid": "798801ae-43b6-431c-8eeb-8d2f49ca2963", "comment": "Malware payload (Mirai)", "value": "e5cf92c5bb9101195db5f9299f9c3b8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693801, "uuid": "6203de3a-5ddc-4916-8df0-2bf0e538a67f", "comment": "Malware payload (Mirai)", "value": "1f32d2ba464973f68e765365c460eda72a9eb041b50fdf89db4b580f14da383c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693801, "uuid": "e566fcec-298c-4150-aece-ad69cdb90779", "comment": "Malware payload (Mirai)", "value": "69c74d7982b08c402affef2f2377094ff84e40c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693801, "uuid": "28ac112b-9f56-450b-a6cb-4abe4297cd45", "comment": "Malware payload (Mirai)", "value": "b24218e76d6aa0547febf54d5c049fcf96a2ef1c3a4eae2645d0d4f671eadefe9f0c78760ab9310ef8b01109b1225f9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693801, "uuid": "2a531bfc-6cbf-4dfc-918e-81bd60d62af8", "value": "T1AD639D72C5295DA4C09486B4B6388B704B63F504929B6FFA4D8BC2719407FBCF6193FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693801, "uuid": "a436b26a-e329-4f48-902e-22e34a1656fc", "value": "1536:qPmaVY6bEcnYOF0fAnstTCKQmXFBB7XxlRCzSaZ:NWbEcnYOuNTlQCB7XxPqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693801, "uuid": "6108f16e-8cf7-493d-a21f-24eecaec2dae", "value": 66952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693801, "uuid": "c3f9c190-e470-4cf6-8fd9-6ad2b8a450ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693801, "uuid": "0c808eb0-bdd3-4f57-afaa-e580f55abe89", "value": "e5cf92c5bb9101195db5f9299f9c3b8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c01f0a-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708207, "uuid": "9092ac4c-617e-4860-b41e-0402b03e5549", "comment": "Malware payload", "value": "8e08acfc8dbd8625541850694798504b", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708207, "uuid": "f64a2673-6ada-4302-bfa9-6f725bfe9f32", "comment": "Malware payload", "value": "1f9302a87c00eae4255781233d3577bdc088c810fe7f886b864ca3098bb48c1e", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708207, "uuid": "d998907c-8e2b-436b-99d3-077c695194cd", "comment": "Malware payload", "value": "6dae247c0d5c95cb1c327a9709348722e74f5b0d", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708207, "uuid": "d7c151dd-36f4-4a10-9bad-d70fab326664", "comment": "Malware payload", "value": "6b9cdf5475054f93f85560a21f37170fdc4e133ded2e17a54f5adee71936a7c3ac753e052c03d843f65171880607154d", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708207, "uuid": "e8489d9b-ac8d-4e2e-ab01-b57d87e9bf79", "value": "T147B5330069D107C9E598DD1B1F8C9936047BEFCA7834EDD353E29AF1200EED5AA939B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708207, "uuid": "4ed186b6-4ac1-4ac4-b664-9503f0bc44e7", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3eU:G1wwAjzIQOMK2GNKslguU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708207, "uuid": "e2976d99-f913-483a-8864-3368d2185fc2", "value": 2330624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708207, "uuid": "190e03e4-3063-4863-830a-8deb03c3f622", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708207, "uuid": "7ceaa491-91f2-4466-bfac-4d7afefad92c", "value": "1f9302a87c00eae4255781233d3577bdc088c810fe7f886b864ca3098bb48c1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d7b717-5597-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638687005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687005, "uuid": "4da296bd-b62c-4f6b-9626-7b40b420109e", "comment": "Malware payload (Mirai)", "value": "888b4f32133f51ddfd7ad07bf1d00956", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687005, "uuid": "c0bf1352-41c7-49db-beff-6d1304363a28", "comment": "Malware payload (Mirai)", "value": "1ff10b4edbf0263e02cd48e09eadff6cc2b98f298804940145d5d4ae0e3e84d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687005, "uuid": "73bec9fb-100c-42ba-9427-a8fe83f655cd", "comment": "Malware payload (Mirai)", "value": "108cf50f6121b81e3eb428dae554446a55fab48a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687005, "uuid": "be4d8350-c37f-4b69-b109-afcc160afc47", "comment": "Malware payload (Mirai)", "value": "9c8bb18073ecad5952dd14df5cef10a47f15f96638293e8787b89a845191c907e8233cb9885b02fe05db038064e31334", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687005, "uuid": "9a42da32-9697-4653-81de-18c4e9f689a6", "value": "T160D2E11D27906CA3D248233DA63F4D4E56A56DC8AB56DE1C27E78828D6538788B31FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687005, "uuid": "197d4976-c368-4416-bbe8-fdaf4bb7a825", "value": "768:4MxAUVAkj0UWT81SqWZZSrlar9Z9hkJBVv:JxAsja84qYicrr9hkJBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638687005, "uuid": "2029ecda-47c0-457b-a7af-96a03d85a7fc", "value": 28968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638687005, "uuid": "0551970a-44d2-4033-b9b5-095a912ce2a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687005, "uuid": "c121782c-9028-42fc-b4af-973c265445ef", "value": "Tsunami.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f2d2aa-55a4-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638692437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692437, "uuid": "f09f0238-b1e4-44a5-9b9d-0bafa4792bd3", "comment": "Malware payload (CryptBot)", "value": "fdfaeda0d19267131ceb8df1f268589a", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692437, "uuid": "b18d6bcd-b261-482d-878b-66530a753201", "comment": "Malware payload (CryptBot)", "value": "20e105c941a9e132dac2ccc56338ad062bd2f35c5048ac70b1cb3ead05faf7b1", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692437, "uuid": "a6a6418d-a2f5-4284-9707-c2792b21ae51", "comment": "Malware payload (CryptBot)", "value": "ef76c0a9de732fa4cf5d87e50b025ce906e89c08", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692437, "uuid": "75e951b4-66d0-4ec5-a23b-2ca7340a3a99", "comment": "Malware payload (CryptBot)", "value": "507fc43f6440520dc6026cf258ed907f4b7fe0ecf73070b87d6e7d6f641e0f516c4f0cc163d9783981dce060fd27c2a7", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692437, "uuid": "2c9844ac-a76d-40c2-b251-fd0cbf680ca6", "value": "T17D84CF1573C0C072C4962472892ACBB55ABAB47517661ACFBBC80BF95F387D19B3630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692437, "uuid": "5090f785-4deb-4ad6-bfe5-55056e5e249f", "value": "1b81e8f7d77881f7dbd36488c7ba26dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692437, "uuid": "7bb2cd15-e8cd-4ac7-9f01-5d169b095b11", "value": "6144:HUGGDR02emlHa9y5nryg/eEVyYhU5NX2YNXs7ddHkUJatHz:HUHIml69MryCeUho92wc7THJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638692437, "uuid": "9b639043-e4a0-4557-8ba9-7c304a493ccb", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638692437, "uuid": "5c68a621-d32e-4827-aff8-6749da5fae7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692437, "uuid": "bca21627-5629-4663-87d3-204642b83d2d", "value": "fdfaeda0d19267131ceb8df1f268589a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34682ca0-55e8-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1638721634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721634, "uuid": "45d45eaa-931e-43bf-9932-984c4202393c", "comment": "Malware payload (NanoCore)", "value": "ff05a80269cdf61f239bef42a83f09e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721634, "uuid": "56a93ae4-6046-43b7-be1b-7dffece367e9", "comment": "Malware payload (NanoCore)", "value": "21f0ed76e68d5e03e6ddf5c800d66c6f56b09b12eaab8a6787be97abdd6bd12d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721634, "uuid": "aae2768a-d9fd-4daf-8f06-7b5d3f9693cb", "comment": "Malware payload (NanoCore)", "value": "03bac519d4920fa61a7bcad3ed4d6f597869ecb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721634, "uuid": "1c3d04c3-89e3-44df-9cc9-088604aaa882", "comment": "Malware payload (NanoCore)", "value": "bd55155c3e7c34ff22b20c47de77e1587048eaab8c4ee38aea73ecba06f47a743957a06449c0387c2583c8c267a1fb1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721634, "uuid": "19365b80-ddf4-47cf-83d4-a70854aa033c", "value": "T11F14CF263BA8862FE2DE857D611212569379C2E3E8C3F3EE58D451B35B627E1470B0D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721634, "uuid": "6b64b82a-6f66-499c-86e3-10368cfccfd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721634, "uuid": "aaf45bf3-3222-4f3d-9048-e7bf24280d56", "value": "6144:wLV6Bta6dtJmakIM5jehjauz5+CE+RkLXUz:wLV6BtpmkNjBA2SLXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721634, "uuid": "03369cb5-3b5c-4b2c-b179-b9f34623f95e", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721634, "uuid": "c71297bb-099d-4239-8151-74445c6409a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721634, "uuid": "f4760de5-1aac-481c-a454-975d2af5a16f", "value": "21F0ED76E68D5E03E6DDF5C800D66C6F56B09B12EAAB8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47b7f9f-5580-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638677181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638677181, "uuid": "441cc802-dc5b-4bba-a946-ba187f8e3f92", "comment": "Malware payload (RedLineStealer)", "value": "37c3cc39c8e35bbd5946f4d9b7ac76f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638677181, "uuid": "9f9f95fe-25c7-4b94-8eae-becb2acf6c1e", "comment": "Malware payload (RedLineStealer)", "value": "23a5e5b0cb827bc3f5d193dea0aaf03296c7c4f4a34eb5884caf8db7d12a7eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638677181, "uuid": "be38fef9-80c7-45fa-828a-03dc4ad683c4", "comment": "Malware payload (RedLineStealer)", "value": "e7b8dccd7228e8e8e34bc4b9ccc2a63658d96d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638677181, "uuid": "f1b094aa-4c6e-48c7-af41-343a35100503", "comment": "Malware payload (RedLineStealer)", "value": "c922aab1cab58cb2034f5cb6d4f0870c44e5f96904ed0518712a0643a87fd4619e957dad9977f864f1e814a92bf6154b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638677181, "uuid": "ba069759-2c3f-4ea6-a5b2-47dc0551803c", "value": "T14694DF1277C0C033C09270768954C7B19EAAB875472A69CBBFE84EBC5F647D1A72634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638677181, "uuid": "61650a59-a5c3-448a-a979-1f193d87c77f", "value": "ace494ecc2c2c2c7ecf836ae6aa78574", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638677181, "uuid": "7d6211b3-ac8f-492c-ac6c-a0d4cad2177d", "value": "6144:ZmzoLKY3CcsOj7eQuwozBTvFkPjgAr3tNyJ+fBBkV9Ht8/WhN:Zm8m3SeQuwozQPjfDNU3tL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638677181, "uuid": "cac4d35c-e802-4ad9-b011-ecf12035fb96", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638677181, "uuid": "76b6f45b-ebc8-4d4a-9afe-43ecf3dff0e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638677181, "uuid": "52c781eb-cd86-4744-9d43-51b904191641", "value": "23a5e5b0cb827bc3f5d193dea0aaf03296c7c4f4a34eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cf4511-5597-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638687053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687053, "uuid": "31a603a8-d9c3-4a84-a4de-ee70899ad9c6", "comment": "Malware payload (RaccoonStealer)", "value": "1ac477e104183f2033ad5caabd8b9a76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687053, "uuid": "7f61d011-23e2-4741-8849-d3ca0864c6b7", "comment": "Malware payload (RaccoonStealer)", "value": "23e3ab4aa0841cf162fb7b324aa458ce04d47c325fe5ca47ccd3abc77ccbd86b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687053, "uuid": "1a58767d-ccf8-4880-9d2f-4b45341fade4", "comment": "Malware payload (RaccoonStealer)", "value": "e1f62d9cd12c2f3bd4338791090315fa3bda4e20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687053, "uuid": "31af194b-69be-4e6f-b14d-823f35ead711", "comment": "Malware payload (RaccoonStealer)", "value": "6204c7d62e5b583a87cadcff1ff8d2d277b726c8fed1f84e5a99ad02e9a1f52c3a42a19dd2d754ab72d9b7b81cabdbaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687053, "uuid": "6fdca266-81e9-493c-b62c-d38ebc8ff1b9", "value": "T15AC4E11132C0C033D05734715A16CBB15EBEB871566A6ACFBBC41BB95F24BE1AB3931A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687053, "uuid": "d20101e2-9179-4666-929b-5350fdbf0ea3", "value": "c5abd64536bf33cf9d17453c6dc09550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687053, "uuid": "e745db4c-a5e5-4cb4-b99c-e409a0593dfb", "value": "12288:Fa4AC0hBxhksIfYlyoU9BiqGmMvbSZnnD:Fa4L0FhjIwly1BiqnHZnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638687053, "uuid": "95e7ffa0-cfcf-4794-b85c-81e4a07d4934", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638687053, "uuid": "6a4e5e7c-ce7a-45fa-b505-c54f3252ce6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687053, "uuid": "0753af50-3416-45f0-9fa5-3e80850cab0f", "value": "23e3ab4aa0841cf162fb7b324aa458ce04d47c325fe5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89ae439-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638693911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693911, "uuid": "8c26c079-969c-48e3-8aa3-51925c4d572b", "comment": "Malware payload (RedLineStealer)", "value": "1f3d6e212c9c98021962dcef42be629e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693911, "uuid": "67773593-2870-4a07-9213-d61c7215df8e", "comment": "Malware payload (RedLineStealer)", "value": "241d7cce19c3d20991809c9fa54eef412d9068d0d09eea2d0c05365bc6c0be6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693911, "uuid": "cbc9b6e7-bc45-49ed-bcfd-e1af8f62021a", "comment": "Malware payload (RedLineStealer)", "value": "d124a356cc67b25cf1101b7fcf66c55d29d909ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693911, "uuid": "9464d466-eb87-420c-a207-efee0c4c2249", "comment": "Malware payload (RedLineStealer)", "value": "95314e46ce319413d2e8918e6e3311ab673497d8b3f388668ac4e007e0674db56b2098f84ba85bdaf6f736aba275a114", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693911, "uuid": "1f3953a5-30e3-4520-93e7-36cb4984c2e4", "value": "T1D6753333AE4DA5A2CC4638789B449D26FD00160FA2FC917EF30F1E5EB2F6E254178691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693911, "uuid": "6f5af139-1b86-4569-8a3c-069b8d2867e9", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693911, "uuid": "ca0bd1b2-1956-44d1-9681-ab8cd15082c9", "value": "24576:UzDJbhWEJ1CSXNfdjVpDdNYvZRjF2QvutASADdWMxThORBLiFYP70kEaHNYK3r8:UzFw61jzTNYvjF2SuoFxgRW8INae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693911, "uuid": "637be557-db58-4c04-ab40-43acc1af4edf", "value": 1627136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693911, "uuid": "a3a3d82b-ef61-494c-9738-ab723f3dc8cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693911, "uuid": "b8f1a061-5239-4d04-9949-bdc5ca51abda", "value": "1f3d6e212c9c98021962dcef42be629e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69166d04-55eb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638723011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723011, "uuid": "7ba98726-bfc9-4242-92d8-3e815a1cf2a2", "comment": "Malware payload (Mirai)", "value": "38e081fe4be81df7329bb993314ff333", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723011, "uuid": "ff16222c-3487-4b67-ae4b-a238eaba1a54", "comment": "Malware payload (Mirai)", "value": "25ee849716371760f1b2e4585815345a38eaf22654e07340fd6c2dd3bd87113b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723011, "uuid": "8c9d82d9-7bc2-4445-870b-400bf381c545", "comment": "Malware payload (Mirai)", "value": "5487111b00e21e26d38e950e526fd7e3c842fadf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723011, "uuid": "aa6536f8-4a27-4ad5-b3cd-176a80aeef15", "comment": "Malware payload (Mirai)", "value": "d1305bf0cc22769d8e107daed21f7edbc94848b329f57046b2fdf8584873ee8458219ca0748c059fd4f2e1981595369f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723011, "uuid": "71dc503e-4366-4f3e-ac1d-8c4669ef0d9b", "value": "T182C32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723011, "uuid": "03c6ff9c-5330-45d3-b5c7-9bee43e291be", "value": "3072:/YNa/GLBNPoQuphakpiQ9/nYEP/UnSQf/R:6a/ylo9phakp39/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638723011, "uuid": "755883d1-92a7-4f9d-a94f-a276d9a822e7", "value": 126929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638723011, "uuid": "fd946641-1e1a-42e9-8613-324035d3df57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723011, "uuid": "71d363ef-21b3-4427-82a7-b9642537b42a", "value": "38e081fe4be81df7329bb993314ff333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f468b910-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708212, "uuid": "bbc49170-6ed2-466c-a806-2bd70bf3a5b4", "comment": "Malware payload", "value": "7219675687b9ade9beafb53b7a4c8119", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708212, "uuid": "69bfaa92-7e83-4bce-908f-e47031750e13", "comment": "Malware payload", "value": "27276165d1a84ded54ffe7b85870fc5b5836e49f5309fd7e2c23f39b332ab7ef", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708212, "uuid": "4fd6e025-3ef1-4c57-9510-b2c95706777f", "comment": "Malware payload", "value": "63ab8a99fcfb04c37cee13da372d8087deecffb5", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708212, "uuid": "65d30876-af70-4220-a1d9-7accdcd78ba4", "comment": "Malware payload", "value": "7d8e3225b877931ca5e32bfaa5a0bbb8b4bbe11de95670bfb475f0a9b6b35ea5df523c28e6b228527d18d0fef0b6b6c6", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708212, "uuid": "b7d7cbdc-dfe7-4e3a-8be0-9051dccbcce3", "value": "T108C533119AD017C9E594CF2F2F9C5936047FDFCA78A4EDE382E28BF1110FE86A566460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708212, "uuid": "3358fd49-0446-4b75-9b38-401a91a15be2", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQH:G1wwAjzIQOMK2GNKslgus10F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708212, "uuid": "70badfd5-4c3d-4f1f-9766-708390911261", "value": 2686976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708212, "uuid": "98c44bae-1f86-4f9b-b72d-b1772f90cdda", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708212, "uuid": "cdbd936d-f5fe-4817-b171-2182f3c97ba7", "value": "27276165d1a84ded54ffe7b85870fc5b5836e49f5309fd7e2c23f39b332ab7ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32224021-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638693713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693713, "uuid": "3fb7e375-34f8-4afb-9e03-9cb4fe910cf9", "comment": "Malware payload (CoinMiner)", "value": "f5ccac71d5c92b321f4a9bc4922cb4db", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693713, "uuid": "dc82a9f1-6f59-400a-853b-80ef1d578c48", "comment": "Malware payload (CoinMiner)", "value": "2810a9fa32147187f8b2d9af9b68da218b784e00845c2f3ab213dad58d3173a1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693713, "uuid": "bff61d9c-93c1-490c-aae6-bc9ab5e05ff7", "comment": "Malware payload (CoinMiner)", "value": "930c67c6a2ac1b6631269f4728e90cdd0003a881", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693713, "uuid": "ceecad51-940c-4a4c-a6ec-7a0708221917", "comment": "Malware payload (CoinMiner)", "value": "1f02bb58ea82d9a9e1f48650b8ecb298ffa079f045afde4d1f4297861463493f19358d1c174ec1bb031c9e8226af4132", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693713, "uuid": "22b85ca4-1827-491d-b927-b77143a70435", "value": "T13AD2CF20738C9115F9390F3E5AF1935617B5FE617461EF6D7AC0020D9E90B04E6A3E7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693713, "uuid": "77df74be-698f-491b-9f87-219d28ce64be", "value": "768:+MY3RQNHxL/Mft+Xn9wG7FSvdRDW2gYsr90gTuF9NnWLyr:nkyHhaw6WFG6Y0XyF9zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693713, "uuid": "a29a5536-2a96-437c-9287-2c5c2e70b8ae", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693713, "uuid": "34351ad0-360f-496f-bf4a-68098be61ca4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693713, "uuid": "f0cb93cd-29a2-4570-a6b3-0b3750d3eb3f", "value": "f5ccac71d5c92b321f4a9bc4922cb4db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d05366a-55eb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638723071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723071, "uuid": "6ae60ad2-b39f-4815-852e-7f75cd4fbf4a", "comment": "Malware payload (Mirai)", "value": "d68c6e13c305b2426609faf987cb685f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723071, "uuid": "1e9243b3-9bc8-4343-a859-375591cf6996", "comment": "Malware payload (Mirai)", "value": "284b1c653418370cf85d9a3bb4fb4cb003c9675367e6dcc915ff2d2a2daa8ed5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723071, "uuid": "ac60eefc-578a-428b-bed9-34d56ff7007a", "comment": "Malware payload (Mirai)", "value": "c1ee6e36808b5d85b50df66a219e1ea752534798", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723071, "uuid": "a0ebf401-71b9-4339-b124-03f20e848402", "comment": "Malware payload (Mirai)", "value": "2abdd4a7c6bf2409d69aa7c04246f4143e9ba01c67788b439df19c72dec0459bc807ef747aceef3aa71ab28ed741992c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723071, "uuid": "90f93096-20a2-4cad-94ec-ab813968f932", "value": "T13CB36C176692C5FAC08342B92BDBA1618823F67D0B36331773D5BDA43F158CA6E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723071, "uuid": "064728c7-9c22-4413-a1d5-8aa986c955f0", "value": "3072:Ft2nlia9qRBFZm4z1EYfcbJzphawfWJv03CKPCNVOXinYuM8R:gsVm4z6YgVphasCcFPCNVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638723071, "uuid": "c666c695-29b6-4baf-af91-1b17503f8053", "value": 112336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638723071, "uuid": "079add55-e743-4e67-a208-70cf92b252a5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723071, "uuid": "eb32f145-1eec-4a14-ba42-8a190449978c", "value": "d68c6e13c305b2426609faf987cb685f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0616845-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638722674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722674, "uuid": "d457a617-6735-4fb6-aac4-43ead206fc5e", "comment": "Malware payload (AgentTesla)", "value": "b2a291da012a2871fc498bdca34489ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722674, "uuid": "51517e5f-10da-4b93-b08d-8cd4b931dba1", "comment": "Malware payload (AgentTesla)", "value": "294a636d87518147519a4932d4e4c1c2f9f0f85a8d1be15e143c24e162656797", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722674, "uuid": "60ff794c-47ca-4519-9d24-0060b8c9cff3", "comment": "Malware payload (AgentTesla)", "value": "fc1bb5c1b117f85eb7c3a82a2ee2f1469baa7f02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722674, "uuid": "37b397d9-7f53-440b-b3fe-4a09534e2304", "comment": "Malware payload (AgentTesla)", "value": "f5449c4b04692d840276678d002c8664c0473e64f30aa264e6508a3e4bf752b01f752bab631087a3bbcd024059a24178", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722674, "uuid": "a0f20c7c-5a63-4f74-b363-733b3f046324", "value": "T122D4E0336642FCD91F7E2D40A9141C590C68BD7BABAC96A8FEC0059275FA904DF1E9F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722674, "uuid": "64e15a80-0636-4996-ad87-e942b035741e", "value": "12288:TqsesaMDEkMa6HESs611tCWW5ADIaQeLtpKVC:eJs/F6Hpb11/qAoqqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722674, "uuid": "acf79c31-72fa-41df-94bd-98e2877f4853", "value": 646088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722674, "uuid": "441ee3f0-aeeb-4c5a-96a9-d4ef2c5004b6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722674, "uuid": "01a099ae-fdb2-4d4a-8d53-eec8a50f0ae1", "value": "Agreement documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cf286e-5609-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638736123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638736123, "uuid": "67694486-d65d-456e-8b47-272bba241281", "comment": "Malware payload", "value": "92072e1401c170181f26fc193ae6137f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638736123, "uuid": "4eb91252-8a3b-4564-bd42-4fec0e1fd931", "comment": "Malware payload", "value": "29c409e07f6bff407c11023eae2d2bb2a9033e44fbb4a07897a785f5ae1c3d24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638736123, "uuid": "783c2ce5-80ff-4419-8628-7b103d58f4da", "comment": "Malware payload", "value": "bcbeeca2346809882369655c85d9ffb9c2b2aadf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638736123, "uuid": "45f53f40-ffce-4d58-bb9d-2a84b8187530", "comment": "Malware payload", "value": "1996260f1fa8fc61aaeecdcd63071b3bcd984f38c96626a56d1e8f8027c31f5767bfcc56e81c5d3798349cc53f665ee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638736123, "uuid": "76200a7c-ffbb-40d7-8e60-aeeacd84b759", "value": "T17275336AB74CEF1AC7CB39B82961EDE3F1E48368C78C6496D456140BF361922FD19270", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638736123, "uuid": "6a2c2f79-6795-403e-b2a3-0394df0b95fe", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638736123, "uuid": "6af40223-32f8-49b1-9c64-4cc4364ab4c0", "value": "24576:TCKot+O+aTp8PLX2J+MgWAb0HUetmJDhQXDLaqMM7B1JjRY2uY1mkEaHNYK3c3Xh:TC5tgaTCzYHTAgHJmXQ6EBV9wNaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638736123, "uuid": "91ab4945-85ea-47df-bf52-22da48ca2a07", "value": 1659904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638736123, "uuid": "cb7430b1-b25b-4c08-985e-401de62e9b36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638736123, "uuid": "fb05605a-038c-4eaa-be36-8459e5968891", "value": "RaveCrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a537001-559d-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638689458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689458, "uuid": "ab9f726a-0b1e-4d0a-81f4-5e6a7186ba98", "comment": "Malware payload (CryptBot)", "value": "ddb6ad32895e6ee2833eff8a120fcb62", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689458, "uuid": "24f805c0-8bf3-45eb-8af5-df7b8e2ceb1b", "comment": "Malware payload (CryptBot)", "value": "2a2f29ba572a5a3262132cfab7cce1172a9bab932ebbe13bd47664817282197b", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689458, "uuid": "ca4b83f6-5bcf-4864-a27f-6f2366446e4c", "comment": "Malware payload (CryptBot)", "value": "95a1a2baf3aeb03a6fe2b6d450db8b1afcbbc93d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689458, "uuid": "8f6a3e83-962f-4d20-a6e3-ff66fef11d84", "comment": "Malware payload (CryptBot)", "value": "77558d9c0b50a262df4918de744423c88c443d5daacd673ad3be64f8df56901c1b521c0d36c830704d20338f8f014b5d", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689458, "uuid": "b3d59679-989b-4632-a690-b90f2af6cc5f", "value": "T17A84DF0176C0C032D05269718A10CBF15EBAB8755B2669CBBFC94EBE5F246D2DB3634E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689458, "uuid": "34553280-1acc-4ee3-9cb8-4f0220a1b178", "value": "c5abd64536bf33cf9d17453c6dc09550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689458, "uuid": "8342a0e0-46d4-44d4-894a-75e350bef0cc", "value": "6144:BkTDdQ1sb5zkvTfUPD8P/dW2mRKHcUqQQlkL3blyyk0LM:BaBQs5yTMPDC/dDiJtQ0o34y1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638689458, "uuid": "57bc3b97-5b61-4a03-9ec9-8008f7beaa13", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638689458, "uuid": "802c73f1-072e-48cb-b9ba-24bbfdaedd06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689458, "uuid": "97b4c498-c865-4cc5-814d-84e52746090a", "value": "ddb6ad32895e6ee2833eff8a120fcb62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ed553e-5626-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638748258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748258, "uuid": "3cbcea1d-9835-4062-b75a-147b080a95c4", "comment": "Malware payload", "value": "912b76afcd1ad2e282eb051ba4b6bd26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748258, "uuid": "ac6b2621-ed0c-4aa6-b0f9-aa84c00c618b", "comment": "Malware payload", "value": "2d742df23cc0f302096cf046fafd5a1925ba089da5478cd0736863cb8020056f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748258, "uuid": "3f367ccd-cb26-4934-86a5-d0fc5b679293", "comment": "Malware payload", "value": "9d08ab919ac142049f4d0182faf0fd3f832c1145", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748258, "uuid": "493fcaff-be8c-4d0d-a431-c86c8b08048f", "comment": "Malware payload", "value": "ccc3e67d3195adccd646921310dd57cbe4b104af679c51cf5e92c38f03f1b22e3926423e5a5a37127dc235dfd0eee4ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748258, "uuid": "184c27ba-5f74-47e8-8172-48001ec1b2d4", "value": "T157E5BF32A3928477C27237F88D1B57A5543ABD312A24B9BA2BF52F4CDF311413B25297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748258, "uuid": "09eab89d-878e-4380-b7d9-152110a54cd2", "value": "d7ffb787b8c3479851de64d8fdb945a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748258, "uuid": "b7d90998-5271-464e-b968-bd535d4bcf4b", "value": "24576:kKKVQqz7V8RLLbx/C0RmcAnXOqZ7GReEh4xRsLCAs59FfhJehQHuk/5Z/VGmMMnx:ntRL3g0OOqtGBZlor5pHMMnWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748258, "uuid": "8598d5be-d403-4e74-a7a5-dae15d7ab854", "value": 3242496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748258, "uuid": "18e8939a-9ca7-431d-9929-e359561bbee5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748258, "uuid": "920b642c-7081-4e07-ad83-51eda2151052", "value": "912b76afcd1ad2e282eb051ba4b6bd26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e924888-55d6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638713947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638713947, "uuid": "1cf3ef1e-dbc4-4ae7-bf5a-8096c0943a53", "comment": "Malware payload", "value": "cc8c3b579e4808a44757f3aa42b37581", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638713947, "uuid": "d776e7a4-96b5-4e05-8fa1-32dc590353f5", "comment": "Malware payload", "value": "2d7445a347b214db47eddaff7ec1adcd80e38d97571333d4c2631463dc408116", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638713947, "uuid": "76a049c9-f922-4562-896b-610ed71b3cdb", "comment": "Malware payload", "value": "8d96a5784afb0e3488d992f7e85e38e1477d5573", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638713947, "uuid": "89072708-3d97-43f1-a712-326623b24f0a", "comment": "Malware payload", "value": "03501a58208021d95d33512933959a06726447a1c8537eb05cd6107da3bd886df6a92cc260bacd0df60b87e2f93b1b66", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638713947, "uuid": "cd03fa04-8b1b-4de7-b54f-64decba95994", "value": "T1C7244A00F561D139FDE611FBCAFB49BC49AC5B00134824DBC3C968A5E7568E93932A6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638713947, "uuid": "e5d1762a-8ec6-40c8-aeed-1516e122abeb", "value": "6144:m09MHnGC7LRzxzVZYsuOa31UvQV8yMcSWUMuEpJ:me+n9DJGtOal5V8yMcztuEpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638713947, "uuid": "d2baf6de-6bc0-4e49-8d87-414ce8c476fd", "value": 222467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638713947, "uuid": "56025dbf-ca1d-4dd9-b22f-8b58797eee6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638713947, "uuid": "1b2917ed-e5db-414b-ab0b-fa80223db538", "value": "emotet_exe_e5_2d7445a347b214db47eddaff7ec1adcd80e38d97571333d4c2631463dc408116_2021-12-05__141902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5a9bb8-55da-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638715877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638715877, "uuid": "7062f88b-ec9b-4363-8e7b-558c8c050360", "comment": "Malware payload", "value": "4fc6e9d3ae631214f05309afa846c485", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638715877, "uuid": "7a1a9563-6412-42ca-8584-ca2ee8428827", "comment": "Malware payload", "value": "2e3366a85b31ffe0329cf8d0bf236a37eb65823b3961352ab6ab36bbab6a5532", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638715877, "uuid": "16113881-075e-4774-839e-7690ab7d2693", "comment": "Malware payload", "value": "a338710e3329fe0d50df271ac815d9bfdf407a06", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638715877, "uuid": "52a79e9c-3443-4831-91da-0eacd11cdf42", "comment": "Malware payload", "value": "3da3cbf84b77ecb07954b0041ed01a6f305e9b4d93f3d01fff59c2445c247aaa7e530af6c27f4a5c76bbe8660ea2f05c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638715877, "uuid": "420a70eb-7362-4eaf-9fa9-d9e858dee537", "value": "T122D423A1BB9A13DB9C3878F49964B5E4639263DED70D09B31D91FF21BCA873815810E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638715877, "uuid": "46169000-6d33-46c9-903f-1d5c6fa056ef", "value": "12288:Ay5C6Sm6mJu5T6gQ8JzAQnVtTXUmzjv2doDvPTtTX64IxrLz:D5BSm6gi6gQSU+FXUmHaCvPBj64Ix7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638715877, "uuid": "b1398a42-c75a-4a3b-bb99-85a23c1415ea", "value": 609859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638715877, "uuid": "db687f40-5aba-42c7-944f-42bf746e9ae8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638715877, "uuid": "415f0b4d-0ac5-4c98-8a7a-69511d309e80", "value": "4fc6e9d3ae631214f05309afa846c485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7870695-55e8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638721961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721961, "uuid": "3c1aec54-3312-42b4-91c9-093cd58ed0c1", "comment": "Malware payload (Mirai)", "value": "0e5d4a9dc9607eefa95520dada4106d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721961, "uuid": "d1f4fa8e-bf75-48cf-8ff6-98cbf6a72f6f", "comment": "Malware payload (Mirai)", "value": "2e56acef95d1d35b99ff308ba3d148a858f5613676c0721550bb86cbce798c7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721961, "uuid": "a5843d49-52c4-4413-b383-151ecc94bfc4", "comment": "Malware payload (Mirai)", "value": "979f07efbc4e52d978529b4d8e68e62c5ad31abf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721961, "uuid": "ed2466ea-1c44-4618-a7fd-7ffe5bb9d77e", "comment": "Malware payload (Mirai)", "value": "720805bee92ff3eb68bbbcbfb4b09b5fbd716a02e5d29581447c070797bd259db8ced0ed149747e81f0fddd70d9c1f52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721961, "uuid": "87aafc5c-922f-459c-aa25-aeda7cd76588", "value": "T199632B86F9C741F6D91B493490EBF23FDA31E57A80309BADEF8A5F36D523A006112259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721961, "uuid": "14a90d74-c98d-4b34-93e3-adbb77e91ecb", "value": "1536:w9HuGtCI3+9pA2VW3RvxwXRzXMgU3uuYDHskw72uf:w91h32pNwlxwB7MV33AMl77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721961, "uuid": "0280b6e6-fb6f-4509-8bf4-b0eabbc7e09c", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721961, "uuid": "cb15e7e5-2b78-4eaa-bddb-e18a41de5d43", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721961, "uuid": "8011a7db-4d00-4aad-aa56-3cfd65ba391c", "value": "0e5d4a9dc9607eefa95520dada4106d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278fe5e9-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638722471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722471, "uuid": "0ea5d54b-1b26-44d8-b0d9-595b03bf6127", "comment": "Malware payload (Formbook)", "value": "57ffdd50836a57d9abf7aa6fad628f62", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722471, "uuid": "e45f6543-76d7-449d-bda7-fcd30cd58c0d", "comment": "Malware payload (Formbook)", "value": "2fb3595d4c398a90cce567f83d9f214bb057a9ed67ec0251826d9698103fad1e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722471, "uuid": "d35326ee-45d5-4a18-8b05-0a1de8249214", "comment": "Malware payload (Formbook)", "value": "0ef225ca7d683dc59f06020e8feb520ee3dcff4c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722471, "uuid": "3a32a13b-25a9-419d-8a0d-2e5a1d068768", "comment": "Malware payload (Formbook)", "value": "512f69b51cba9bc1d623a964f20eec226016bb4f50153d5f8f1063e52292cc20769e3f7c0e8ea7f2ab7d3714021bfbc9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722471, "uuid": "cb92382f-8184-4b46-aa8d-9aa051c90141", "value": "T1DA34126277820AA8DD8B44F59FB34719DFF7FD716A2A043720843566F73B39106A2722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722471, "uuid": "ddcd9187-7919-46fe-b4a5-7cd112ec2234", "value": "6144:YU22IMH2PY3A2SokwDZykH9bj3eez5+Flm:m239PhkwDZ1d2ezUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722471, "uuid": "be962952-3e72-42cc-a5fa-fd0eaa0de1c1", "value": 234568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722471, "uuid": "4132da95-b7c8-49ba-b5cd-6c4481a78124", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722471, "uuid": "bbdc5f71-5295-479f-89c5-b89ed23aa8e4", "value": "Pharmaceutals Order egypt supplies.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db161f12-5575-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638672521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672521, "uuid": "3628ba9d-3280-47e6-9277-ed51d829e12c", "comment": "Malware payload (GuLoader)", "value": "4e965599c2c0119baa3a2298d43e4d2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672521, "uuid": "a6df3680-7a1e-47c7-85fc-8dba89ec3aae", "comment": "Malware payload (GuLoader)", "value": "2fcd3f1ea4b954477eac45ea5c9174cf4a3195137d33504d7532715da3477e9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672521, "uuid": "e1c25ee1-9bde-4261-87b5-602f24e9282f", "comment": "Malware payload (GuLoader)", "value": "82e144a19ba2951f3c476505f9f7fd4477768dc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672521, "uuid": "1d26c2bc-5545-426a-a1cb-f9677c073c8f", "comment": "Malware payload (GuLoader)", "value": "bff158d41a3926b56baebe06799fe6f03a7772f171916a75512c79ea9be8bba34c832d82ef2b7b4b68483e108efe1fd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672521, "uuid": "06cf7fe1-c00a-4126-8192-15f82f62c193", "value": "T100D3E0109BB1C473E5B102B1493A57BBBFBBE41261A04FC703706E8D7DB2A51CA2E759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672521, "uuid": "ea8f521d-1e2f-450c-84be-727da4faa2d6", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672521, "uuid": "1bfff36e-7812-4131-9077-05da860295e9", "value": "3072:gbG7N2kDTHUpou4ubYk+Scdk1QcCPvYScUE2fOpUzh1KS:gbE/HUjYg1Qcy3HOpUt1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638672521, "uuid": "4060439b-9e0a-4dcc-8487-04be69e9bb3a", "value": 131488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638672521, "uuid": "2b2cede9-4b6c-4d18-a42f-8c8d76892a97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672521, "uuid": "23ad946c-9096-4270-923a-08856eace28b", "value": "4e965599c2c0119baa3a2298d43e4d2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14dea6f7-55ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638723728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723728, "uuid": "75963823-a1ae-4854-b21a-3972fd89a7ec", "comment": "Malware payload (RedLineStealer)", "value": "3ad87fbcb98cc43b59cbbe063ea69a20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723728, "uuid": "19ec88d3-bf79-4c8a-bd55-2a3f1b9c964e", "comment": "Malware payload (RedLineStealer)", "value": "3019bf7aad3f4838d64c6a648b24ea0e6f8a652ba2993e5b5b2b4e9527b0968d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723728, "uuid": "af8a27fe-7172-4b7b-8239-7bad922eae2d", "comment": "Malware payload (RedLineStealer)", "value": "7bf23b06e609bdf213e56b1ee820eb5d326f9d87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723728, "uuid": "90a902bd-70cc-4c95-9511-ac01a674be78", "comment": "Malware payload (RedLineStealer)", "value": "600409e52af0d692eac7e4f5026e9b92057134ed37e4f4137e2d54a8e4b47dc046f7823a4d689f703be3dcdd43c7714d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723728, "uuid": "66cfad4c-9c6c-4e5b-837e-b9bc4876385e", "value": "T195E3E8027B009F06C9AC353641FF6D3863B1F6CB1731890EAF45B76B1DD626ADA8D246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723728, "uuid": "01ddd380-024d-47c5-8bf6-254e849928ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723728, "uuid": "d4dd6d50-2a31-4d8f-ba3d-4bd1671d45bc", "value": "3072:SH86u9ZbAfkCYMayDPvlrEZ1Q6Qok9xR0Ee:SebAcMjlw1Q4kN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638723728, "uuid": "770e91a7-e9aa-4018-9f92-f890669db931", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638723728, "uuid": "1f4e1c6c-f4ca-48cc-aaae-50f536e3b487", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723728, "uuid": "6a64c96e-49d3-4af5-b1e8-355ea0ace4fa", "value": "3ad87fbcb98cc43b59cbbe063ea69a20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b388dd39-5618-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638742463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742463, "uuid": "2be81c0a-697c-4bdc-b93a-64679c9e7068", "comment": "Malware payload", "value": "5a4e845d9d37a1bc53de4e95d23637cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742463, "uuid": "b5858fe0-4b85-444f-8638-c74629be0b0d", "comment": "Malware payload", "value": "30c40f127100a3d96bdb69ce93424228af279691046277adca4985c7a6b64468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742463, "uuid": "c2a9c937-7ffd-4810-86bf-29a036a2b12f", "comment": "Malware payload", "value": "e7b6f767c6bbb33635df403d38bb6e5ed4321458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742463, "uuid": "b2bdf912-390b-40c1-a920-fb68792af07d", "comment": "Malware payload", "value": "6ffbd153d5e0c0713fe636fc4ebc0ce7506250c406a6f9fda880c57f5ed2590252be9dcc0e78510fa95a6356ee551b01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742463, "uuid": "ba4b8c33-7551-4748-959f-4ae204c069c4", "value": "T1697533FB37975AEBC24FC6784B722D82E39BD52437C0149E7028A0A9A23D146DB25717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742463, "uuid": "b98da9c4-5668-4a2b-9578-c7f99bfab207", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742463, "uuid": "09081c8d-a34e-4f8f-948c-a41c682012d8", "value": "49152:m4AxE8+I8S0sibCzY6wIIWq83CAoj+Ljdxiw5Na0+M12:6E8f8S3ibaOyLRxiiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638742463, "uuid": "c20650d2-f1f6-4c6e-acb2-b50cb3346ca0", "value": 1662464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638742463, "uuid": "0ea6adae-a608-4fab-a667-5dfa64b6e736", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742463, "uuid": "de39810e-9a6c-4f7e-a3aa-a42f09acd57a", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27aa3b1-5584-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638678922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678922, "uuid": "7ada2c6d-3e5a-4ef8-8095-0b9e94079052", "comment": "Malware payload", "value": "da42182a80f5bf9ec7be6d48bdb30f90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678922, "uuid": "cbc26fb2-6e6e-4839-8efc-7a0f43c379a6", "comment": "Malware payload", "value": "31923ed644ac377d3c29920a4809854c1a77d9093a4540cb5107d78084da030e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678922, "uuid": "57c3c7fd-b9d9-4e9e-a075-34d20061fd6e", "comment": "Malware payload", "value": "f5ac15b215f12954a7ceee30d5d15f112edc6458", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678922, "uuid": "05753389-dd72-46e7-a58c-87e0a90e9b4f", "comment": "Malware payload", "value": "2348a8478b3fc9b23a706e47e1da9167e5c325a28a2b5c54ff1bb1195219eaf8a1f60fb7cc9bf6258c157572f7b7c239", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678922, "uuid": "f27804ee-5415-4902-a74d-af797b45e49d", "value": "T140E33A05D7408B57C1E2277AEBCF824933339B54A7D733095A38ABF43BC27A95E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678922, "uuid": "6ff09c43-41a0-435f-a283-2b9ff4f68efd", "value": "3072:8tB+B7aEuNwWPaEAseCnrW7a8oXV7RDF+mLwfCDQSAW:WB+B7juCWPaUDnrW7a8oXV7RsmLwfCE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638678922, "uuid": "e0d41151-80f1-435e-b492-b8a3c0c20449", "value": 150337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638678922, "uuid": "9c5e163f-2056-4186-ab67-0ac514dc786b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678922, "uuid": "a478fbfa-8b4a-427e-8905-dd2c9befa37f", "value": "da42182a80f5bf9ec7be6d48bdb30f90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221cd24c-55a4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638692397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692397, "uuid": "c4815d5e-1e72-48b7-8491-a46a160cfcd2", "comment": "Malware payload", "value": "0e5bd98bcf1ef9bef39f19f41e1aabfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692397, "uuid": "8ff14182-0999-4560-8994-e2727cea6e22", "comment": "Malware payload", "value": "31f84b5a677f3be143c04055bf0d6dc79433332d98e7fd89c68429c2192ac385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692397, "uuid": "3a985e31-a283-422e-a517-8e071fae4c90", "comment": "Malware payload", "value": "61bf8f0da074f12e7a37d9f2900eff382af939f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692397, "uuid": "a52f1d81-50f5-4216-ad03-28f3b3a1c740", "comment": "Malware payload", "value": "2ef24fdda218bdc76e5b3c1568046ab46a3b3c298d092d2df335b1ae558910f3cc6068c0d5a644cb9a0b22851fec4020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692397, "uuid": "895eb6b6-54a7-445c-b39b-353ce0b37962", "value": "T12C55EC9F1A18267BB25286FBC83F0635F1F2E725533A818B151C4C42D6B27967EAF1C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692397, "uuid": "f6fc05bc-b576-4ff5-afcd-845d1660b0f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692397, "uuid": "c2b77d53-0fab-40af-b2a9-289211e7dda7", "value": "12288:jjZRYoIKfOn9ThhqMm3lMx4D4Qmq0Sg3g1MLZhTtqNd/hZRkCv9/6XI8PjM7FBdi:/ZRYTV99NVcdfac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638692397, "uuid": "5e5148c0-ec2f-406a-b4cb-f05d3410d25b", "value": 1312768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638692397, "uuid": "1f904263-8cfc-4196-ae5f-1322e9c03168", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692397, "uuid": "5c874768-9827-4263-889f-71978abdccbb", "value": "0e5bd98bcf1ef9bef39f19f41e1aabfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db33c6a0-560c-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638737375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737375, "uuid": "de0d97c0-e6ad-4ab2-9e70-8c4a4b85aed3", "comment": "Malware payload", "value": "4ba8a6af59b167aa45b1c9aae4a8f682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737375, "uuid": "0dc81f67-d8eb-4874-85d0-d69fdc8e2a60", "comment": "Malware payload", "value": "33b18a85c6b49af6f5025ada7db397fad10b6e1d0c25d98b9ac557c3024a2ac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737375, "uuid": "b32a477a-4d04-4ac7-a893-2176fa696dbc", "comment": "Malware payload", "value": "414842ce90f8968f397a731e447a4559155f4e6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737375, "uuid": "5a915671-3e6a-4940-8be5-7cebba7b77bf", "comment": "Malware payload", "value": "e895e75e8d7f5a41d2a1410821f6d24307ace63009083aadf663af7c2a144b2f53d0de120e234b8e7733f80a58fe4d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737375, "uuid": "65b87a43-5a9c-4891-b27d-cac2b5e12f82", "value": "T1BBB63312789701BEDD731A79212BA271873835300FA85A7FE7F08DDC5E3A5C0AA65793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737375, "uuid": "c67b80eb-06dc-40e2-b1f0-fca363db4a28", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737375, "uuid": "faabe8e4-d77e-40b8-b313-71f46766366b", "value": "196608:qeclZZigEom5TmcP11Ts5Sp1sUHKB3zf1WkSJYVjiQYEyMZZsK:7zam5Xtdskp1gumRvZZsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638737375, "uuid": "7e64bdc1-62e3-48b2-a432-934c2aaed986", "value": 10558770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638737375, "uuid": "65695212-b7bb-4d1b-b89b-92761a00349c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737375, "uuid": "39441a1d-afe6-4f99-baa2-4d3125ad4d42", "value": "ProtonVPNcrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe29bca-5568-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638666704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666704, "uuid": "59c441fa-cd01-4c08-8667-b01dcfdd624c", "comment": "Malware payload (RedLineStealer)", "value": "47db0ded618502977919fdfd7444c808", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666704, "uuid": "d0c2c153-624f-42d8-8d39-1caf51af8b25", "comment": "Malware payload (RedLineStealer)", "value": "3426d12d872333a290c333ef0cff53ccd94966fe5826106ebc3d819cf078698b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666704, "uuid": "0e15edd0-03de-48da-987e-ee34d0298ebf", "comment": "Malware payload (RedLineStealer)", "value": "37c0272392fc682990ed87b4f8214959a0f75c6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666704, "uuid": "0eec0828-d70b-43f6-9255-5c40213bc582", "comment": "Malware payload (RedLineStealer)", "value": "9de2da3499a5707348452e6a809b6b699f6826bb468446279aea946fdab20570c8806e10b7e73840e462b20d56880b70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666704, "uuid": "5ac55488-5eef-4168-8fe8-44209998025a", "value": "T19C25992BEECE86DCEB42077945F3BB108BA664D94F3B07D89314A5F04B8D1751B01AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666704, "uuid": "3580b570-e384-4e06-907f-923af8a30b3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666704, "uuid": "ff2f2d85-0f0a-4999-aea2-ffa606210709", "value": "12288:4QpUCQfSdbhA0leo+4Es9396IIfM33FGCOFsUuFNBy:4QSSvvUo3JvUbsDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638666704, "uuid": "cd114fba-4c1e-4b43-aa94-519d3bd4fcce", "value": 986008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638666704, "uuid": "b24a34b4-e131-487f-8e20-b955196313c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666704, "uuid": "d392ffe6-5a33-4b3d-80ac-c642e644f0c5", "value": "47db0ded618502977919fdfd7444c808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cc2ac2-5626-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638748236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748236, "uuid": "bad8e08d-6d2b-463f-ab86-02f7027a080b", "comment": "Malware payload (RedLineStealer)", "value": "a8f4e8e1be09c21778a18f411fa2e8fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748236, "uuid": "7fbb1902-5516-4b0a-bf5e-e3c529502221", "comment": "Malware payload (RedLineStealer)", "value": "34271ecbcc47ad9170526f4655a0a38295f230cebdd788c77c2f46d23847cd2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748236, "uuid": "2d8e0d0a-0ea6-4bf6-948c-8bcd41308e9f", "comment": "Malware payload (RedLineStealer)", "value": "36d27f55954c7365d887ea7da7b44ec57500eb9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748236, "uuid": "209aff97-2d45-454b-b698-3e4e8f5faa9b", "comment": "Malware payload (RedLineStealer)", "value": "45569271054c9075541a0839644ee0402e5d99c923530a9e184e22b82fe5b95738f843548df1669c1fc800435e5479f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748236, "uuid": "0baa0aa9-eb7c-4c2b-91f7-95dc7df60299", "value": "T120243B2C6388DB31E7EC4575C9F10104B3F6D99BD24BEB2E99C075E93992B85FA01B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748236, "uuid": "048e304b-97cd-4796-8c88-e62484970364", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748236, "uuid": "fbe5ae1e-dad9-4728-b7ab-f7f0c9444343", "value": "3072:bufxvhn05eO8/navoLxKWxRE4hBprTA+Esmov8f5g7r5MtokdmLzo:bufxpo67ei7Q+E/12A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748236, "uuid": "5d90fbf2-cf28-4e69-960c-645a794a039c", "value": 222936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748236, "uuid": "d258122a-76f4-40ad-b016-2858346000da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748236, "uuid": "db23d861-9eaf-4fd1-9088-e3d4458cf822", "value": "a8f4e8e1be09c21778a18f411fa2e8fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b02778-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638722444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722444, "uuid": "2ae60785-5824-40f5-ac9e-53d6343b73fc", "comment": "Malware payload (RedLineStealer)", "value": "402577e230849f875d8e0aa2a82c70d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722444, "uuid": "58c641a1-2d7a-4e1c-ab35-cfebf30f8cc7", "comment": "Malware payload (RedLineStealer)", "value": "348fb27248310d8a6984bdb66796cf2cbc8871adc4ade19a9b3d8324cd2a2f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722444, "uuid": "f3d11665-3794-4dbc-88dc-e6bc99677f84", "comment": "Malware payload (RedLineStealer)", "value": "47ae78b445c1da9b8192eac263a19eacce64b39e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722444, "uuid": "20e6b2ed-9267-4008-a979-6dd63853fead", "comment": "Malware payload (RedLineStealer)", "value": "42bbd2726348a3cf0748403427453a96dee671f14bd3a95adf66de3d2a69d13b8685ea68b24e4f5a50a2d6b98414b743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722444, "uuid": "702f649c-05a2-4445-ae82-4098dc3a2164", "value": "T187842428687FC05944E3EEA62DDCA8FBD99A95E3640C743301B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722444, "uuid": "970faba6-220f-498d-83e0-7963ab08bde9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722444, "uuid": "4102aa26-4d1c-4a7d-a975-80c805619bac", "value": "12288:2E7ip0pr6RVgh6w0+ryDkjHdX4QnAQRu:fin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722444, "uuid": "b1af1c34-aa3b-49d3-bea5-04d73cad28ed", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722444, "uuid": "de7f3c77-265f-4119-8cdb-dcbe05ba280a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722444, "uuid": "b4ac443b-073a-4147-a069-e38c90080b69", "value": "402577e230849f875d8e0aa2a82c70d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57c4779-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708214, "uuid": "88dcb935-be56-4961-a502-3fb4dfad88e6", "comment": "Malware payload", "value": "f6c87feba3bca32c3fc8d00233fcbffc", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708214, "uuid": "9576139e-63c2-41c7-b4cb-6007d55f4a78", "comment": "Malware payload", "value": "35c380a957fd4f3126391a92e9d9918916d6488c79d94481930a4bfbbed7fe54", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708214, "uuid": "6f0c6e66-aef6-4bd2-af70-e9c681bd39ca", "comment": "Malware payload", "value": "596193a9b37202d03c5304af30cf39c1fcc38207", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708214, "uuid": "9cbcd271-ea00-4336-be99-9db1dd23dd24", "comment": "Malware payload", "value": "66bb9d0b85a6f8c1979947aca93ac524d752e9dd6332e96efeaeff65764459f2a8e3973b7a899f72feb02433c28fb3d5", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708214, "uuid": "313b00fd-d358-4384-b606-0fbbd5da833c", "value": "T1DCD533109AD116C9F598CE2F2FDC9936143FEFCA78A4ADD792928BF1100FF85A562470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708214, "uuid": "5eec6e7f-ec08-407f-b3ee-94c039dc52dd", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvU:G1wwAjzIQOMK2GNKslgus10u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708214, "uuid": "54ae0c01-e732-4d86-a9ca-0db6ce504490", "value": 2789376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708214, "uuid": "cf8ece71-cf2b-44f1-8d1a-fd8a965ba27e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708214, "uuid": "c0721ce3-a189-416d-a2d1-3cebecbf2c5a", "value": "35c380a957fd4f3126391a92e9d9918916d6488c79d94481930a4bfbbed7fe54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfb4876-55d7-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638714291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714291, "uuid": "72e38ef9-a298-42ab-9650-cc8d6be972ca", "comment": "Malware payload (CryptBot)", "value": "c18b04da3b11ba55234b903ff05bc050", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714291, "uuid": "eabf7c10-9a3e-4035-861e-14e8da79801f", "comment": "Malware payload (CryptBot)", "value": "376370566ccbac9ef740440bfa8093d84db2e69b06836e062e97f6ebf314256d", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714291, "uuid": "dffae4b7-f21c-4d8c-8577-b1667ccd2b24", "comment": "Malware payload (CryptBot)", "value": "9ce14dfe83969462cd558f2953ae81d1b75c55f1", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714291, "uuid": "fd668ab4-09d8-45c3-8125-6faef92a28bc", "comment": "Malware payload (CryptBot)", "value": "e1912e58b380496b8bde8eac9a219544e242bcec10d995f5acc99355c9f5c17240e1e5cf977afc620cbfe2c2635ab4cc", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714291, "uuid": "27317e17-b376-4439-a852-1a0072e6bca1", "value": "T1C384DF1076C1C033D09225768D21C7F15EBAB4755A265ACFBBC84EBA5F603E2E73631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714291, "uuid": "eb5e43d1-3fae-43c8-aeed-820ab5f15530", "value": "a65482a1f9e06ba3a44a5530ea74c096", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714291, "uuid": "ff7baa45-1d7e-4e27-8ffa-178d64834bde", "value": "6144:lx6BRdxOdTrGCD5HSh5Lkwd/mEfsnY5lV+ArIhEL9ei:lwB/xCTqCFSh5LP/VlgArIqLUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638714291, "uuid": "c447c4a8-e033-43a7-9f26-9d86cc99f15a", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638714291, "uuid": "9e54ecd4-e327-4776-81a6-282e79777d2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714291, "uuid": "1b3828c1-031d-40ca-89f3-cb3d5de52edc", "value": "SecuriteInfo.com.W32.AIDetect.malware2.31704.17861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebd6059-559c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638689117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689117, "uuid": "4686e1ba-b35c-44c0-a901-259a09d11906", "comment": "Malware payload (Vjw0rm)", "value": "c15a7e48753b74413ffd8c4bedebf689", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689117, "uuid": "893afaf7-8ba2-4562-a04a-b3af4f369b91", "comment": "Malware payload (Vjw0rm)", "value": "37dea53db80a227936238a3e43a474a48114b3f209cf2d44606735a5cfecf727", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689117, "uuid": "0119974e-8934-41cb-b70a-a65b18e5d633", "comment": "Malware payload (Vjw0rm)", "value": "0673e275a19a4f35b09c24941cf9baaae57e3b36", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689117, "uuid": "e9459d81-2b09-48bd-bde9-704ff40480a3", "comment": "Malware payload (Vjw0rm)", "value": "992186e59dab65e72b438ea6349fb421ba99664f91be5b65cfee6e9eff4813644ed43946aec8d11daadaa25f500e723c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689117, "uuid": "0f4eb9fa-aa6a-4771-8df3-3cf9a8f617c6", "value": "T18D54398C6980A2DBCB17A0247B7F28C713F0570BA40157C8F6BE76294B6277CE7D9568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689117, "uuid": "1382a5f5-17c7-4c01-9b17-7ffdf2161ee5", "value": "3072:kTtg44LgM76jFV/9GpC3Wk0vmxSVe0vq9iiRu8MdCCdX+vmaHZTIe2S64xO:kTtxMqt9jxiDv5widl475ke2S64xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638689117, "uuid": "be68a2d9-2e24-4aad-9595-0363843ea175", "value": 278723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638689117, "uuid": "a4f33b18-11e3-48a7-9419-a9f0cbb33226", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689117, "uuid": "19fce698-13ea-41d7-9a8e-47c97ee34230", "value": "Signed agreement documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b9479d-5597-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638687090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687090, "uuid": "b018417d-8725-4fa8-8158-50fe7db5a3f7", "comment": "Malware payload (RedLineStealer)", "value": "54a2b455a1c66a105a4c47f4780e4fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687090, "uuid": "c0f25499-b8ca-44b5-a7ea-c9a334bc5b37", "comment": "Malware payload (RedLineStealer)", "value": "38dbfe3e95b603dcde4eb8b64015bf2548dda4f56611d873a12d94c5dd4af2b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687090, "uuid": "4b8689fe-d8be-47fa-8d54-20c32830ee3f", "comment": "Malware payload (RedLineStealer)", "value": "d737551855b9d38fa68af5f1eac005b31de13848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687090, "uuid": "08a380a9-0cf5-4309-9b91-8582e11dfd43", "comment": "Malware payload (RedLineStealer)", "value": "638f25f3f72e747cba2fe9736f5278cdc02bbdc27631a6024e89487c23a45d33b09fe85a8114659acbe3eaf079191e1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687090, "uuid": "6137c5e2-b8e7-43d4-add6-5467f2e81dbc", "value": "T124B4229C766076DFC857D472DAA82CA8EB6534BB831F4203906715EDAE4D897CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687090, "uuid": "f6288954-6503-413a-b7b9-021dd1ab9eb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687090, "uuid": "fbfa5dfe-0e4c-46b7-a691-2782f5565d42", "value": "12288:CHgzUerUP1AbjBcovkbV8XRVwfa2ibi3zdeZNZa6Ktj3NX283/gjXzAJ38Kezp2n:CH4DIPKlI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638687090, "uuid": "923b986c-737f-4573-bfdf-e1b2793f80c6", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638687090, "uuid": "b89e3244-6ad3-41ee-b674-f49a08a24d0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687090, "uuid": "01948adc-3d75-416d-b049-9e9ea663a29c", "value": "38dbfe3e95b603dcde4eb8b64015bf2548dda4f56611d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b53650-5585-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638679028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679028, "uuid": "8ea160d7-2d61-4f3a-a8d4-ddb2ab2ecaf3", "comment": "Malware payload", "value": "21d0d18a72c04047ef5eada428f465a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679028, "uuid": "7cfa01e2-63d8-47d7-b1fa-5b1deb84ec3a", "comment": "Malware payload", "value": "3904b8e7dc4721c84e5146821a9c3d419010a3d69640d954f51d7a3651662757", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679028, "uuid": "f68f89d6-899e-41f8-89f9-d807dbb827f7", "comment": "Malware payload", "value": "dbf6429ab640783af55d92468cc3ed5b302eecfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679028, "uuid": "ea07d6f9-d44f-464f-935f-3750d61f184c", "comment": "Malware payload", "value": "b9ce8e94b455e4686edebd17125fe21862637011c69741f832fac8ac33889710412493cf0d2ef693ae13c9df35d06c0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679028, "uuid": "57552812-aa66-48fb-a66c-3553ce02f098", "value": "T183E34905DB408B57C1E2277AEBDB424933339B54A7E733059638ABF43FC2B995E22116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679028, "uuid": "75960b38-60be-45fd-bbfb-1b0b70c20b43", "value": "3072:8tB+B7aEuNwWPaEAseCnrW7nI8txVRDF+mLwfCDQSAW:WB+B7juCWPaUDnrW7nI8txVRsmLwfCE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638679028, "uuid": "10a8aace-a1d8-4466-8654-ca832c8760db", "value": 150337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638679028, "uuid": "d84c6879-9710-4c1f-825d-a5e9a7b9b476", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679028, "uuid": "c30ce194-42d6-4237-8f1f-7b9015fadf3f", "value": "21d0d18a72c04047ef5eada428f465a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656dc7bc-557c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638675330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638675330, "uuid": "0b9c06c6-3cd6-4c07-9850-2cc5d00e3b7b", "comment": "Malware payload (RedLineStealer)", "value": "ee1d2e8320a37c4a55dd13725269b942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638675330, "uuid": "0ea9fba5-b149-44fd-abd3-71cec4710dbd", "comment": "Malware payload (RedLineStealer)", "value": "3919e3d794ea37d6730ccb6c4dd94ead431e99bbb7ad2408e4720cd5b5f4d7b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638675330, "uuid": "c7358d93-c2ec-4d37-8766-188b4fc8356e", "comment": "Malware payload (RedLineStealer)", "value": "b603a5145b07f8925fd442949d0ec910fd837960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638675330, "uuid": "69dd17cc-9aea-4189-9144-2d93c2c4430b", "comment": "Malware payload (RedLineStealer)", "value": "8fd751a21532b152518d21ce6bb5139498255ea77060f8d1924d98c34ff7f08487897072896aedc614caac41947c9287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638675330, "uuid": "c329989a-5f82-4c08-8d84-543ab9a56367", "value": "T105549D1133E0C032D49729764525CBB58EBAB4312A666ACFFBD81EB89F247D1973530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638675330, "uuid": "bf5579e9-bbdb-4989-bbcc-963731866576", "value": "ace494ecc2c2c2c7ecf836ae6aa78574", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638675330, "uuid": "fa91f06b-5bea-4c6a-abd9-41f210ca24bd", "value": "3072:q+QaoPP224bm7osYlx/JjxI3vJiNYeigin0Nt6bE5OUNog3tzS1qC5KL:q9PUIo9JjxImDqBbEdNP348", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638675330, "uuid": "32b4b718-7562-4ba9-b900-0535baaba339", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638675330, "uuid": "9115df95-4e63-45f4-8444-d036abff60a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638675330, "uuid": "e47ce174-1901-48d8-8059-d6475661c7eb", "value": "ee1d2e8320a37c4a55dd13725269b942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3cdf29-5604-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638733862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638733862, "uuid": "30020204-2a40-409a-8b52-a431c0e8ac8b", "comment": "Malware payload", "value": "a0d49918e31227a992639846dba48db4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638733862, "uuid": "e3223bff-11e0-4c70-9f34-81352e1b215b", "comment": "Malware payload", "value": "393b27629faf102e16ab832a8c21ef40b9dd820508aadc9f7df540c30e5ba04e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638733862, "uuid": "e8203003-729c-492f-ba5a-e8acf1666770", "comment": "Malware payload", "value": "897614f43c47e65daa94e366a974c4c54706fa87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638733862, "uuid": "43a5f99f-a1e5-42dc-bc48-c8e61fb06d7c", "comment": "Malware payload", "value": "bcfa6ba6523411917d25eb5c7d154ae1a55f3619b6ef1f4f19c9ae40f345245c065e5b2b0bc2c6e2e6dd35b9a16f64a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638733862, "uuid": "5b98ff9f-2795-41a2-b853-be9d2c579e51", "value": "T1C07533864D5C312FEC4A4BF58108F72BC5CE67746AD63706429CAA137A302F4AE4D7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638733862, "uuid": "db4289d7-abab-4e48-9321-9b243104446f", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638733862, "uuid": "8d65c89a-f64d-4104-a416-c7826c8ea29b", "value": "49152:4Kpfh5lKzdEI3fQCDo9DL3GjPzJWD7x3aIeSMNamU6NVC:4afh5ICIv89n2j7U3ips", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638733862, "uuid": "57a387d0-d928-452b-aa32-a23c00259ca1", "value": 1615872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638733862, "uuid": "ff9280bd-cc6e-4169-8b14-67b0631e82af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638733862, "uuid": "1026ff51-a3b7-46fe-ab2e-5aac681ae8b9", "value": "a0d49918e31227a992639846dba48db4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b67215-5626-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638748513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748513, "uuid": "c1b51dab-81f2-4b0d-b737-be824d6cd12b", "comment": "Malware payload", "value": "620a71217e99abdb199b6568fcc483d1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748513, "uuid": "3a8644e6-55fa-423c-9fcb-d107789d0e5d", "comment": "Malware payload", "value": "3b55a94bce8595f9c9b655ca7029bc2ae625b11bd2d5d4eb022cc2028d496af6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748513, "uuid": "458e880c-728c-4054-b6d9-8f9682513b5d", "comment": "Malware payload", "value": "745c1c1469ff681aeccae5b18713d8054c8d6c0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748513, "uuid": "7c1aa78c-04b4-4380-9e95-bc53a8b279f7", "comment": "Malware payload", "value": "5d299bcdcdf800a0dde55e1c3625a020666fb70adea74994c7f1e04bc07fc5a5c07df1dd4555650f35d9dfbd3c1d3802", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748513, "uuid": "cd561000-e7c4-49d6-b164-cd50b29f55bf", "value": "T1C9B4BE11B6D29432E0BF05343978EB5609AD7C328FB4C9EBB7D816AD0F705C18A35A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748513, "uuid": "a69d2d45-0f5a-4e46-abb2-42d0bbbad3ab", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748513, "uuid": "699f4e6b-3117-4120-8976-8f3f72dc2273", "value": "12288:+AriSOG9c0jc5mDQxqfNR4iTQG8Ht3WZ6y1zTV3z14:vof4DQxMP4iTFUVWXpTVjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748513, "uuid": "68214b27-c71a-47dc-b495-4ee006523e5f", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748513, "uuid": "257e18ff-cc84-42a6-89de-956dae459c70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748513, "uuid": "39985a83-99da-4f7a-a869-9efe1ea74856", "value": "emotet_exe_e5_24e4e8e211403b83e07f7622f9075a28f93e9bad9663c70a2e0c1e403d787fba_2021-12-05__235508.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1bc1d4-55e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638722001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722001, "uuid": "9f490267-dd58-48df-8686-8ec3c094821b", "comment": "Malware payload (Mirai)", "value": "887dc7bbde314c208a6e9771f2890870", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722001, "uuid": "8628435a-e22c-47a8-ab25-373802c2e2d9", "comment": "Malware payload (Mirai)", "value": "3c3d7df4bd7ef6db95d5065a154e04d73516428d641b1f07535aa41f782a8f73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722001, "uuid": "2a71b3ac-db91-4b4e-b8d4-0f6d1d0b36a3", "comment": "Malware payload (Mirai)", "value": "661fb19661ba998aef7160e43d56ce4bef1d6b22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722001, "uuid": "b591b0ce-34aa-4187-9801-32a584384f41", "comment": "Malware payload (Mirai)", "value": "72f49d183dc7c79082c79917d1e2731c36d1ec711b5cb26fe6778ceb80eae10dd777c71ad5e4bbaf46c589e7d70ac8ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722001, "uuid": "407e0d36-90ad-4b52-a10e-30b2cfd9a701", "value": "T140D34B86FA408B13C4C61B76FAAF41493322D795E3EB73068D185BF43F86A5E4E17606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722001, "uuid": "8cc74e46-d2f6-4a86-b561-89aa964c6631", "value": "3072:gqyf/K8sSFYSQOrqvGV0FOq/rtI9p2alXMkM/9OAr:VeKnSF/ZV0FOq/hIyalDM/9OAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722001, "uuid": "4b80a92e-7aac-4ed7-9ca6-993e2a54050e", "value": 142549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722001, "uuid": "c0ae8d82-ab2a-4727-8898-0868563f2418", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722001, "uuid": "44e060c9-1f70-4749-a277-8c95e7c1b6f3", "value": "887dc7bbde314c208a6e9771f2890870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c42eff3-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638693810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693810, "uuid": "0b5ec825-08fb-42ec-b1e2-c9b3d5b43ad1", "comment": "Malware payload (Mirai)", "value": "e92fbb2bf64e8a2a1a8fead18474f115", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693810, "uuid": "8b2e8197-2321-43f3-ab7c-f46c45c4dedd", "comment": "Malware payload (Mirai)", "value": "3ca2139fe73591c5eb784bea6b9595732a4f4963f0074cf39b7e57cee65ff3ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693810, "uuid": "c462a71e-20e2-42f9-b3a7-b05a9105c37e", "comment": "Malware payload (Mirai)", "value": "8ae0b4a1e6e2da89af07ff4c0fa6d30649a3f69c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693810, "uuid": "10bde29c-ef5a-4572-8a37-fab2630d5d8e", "comment": "Malware payload (Mirai)", "value": "694ec8bbc522e116c74f4e2ae87cda766972b588cd914e9fe79be902d74ef926e3c149d7b0f79f8d28a0375158d9fa34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693810, "uuid": "a9caffdf-7d57-468e-83ad-29210c6f6f29", "value": "T14E733AD6F801DDBDFC0AE67A4413090EB530B2645B930F37A25BFCA7BD720A52A56E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693810, "uuid": "268efcdb-7210-4948-9e24-9fbee3b7a056", "value": "1536:BvaieHhZQww6ea48bDn4Qko7NcvWHg1eLdRx:BidTVjeapGoBcuNRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693810, "uuid": "242fa117-95da-49d9-addb-3c894591f099", "value": 80128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693810, "uuid": "67c1785b-3867-4351-8fde-3478157b9bf7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693810, "uuid": "04962c82-25ca-41a3-8ebd-64d3e8ddcf13", "value": "e92fbb2bf64e8a2a1a8fead18474f115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d21bb7b-55a0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638690698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690698, "uuid": "d3123c69-0dff-4c6f-9589-6ad9f54fd226", "comment": "Malware payload (Mirai)", "value": "c79ce74b63e0eda80153273d92ee3195", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690698, "uuid": "4abd746b-f7a3-44ba-a96a-abed007a3b50", "comment": "Malware payload (Mirai)", "value": "4016b6c8dfd782b78dff1c853ff59dc7e92b1a23c46cffdc6b0e06965b5d7f7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690698, "uuid": "e551ec90-600c-4b2a-aa75-124a82fff8b1", "comment": "Malware payload (Mirai)", "value": "5803251f9108294a3449db9593e9ba5c16f44f9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690698, "uuid": "b54387d3-a5b5-45ab-b53a-e067e7a0c188", "comment": "Malware payload (Mirai)", "value": "e836a3ef07f2f9ae4a1b17e2be574140c728c01d3b5cbb7b6de9539ce851c2bb164207eade7a09c3656a9ec47b7a6b49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690698, "uuid": "55ef5c9e-7492-4000-999a-56f6dc7844e8", "value": "T133E2F161C953EA22D9F06873BE7248925C081FB46EB5B46317B425EC53D318F7869B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690698, "uuid": "63f6063c-a1dc-4200-97b6-457acf2e0a74", "value": "768:mWPK+O2Do0oZOOvzGWijimrCor7fejESUB5qWZ9q3UELkR:RXO2jMGxWoANu5zMLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690698, "uuid": "a8b995d5-aba1-4572-a419-30eef23a3361", "value": 33572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690698, "uuid": "9a709744-a0f1-43e1-8984-32c77a9438f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690698, "uuid": "7b898bee-9dfa-4936-b236-d33f7e38c280", "value": "c79ce74b63e0eda80153273d92ee3195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454f926e-5622-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638746573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638746573, "uuid": "8a8f0140-3c70-4817-9866-bbb6c6de23a0", "comment": "Malware payload", "value": "1813abbe49de404c0c0c02a28fc06d64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638746573, "uuid": "ebcc6130-00c2-4b54-b887-37cd3d9b2c97", "comment": "Malware payload", "value": "41eed12a51e9f070c161a1cedac0e5eaab85d7c82513d5d5d2e798a19bc4fceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638746573, "uuid": "964e7fd7-438d-4b14-be0f-47fa164f0b8b", "comment": "Malware payload", "value": "c4968da6a019ca12ae8bebf86927b82d54626dbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638746573, "uuid": "fff3cb0f-4c84-46af-9036-c8bce12ddd0f", "comment": "Malware payload", "value": "e80b57474a28eb50b44132bf9e6566464126bdbb1025c147ef649af5559d1f649c886df44451760cd016c6e6863f03e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638746573, "uuid": "67767ff8-baa3-4eaa-9a79-b0cbfa6dc8e7", "value": "T1AF6533F4C7D1FB4EDA5797B01BF47E29A3C6E5D44E91C099C2D9510E8C38842A72D2B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638746573, "uuid": "b17b2f25-f3e2-4a12-b3bc-6a3cee01a25b", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638746573, "uuid": "34e08387-120f-4859-bf3c-e2db40793d4e", "value": "24576:jrxD0wWrggRTi3j1KdSZwZAPEB3bCcsLrOKdwNk4Gc1wqTcZJjkEaHNYK3TnYf/:jVg5EAiAiSrCcsLBwy4wJJjNaFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638746573, "uuid": "b51b0166-48f8-45d6-b158-fb5c000d37e5", "value": 1535704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638746573, "uuid": "f034ebb9-3253-4881-aba0-b7d0ac408ee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638746573, "uuid": "92fb6d43-8ed4-4556-b593-c06f30e29b84", "value": "Valorant Skin Changer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69a4ad1-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708216, "uuid": "19efc69b-cca5-4375-8c48-ce8c6441eccc", "comment": "Malware payload", "value": "b7081fac74a4f29e4de9cd171ccbc9a8", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708216, "uuid": "38e52a65-33a5-4f63-b2d6-752d5af3e191", "comment": "Malware payload", "value": "42040529da52fc69b5bea6fc1b0129beb253c167ad306714abedada26192ac16", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708216, "uuid": "e3aea343-cdc8-43c5-8ad9-7849dd5220c7", "comment": "Malware payload", "value": "70386f334d2eaa0f9c3621d2d4b3443ac31afd39", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708216, "uuid": "78716acf-eb02-43f7-97ea-e45422e21a37", "comment": "Malware payload", "value": "e2ce99288cf4bb0501896e7fa09a5f63707a322d426d21fdc925e88465b3d20320160957a3007b6167d3066bfff3d3d4", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708216, "uuid": "c47b830d-c9d7-4ecc-a634-ed3a79868139", "value": "T11FD5331099D106C8F598CE2F1BDDA536147FEFCA78A8ADE782D28BF1040FB859973464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708216, "uuid": "30ef97c4-f0bf-4b5f-b194-634cfc6ecc21", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqV:G1wwAjzIQOMK2GNKslgus10YV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708216, "uuid": "1a64e390-250d-4ea7-852b-d59e9d3729b3", "value": 2912256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708216, "uuid": "f6853b5f-a80b-45a9-97d3-62a905030f70", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708216, "uuid": "96ea3cbd-09c1-4275-b8c5-ab7189e69d1b", "value": "42040529da52fc69b5bea6fc1b0129beb253c167ad306714abedada26192ac16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f7a9b0-561a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638743170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638743170, "uuid": "d2eca331-fc33-4d33-b2a4-59a56140f4ad", "comment": "Malware payload", "value": "b77a7d89c69b05d5fbff6ef82a17a4d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638743170, "uuid": "5bdb0332-7533-4472-b35c-1d00533b5d8f", "comment": "Malware payload", "value": "4273cb34144e9f16620bc4f43d286ac6068dffd6d006dfd938a0abbc4c55cf47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638743170, "uuid": "d4fa51d8-d317-410a-958a-8ec8952b5bee", "comment": "Malware payload", "value": "e00961ce2020df807dc576f02b1aae0cdf70512c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638743170, "uuid": "e81913f5-a42f-4de2-a171-7d7457aa5adb", "comment": "Malware payload", "value": "f03f0a0bb49eb0b6f9aa488daccfb5036148c84a9641884e748faf9f040054d4542ffe379aeb959d057134db92e45b46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638743170, "uuid": "1fcc4992-2b85-4b2f-9e10-efb14f0855ec", "value": "T183245B2C77889E20E77C0437C8F10250E3F1D85A9147E75AB9C431E95993BCAEA5A7CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638743170, "uuid": "2eb67d34-3e4a-4b5a-b37a-55de5d35189b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638743170, "uuid": "d61e6f36-2948-4f8b-a28f-2642b45ed0e1", "value": "3072:9TnpKndizkxFywsbrGNTyY9+uREwiULOd+TlvhwSd++1MsufQhzzUtffYVf2Smn:xnpqMzfH6eWle7+TLw9sufDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638743170, "uuid": "951c630a-2d04-4b25-8f1c-e10cad90509c", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638743170, "uuid": "77735341-c6eb-406c-85a7-a2c5ff137fd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638743170, "uuid": "7ee3f6c8-cfe7-4b80-b29b-2577616b1cc2", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee88ced3-559c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638689304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689304, "uuid": "22d14d27-c984-43ad-a206-51aaaa460920", "comment": "Malware payload (Smoke Loader)", "value": "ca53d7c908eff8fbefc337406939a07d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689304, "uuid": "02aec56c-9cc0-4cf7-834d-baa02043f579", "comment": "Malware payload (Smoke Loader)", "value": "4429d7bb14f60e8b2673db64a7f3e9550947d40cd53eadd1006f3c3959201fb7", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689304, "uuid": "da3cb8c8-be5d-45bc-bd8f-5d8fb0ee602a", "comment": "Malware payload (Smoke Loader)", "value": "05c4da8a7e8ffac6ac90424d53b83be16df7814f", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689304, "uuid": "35c3cc59-de56-4859-bb09-63c1e7385199", "comment": "Malware payload (Smoke Loader)", "value": "8a68f58338e8778eaf67d5b51e23b8449af2f3c9d8a66da8210cf77e520607609c846732fea4db9cd54e519d2310fe38", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689304, "uuid": "687a324c-c5fc-4c28-9545-eef2406095f5", "value": "T148549E2133E0C033D59725764525CBB58EBA74316A666ACBBFC80EBC9F247D1A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689304, "uuid": "319593db-c924-49a4-a300-128145a3326b", "value": "ace494ecc2c2c2c7ecf836ae6aa78574", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689304, "uuid": "14d3191c-3fd1-495e-9c63-99887384d865", "value": "3072:pA7a5PP224bY7osYlx/JjxI3vJiNYeigin0Nt6bE5PJJDGWEZvZ4WWv1oC5KL:p4qU+o9JjxImDqBbEtJJaVZ4TNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638689304, "uuid": "75d85ea8-b4e7-443b-89e3-6f2c70f0aaae", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638689304, "uuid": "5857025a-d4af-423d-9af4-5eaa4b0217c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689304, "uuid": "6601fb6c-cfc6-487e-b8ae-fb5a2401874b", "value": "ca53d7c908eff8fbefc337406939a07d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f3f8b1-55ec-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638723567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723567, "uuid": "e7fc0f37-e150-44ad-8f5c-a43e7e167a79", "comment": "Malware payload (Gafgyt)", "value": "a6005e36a2fc6eb20bedf037e8c4165a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723567, "uuid": "c20c6316-4f97-40ca-81f9-0e86fbdbdbf7", "comment": "Malware payload (Gafgyt)", "value": "44bb56665e9a83fa19bedd01651c5ef80e8f165193556b494b37d458d5a62e75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723567, "uuid": "8ee05d82-a20f-4a9a-a7ea-416bf94b345e", "comment": "Malware payload (Gafgyt)", "value": "c8a2a22bf51cd8d1f3942a33440d2c689963ee17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723567, "uuid": "d63a9a5c-160c-4282-a1aa-29cad847525b", "comment": "Malware payload (Gafgyt)", "value": "2a30488af9dfd82f1651bdf9c86fca62f21ccd416897414500cb35bdf3d2c649861ce5696779e9b451b62f48b2177aa1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723567, "uuid": "5c5a91cf-29b0-49c7-815b-5226550d127c", "value": "T1B9734A02FA42C7B3C4930AB6029BEB5A0931F9BA5F179F45F32C7DB46B124C87216B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723567, "uuid": "a8d6bd80-a200-4c9c-ad7a-1b4dd680b9cb", "value": "1536:xTqiVw//WXKG01KNw7XsCtGV+7dAQlmLI2VOCjXUfJRk:YiVw26ZKNw7sCQUxmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638723567, "uuid": "df321a40-45ab-4b57-b21e-b02756b8bb78", "value": 76738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638723567, "uuid": "f6440b8d-d49a-4c25-9961-c989426e34cb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723567, "uuid": "661c7605-674e-4aac-b21e-88c708f7f027", "value": "a6005e36a2fc6eb20bedf037e8c4165a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2626f1-5584-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638678991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678991, "uuid": "f186c119-281d-46ce-b6ac-ee8a95d58581", "comment": "Malware payload (Gafgyt)", "value": "1d5d00126c3e3909158e132941d91a0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678991, "uuid": "ed8edb57-222d-4163-9141-5f72bdbfc961", "comment": "Malware payload (Gafgyt)", "value": "4673ecd520d2f47d6a2ef4e262301398f2fb73fb61a29e35bdf6f347841db758", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678991, "uuid": "fa4bb0a3-eddc-425c-88d9-0c0ea5e24daa", "comment": "Malware payload (Gafgyt)", "value": "f9208eca5f449cabce390537521a57f096e6a00e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678991, "uuid": "a5f79f98-a5ec-42cf-89d0-ca7a93086478", "comment": "Malware payload (Gafgyt)", "value": "63ba06310b2b6d919ed7a49ddcac7aef2830394562d2ce4c039733662788ff6d136f51d34eb009399efa296336f15800", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678991, "uuid": "f66292d7-876b-4cd7-92e5-c8f082d6f147", "value": "T1C4832B06D3A3D5B3C4871BFA02E7972B0631F9564B2A5F0AE35DBEF46B024C4758A316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678991, "uuid": "f674e28f-aea3-4646-9ac8-1e5bea7c0d9c", "value": "1536:Zc47rsiNhVUQt6jG38Z799/OyQlas6T/apdlX6Ylu0+36m5BsNFP4Y7x0:djVUQtbU7jXQUseiqYlutqmrsN14Y7x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638678991, "uuid": "96026629-c84f-43f2-b05d-514208dbb181", "value": 87561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638678991, "uuid": "64a50eea-940e-4687-8806-224a26b30a4d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678991, "uuid": "ed8c402f-a123-41db-bcc0-d3cb625c3c15", "value": "1d5d00126c3e3909158e132941d91a0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ea3668-55be-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638703602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638703602, "uuid": "5102d0d0-fc25-4db4-9955-bcbfea81c2b2", "comment": "Malware payload (Formbook)", "value": "851dfa1d7b84f4398c714d0b69c4d881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638703602, "uuid": "aea7eff2-bf5f-4e04-89b2-03ae7bb26983", "comment": "Malware payload (Formbook)", "value": "46c6e99d59ab3164c5150d2f938c78330377a7afb81dd6d76b78eb0517bae6a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638703602, "uuid": "54ab8afa-8ff6-4b06-90dc-0776633c4b2b", "comment": "Malware payload (Formbook)", "value": "fd9affad371a3d953f62d683e4f6cffc95c3b037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638703602, "uuid": "47fbdb1d-1dbe-42e7-b5ee-35419e0a79c5", "comment": "Malware payload (Formbook)", "value": "c95435422733df9382da33712b7d25c8274fb65187c301df3ec8b2d61cc84b0cc25fc1d5fa51614c46cb3e801c98d9e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638703602, "uuid": "47c20ec6-d7e9-4625-ab84-4f98286ce0cf", "value": "T19C74121EE3D10C5BE6E11B3019BB1DB4E3FBFEB42A71A90256157D3B5BB3287291A011", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638703602, "uuid": "7bb0ead7-cfbf-495f-ab4f-cd239fe3b910", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638703602, "uuid": "add8b7ba-d754-4f71-82e8-6951a9bdae33", "value": "6144:jGiNJ2rmgva5Pq4H+luH/58qmeUh5ZBwPwD0ZBUa:n2SgvJE+luHqh/BwPwD0Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638703602, "uuid": "d9cb5216-7460-41fa-9d6a-521addc5eb67", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638703602, "uuid": "2e09019b-a44f-488b-8c36-e26634dd04a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638703602, "uuid": "632e41a4-0d58-4d12-8b59-fd75afee551d", "value": "Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c871d6da-5590-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638684086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684086, "uuid": "7f69398b-001d-40ca-a222-a7ca446e97f9", "comment": "Malware payload (RedLineStealer)", "value": "eca331f956ca2c7079cad20446cb4de0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684086, "uuid": "8b93ecc6-1ba8-46fd-8b98-3768772cc20e", "comment": "Malware payload (RedLineStealer)", "value": "494310e4e3e393fcbd3d4c78bfdf3b0d97a8fd10ff10b3225a889a87a8d6ee2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684086, "uuid": "9266d8a4-3982-4923-8ad1-38a0b12b6424", "comment": "Malware payload (RedLineStealer)", "value": "a5c18505baf2f3436bab849a276e8d32603b55f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684086, "uuid": "7e98db40-1f1b-422d-bc08-0b81a5f5435f", "comment": "Malware payload (RedLineStealer)", "value": "f5e033711acabd81a1c4f7a286560a1ab589f9cf47db48cedb10ab12873ac45d5b53c064f2d7eedb6e0714de616ea84c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684086, "uuid": "558c27da-3111-4658-8e59-5699e0ce7c7b", "value": "T18C549D2133A0C033D58725768525CBB58EBAB4312A266ACFBBD44EBC9F247D1973530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684086, "uuid": "b63c8a68-39d2-4a8f-9bdf-d9f6aa2b3595", "value": "c5abd64536bf33cf9d17453c6dc09550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684086, "uuid": "17854419-a10f-4c04-b907-feaecffe8db3", "value": "3072:JsT18F8fej4NpVsYWJZYIDx9pJi8dKgMXUaFv1gjFcGwNEPDlLSsiyzQMSu56N:yRJfvVMsIVN67v1mCEPD1QMEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638684086, "uuid": "b1b8ad0c-32f8-4b7a-a3c8-3944b1296868", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638684086, "uuid": "ad1c8ca0-b233-4f8d-a978-e2da6aa847f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684086, "uuid": "73cea6bf-e47e-427b-8c5f-a67d1bf6081e", "value": "eca331f956ca2c7079cad20446cb4de0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280d500f-55fc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638730203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638730203, "uuid": "d7620251-8e7a-446e-bd75-f962490ef245", "comment": "Malware payload (Mirai)", "value": "708139ef2d135ae0af565ebf5483477a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638730203, "uuid": "3f87ae48-aa2f-4c0b-94ea-fe5c47b3b512", "comment": "Malware payload (Mirai)", "value": "494d9c18e89be7e75e03fcd73a0aefdcdce6cc82cf074afee770f757e4c83497", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638730203, "uuid": "f66f8f76-57a7-4855-bfae-21522432f362", "comment": "Malware payload (Mirai)", "value": "ec3c04d6a76b8afaec70e948959889437a4d9643", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638730203, "uuid": "96d17012-9f65-4b14-a36e-ad25254dd1fa", "comment": "Malware payload (Mirai)", "value": "11bb7b1d774744cf4a0f1c3250b67f539baa65661311bcc7898db956c4d419f9647001a8122b8f75aeb6ac02cb299ce9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638730203, "uuid": "274f0a8b-13f0-47d9-bfef-922993a00872", "value": "T1C6E2F16586D7420DDDD8B7F3D4CCB1A248E6212167BF8F622E2C4C52224B1D962D4E9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638730203, "uuid": "47dabaf9-43d4-4040-991e-824cd6ce2126", "value": "768:Tq3yhi2rg98FdmvPyQw7NABkcEfwVBVVtXIXJ4N9VcaV2y1K5:4iFdmvPgACcEfwVLsXJ4u6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638730203, "uuid": "95674757-4b79-473a-bfce-1a9a681c98a4", "value": 31336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638730203, "uuid": "25ad3b2e-b48e-4ee3-8262-b2f5a41467a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638730203, "uuid": "03168af1-a11e-4fbd-ad99-750fedcafc24", "value": "z0r0.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bb3ffc-5611-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638739225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739225, "uuid": "45482323-1b68-4655-948f-1e9ff740e4bb", "comment": "Malware payload (Mirai)", "value": "5d377df2e425b80d10d6aa6edb204ad9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739225, "uuid": "4472c0a2-dbad-4d76-b3de-252b70a11953", "comment": "Malware payload (Mirai)", "value": "4976e24dd32d66ac356cef62e381057f5eaeec92cfa3b8af4ad0aa4e3119f228", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739225, "uuid": "37a21d4f-5400-4e1a-9660-5aa4b450afb6", "comment": "Malware payload (Mirai)", "value": "fa7b5bc8d56da4a6d7b532a905cb8a84c003ff97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739225, "uuid": "ea01dbdc-757a-46ea-a6ae-236292d556ec", "comment": "Malware payload (Mirai)", "value": "28b613be89ccb69e0a8b3eec05d7f5804255d94e063ee0e9ab489b72735abf37fedb5442131c6c3094fff37188eea288", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739225, "uuid": "ce5c6dd7-bca9-45d6-aea1-487780606f5e", "value": "T14ED2D0AD53002769CD7E90FC176B07A43DB98F259083AE6A65C1FEC1EC445F479A3AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739225, "uuid": "945a713c-18f6-4694-8a3d-940b15566899", "value": "768:/yvYLznDEB2iC+sDqC6NtxsfzxPnNsGbG/l8EXAJgGlzDpbuR1JU:GYnnDEBI+smATfvXVJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638739225, "uuid": "47523d42-1a73-4fe7-9ddb-a8470159c13f", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638739225, "uuid": "72ee236d-a9a1-4698-b326-06ea49ee863c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739225, "uuid": "721be775-dcfc-4ec1-961c-30d78cbcabfe", "value": "5d377df2e425b80d10d6aa6edb204ad9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fb20fc-5627-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638748648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748648, "uuid": "e1c55ccf-d764-4186-9dab-79223f3d9dc6", "comment": "Malware payload", "value": "a6cc53d9695ece444a3ad476a261d0d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748648, "uuid": "a8655e2b-6ad2-433d-9dc7-0a98728f4837", "comment": "Malware payload", "value": "4af6172bd889b45548016c2303df6c3e4a0067f0459fbcaea3f49d5f6887db81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748648, "uuid": "c6575ee5-672a-454f-b1e3-dd2e6c6d9c86", "comment": "Malware payload", "value": "1389270281f5e187a1ffcb18bbf8b62284ad9410", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748648, "uuid": "502fe7b2-a34e-4064-a331-4583fbfb6913", "comment": "Malware payload", "value": "cf434f5d55c8caca8cdf6f293ae125ae347d66353b316b271a76b7f0dff2897e331976b4e903ed4ce56cdb797ea11e64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748648, "uuid": "51108075-27a6-4a97-aa0c-829055e25cb4", "value": "T1EB54E150BFEA8432E4A7A5316470CE625A7F78723A35825B3B74263EDE717D04632393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748648, "uuid": "4afefb33-801f-4992-9b33-38856e0b3a4e", "value": "3e8df926fd370bd9eed56bdb3961982f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748648, "uuid": "e64aebeb-8744-4acb-a0df-fcb62de212b0", "value": "6144:MvzGiXPoPIhwC9dzRp7lnIyv/YCvUSeydxdaIAJ3eK201PXqMxD:MLGiXPoPGweVjv/YAUSeSIJ3ew/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748648, "uuid": "98d624d4-c2f8-47c6-af10-16c51d60a6c2", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748648, "uuid": "6e2a0c2d-556e-417c-9ad3-6cf9689da2f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748648, "uuid": "a89a98da-a57e-4279-a8ba-61758198f97e", "value": "a6cc53d9695ece444a3ad476a261d0d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da60dbd6-5623-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638747252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747252, "uuid": "5f6ada21-7a8c-4547-8030-6853b07d7530", "comment": "Malware payload", "value": "26f26a2aeb01f74c3c43fe03614c4d99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747252, "uuid": "0c6df497-d8f8-41db-a1eb-0e9d07b6351d", "comment": "Malware payload", "value": "4d78c11e4f7e17577627e2a05fa49599cceb15075e3f7cd5428bf8402e32e5db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747252, "uuid": "057b5cdd-865d-4790-ae60-ffe4623e4949", "comment": "Malware payload", "value": "52e2878f038ab06afa9459f7bb43138704211898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747252, "uuid": "469e80a3-3194-497e-a14b-f698fdfb1322", "comment": "Malware payload", "value": "a6d105f98f58fc8bc986f1c18f067b71e9bf3ddad04707cc28e676e9b0db020754d5535a3917d018220e2f4ffd3695b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747252, "uuid": "536ebd3b-6ff0-4a71-9ce7-1d40d7e123ce", "value": "T135352312369A2F37E13C5BF17636A1441BF6623B3AA9DE2C5DC130EE9621F518212F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747252, "uuid": "dcffa5ca-a3b1-43c7-b67a-91db3f5429ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747252, "uuid": "21fb84dd-bcad-4bb4-b551-c999d135827d", "value": "24576:Ixb+4mplmGTEs3zc1Rklry0FVCdE91M6a9FHZbvjNDxTz:WbTa3gs3zc1IryFdE9NOZ1xTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638747252, "uuid": "694a1532-fe5f-4ea3-b325-ee9456f27a09", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638747252, "uuid": "783a0d41-2e21-4082-8125-a0e6fd4d4f6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747252, "uuid": "65a70596-d57f-40fc-890c-063658e37a1c", "value": "ValorantHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a08958d-5560-11ec-96a4-42010a9c0029", "comment": "Malware payload (BlackMatter)", "timestamp": 1638663232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663232, "uuid": "d111391e-f1f1-4551-8598-00b2c0fd3a11", "comment": "Malware payload (BlackMatter)", "value": "1fb8d3aafb6da2fb087d6a186157d720", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663232, "uuid": "104f4508-01a5-452e-bee8-7a51ad2f9732", "comment": "Malware payload (BlackMatter)", "value": "4e74b6733558644ee27e4c568bec821c8e2cec95c86f524999edbbbbe932a43e", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663232, "uuid": "7a221e7c-31c3-4299-abaf-d0442f304ae4", "comment": "Malware payload (BlackMatter)", "value": "a165ef896757160c43c820d440a30ac61019c35e", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663232, "uuid": "e3690cf7-5af5-43a1-862d-bd1785eaf1c6", "comment": "Malware payload (BlackMatter)", "value": "f9ccce307c193ddad36922905ccf4245e50cdcdbea112b3e4cc2f95d2131d7d7e7b0ba5b8508839b0582d4a149ab4b71", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663232, "uuid": "9e214bbb-7db7-4725-b694-64405e96d3d1", "value": "T1A4E32910318AD077C0DE18FEA62F62957B6FC91D48E968BFBBD84F09665A4237F20543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663232, "uuid": "fa524c14-792c-471a-917d-8ec00a7434fd", "value": "1536:BnICS4ALkzXpA5DptlN3nICS4ALkzXpA5DptlNRrr9e77LI750Dx:S5gSJNk5gSJNprwXk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638663232, "uuid": "ac6bade2-7f0f-4921-8e9c-27df1c5b5491", "value": 144953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638663232, "uuid": "d0d5f4f6-71fe-4a5f-a75d-9f3a94dce5c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663232, "uuid": "c1b56f8c-0101-43d9-ad55-124c488a6d1d", "value": "4e74b6733558644ee27e4c568bec821c8e2cec95c86f524999edbbbbe932a43e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bf7add-5575-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638672542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672542, "uuid": "38df9419-b7fd-4ed2-b867-cc861085800a", "comment": "Malware payload (GuLoader)", "value": "c3d12616fa86608c82def10c1cb58d9e", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672542, "uuid": "40834955-4da3-4882-9c83-f3bf2737375f", "comment": "Malware payload (GuLoader)", "value": "5051a25b75ff32b562f56f5c138de98a3fc4d301ce6b2b7a7d6333faebab6936", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672542, "uuid": "68d2b986-9d48-4cb2-82c7-f87689e53fda", "comment": "Malware payload (GuLoader)", "value": "a2e8844ff494b5839a91c94e8d92e8e63cf92ac0", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672542, "uuid": "d84db694-5669-4e2d-bb7c-bfd2b4eb6dbc", "comment": "Malware payload (GuLoader)", "value": "a31ed17981d30335a0d4892bcc38c164e5b06ef08816f8794d63f7bc848f9e7762a125618bc7b8e93311bfd2aecb82c4", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672542, "uuid": "7c0c6dd0-5014-49b5-89c7-ca762876a9df", "value": "T172C2437EF58B0E48DE568669065A7B65064DF11D32C840E23BBCDB387A5CC5B8B23D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672542, "uuid": "d587e772-72cc-4569-b6e2-952b77f8bb9e", "value": "768:LKWlfFZdwg+R3wIfeGRm/O860I0WcrvauNs/YAMLtFOQ92:LBfFQg+BwIZRm/E0VFbauoYLLTx92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638672542, "uuid": "cac127d3-6b8c-43f2-bfa4-a103a8a4cdd0", "value": 27653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638672542, "uuid": "b4d00eb0-002b-4448-be2e-e5bd41f88b6d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672542, "uuid": "e44e1181-6ab4-4900-8062-394ddbbde98c", "value": "c3d12616fa86608c82def10c1cb58d9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77060aeb-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638722604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722604, "uuid": "29146095-e5bc-4bca-8210-edb8b6eba0fb", "comment": "Malware payload (Mirai)", "value": "b84d9314f94139b6ca47de7b1f2a325f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722604, "uuid": "6d572351-2863-4915-8c57-8eba72577437", "comment": "Malware payload (Mirai)", "value": "506cbcf058f5e96bfef69a036e0cc1736764700d535b34ceb9b8e831c090a4b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722604, "uuid": "2c5d1481-0484-4926-b3aa-efeb008ecf17", "comment": "Malware payload (Mirai)", "value": "3fb48c9e5e6371e18723a6c80afe6ab0b1e42916", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722604, "uuid": "6abc6d25-9783-4be6-a091-f0a48e0749ff", "comment": "Malware payload (Mirai)", "value": "2be81a6f4a270628bca8ada48ea9ba1c0809ee15127db193dadcd9d3089695be835b250891892cce8962d37acce74283", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722604, "uuid": "22343a5f-ebe4-406d-af37-bac297332d13", "value": "T163534B0073988E0BE5AA4EF9283F17E487FFEE4051E5F5846A0FD60A8235E335959F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722604, "uuid": "736e44ea-0643-42d2-863a-d27e329c5a55", "value": "768:f+gZEMb4SRsKLNdT+YsAkURw2gDSwCPxdFBj+LCa31xXwCjjLTJJ58lf6C9/tLix:5/5wCFgDFxlLp8lfjxtLvLjpeEXaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722604, "uuid": "dd62a558-4fce-4cba-af0e-c2c76018b738", "value": 64248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722604, "uuid": "7aee58ec-af43-489d-b19d-0a3bf0ce3f68", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722604, "uuid": "2a316685-a399-41e2-a07d-15bacf970083", "value": "b84d9314f94139b6ca47de7b1f2a325f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd136182-55e7-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638721487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721487, "uuid": "ff63fb23-3315-4151-bf3f-75bdea72a768", "comment": "Malware payload (RedLineStealer)", "value": "722d54030812d3551c5ed8450dad78fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721487, "uuid": "a4d2a3a8-c607-48ae-ac16-42c75790129f", "comment": "Malware payload (RedLineStealer)", "value": "521bb81a2b272528789a3177acc21bfa98edbebe8ada0057092ac89e450111d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721487, "uuid": "b57efa7e-3de4-4ced-acb1-608ee816dcb8", "comment": "Malware payload (RedLineStealer)", "value": "6df95da5feab9de4aa0f7a6cc34a427a77ff5906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721487, "uuid": "22d4aeef-0b2a-435d-8099-76412c9ace55", "comment": "Malware payload (RedLineStealer)", "value": "a74e18cb3815cbac27521be032e94321f319961723657f3712e52bf1645db488385b64aff31ae58cbb2ed4ea6777e9be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721487, "uuid": "34a4bbee-e238-4811-b2f3-6de4ea6afabf", "value": "T12885337FA294DA3AC1C9277C463EA549928B5D3693CCF3AC3DA25F16119C4E5C0882FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721487, "uuid": "6fc4d26f-6d04-444a-be96-6c77642ae022", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721487, "uuid": "917961cc-6dff-4125-8b99-5514c473e55d", "value": "49152:zVmvscf6zCI2tLF0dHw7QL0BbWNadU6NV1:gv4zT2tG1w73k+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721487, "uuid": "894bd6cb-e392-4200-af39-ad6e0fa79b43", "value": 1733120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721487, "uuid": "6868c21e-44e5-4b87-90d5-330070e65474", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721487, "uuid": "56648651-be1b-4557-9236-87d666c9018e", "value": "Skinschanger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b30977-5626-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638748243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748243, "uuid": "8810268c-cb6c-42bf-a3b9-a4d8eb3dc69c", "comment": "Malware payload", "value": "3d93e2c61b25516ee8997b61b2fe63a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748243, "uuid": "20825886-e3fa-4131-91ba-ea545c3c8425", "comment": "Malware payload", "value": "52cb37d91906ed1cd97be339ee5e885bd63989898d5518db5e66f5124a698460", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748243, "uuid": "e006d47f-a9b3-40b3-9c6f-ab5904613d6f", "comment": "Malware payload", "value": "95aa403192be4f765be06861c1997a59a73bb40f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748243, "uuid": "8c95106a-9dc6-471f-a5a1-0bab22903227", "comment": "Malware payload", "value": "f958e6c2e50c4746e700a916302a3fac427b2258072bbf30db252df293f66f77f9e753c04fd0e244988809730815a729", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748243, "uuid": "193836f0-afde-46f4-a294-f6370ecd55c8", "value": "T16194BF10F7A0D038F1F356F8597593A8A92E7EA16B64A0CF62D516EE47346E0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748243, "uuid": "01c77481-51ff-4b86-a134-500febdb832c", "value": "6777c2daa60f6bf0e60c4c794f841432", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748243, "uuid": "15008857-51bf-4c86-9a83-167e310c2b6f", "value": "12288:0AO9hQjI7lh2O5+fVx9Ge19qoPp+eWCu:0ZQjIP2z1xx+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748243, "uuid": "68140894-4228-4fd4-ab09-42f480f7354d", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748243, "uuid": "868f2bea-f8de-4051-a43b-e7c246854bae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748243, "uuid": "e404ff77-80eb-42ae-978f-5f17992af82e", "value": "3d93e2c61b25516ee8997b61b2fe63a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693236c7-55e4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638720004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720004, "uuid": "436bd35f-63bb-4034-ba1b-b4e39fd4b8e4", "comment": "Malware payload (Gafgyt)", "value": "8b13dac01e443d20f2db274449dd45b5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720004, "uuid": "dee74677-f1fa-4ac1-8770-1918847ddef4", "comment": "Malware payload (Gafgyt)", "value": "538d99b12bb2644ed6debb5e5e3d3726cb0c8b74111c942d377c9626bebf75cf", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720004, "uuid": "806276a8-1f65-479a-9a46-c1917e460164", "comment": "Malware payload (Gafgyt)", "value": "912da1b5af8b4317a578be4e538d9cd0bc5d5b71", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720004, "uuid": "24585ded-b472-4848-bb04-9b2f18777fb9", "comment": "Malware payload (Gafgyt)", "value": "b648187c3be159c289adb11f499551973462c14d262ddccb4e9721ba28e378a62a2e0fff68af0c96d0b9e3664a47d5df", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720004, "uuid": "ff4761cd-3319-4272-91d1-06af389d1c2a", "value": "T1B7234E48FB99932EC6A1F2FFEF98418E33354B9477FE3D2A9235014923C87696536520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720004, "uuid": "070192df-50bd-408b-9f89-1332fee9ce87", "value": "768:tfPVYjzpGMx9VKMl2myZHh3OEpXq1h50Oh26AkZP7WKl42vtaM9o6/HGCtTRUNiF:tftYUKumK3OEpM0qPSrlmGQJ12m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638720004, "uuid": "5f0f8c8a-a93c-43ea-936b-25abb6244b60", "value": 48387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638720004, "uuid": "ff5a054f-d033-4534-a6d4-28f430be20cf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720004, "uuid": "d92a781e-9726-419f-b24c-a227b2c31ed1", "value": "cbr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0962fb14-5624-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638747331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747331, "uuid": "06982c44-29f6-4ffb-867d-2963f46f5a36", "comment": "Malware payload", "value": "399289fefce9004754aa98ca823ebc14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747331, "uuid": "970f7047-dbe7-439e-992c-a8e482325411", "comment": "Malware payload", "value": "557d00f1681acc8fc820823e03fa62fa5fbdfe38233d3ecfaa7b49291cff901a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747331, "uuid": "fb15c8c8-1178-4eea-bff5-db1a5c6ee44d", "comment": "Malware payload", "value": "402220a50be951b176d233a49e1f302a08857ba7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747331, "uuid": "9a099e17-cafe-48ed-81ad-ed1c29ad03be", "comment": "Malware payload", "value": "9e00484300f42360b9a895d9c52eeedf5c369af531aa512a23d16d2cb7cf9d1dbb97c731e7b9a28c6d5051c019f11306", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747331, "uuid": "26cce30e-4fd7-462e-a56e-7a49eb2cfbd5", "value": "T11805262864BFD02951E3EE952DDCA8BBDE9A55E3640C743701B4632B8B52B80DF4F439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747331, "uuid": "edc0f1fa-af46-45a0-b9ed-2a94c612ac25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747331, "uuid": "14c2952c-85ec-4cb2-a969-967a7a64f9e4", "value": "12288:CyTHxPLU0mw7w4Dfy3fST/ZgiEXHqzeK3zLterK2YmUejWTtCl21Hlc4Obmj8HdA:JtPMpHs4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638747331, "uuid": "c2f3bf37-5d30-40d7-8239-0fbb6c8519b0", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638747331, "uuid": "b60e4fbd-6ac5-4ad8-a8ee-adf8040e5348", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747331, "uuid": "89c28e26-cdad-4453-8627-a13aa0f8e983", "value": "399289fefce9004754aa98ca823ebc14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa87b01d-5584-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638679016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679016, "uuid": "cc015d7a-2304-410d-a1ea-d720a182d910", "comment": "Malware payload (Gafgyt)", "value": "6bf547fe15ac7ec3cd83cfdfdb853004", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679016, "uuid": "2f37fec7-ab4e-4bb8-91bd-da966eb98a1b", "comment": "Malware payload (Gafgyt)", "value": "5644d5cea2e5761cfe3ddf540425995016a0fc493bc0e0d88a3ddb0ce1222952", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679016, "uuid": "6f3468ce-0c6d-43dd-b770-295c05012f5b", "comment": "Malware payload (Gafgyt)", "value": "5ac67e6a8006a0b590999b20cc9042c540f3c77a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679016, "uuid": "37a1e126-f18e-410a-9100-f21d0e86c09f", "comment": "Malware payload (Gafgyt)", "value": "99e92de3e03a52d230c6c5b612f41f0b4826cb8d5568326a9ea14001ad807cc088fccdeb1a0e3833574135388c8b98a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679016, "uuid": "c055e1c2-bbe1-4892-8275-c488df8c7143", "value": "T12DC3292327270B23C5EA503441E35333B7B6DB8535789347AAD0AEAC2F1AAD435573E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679016, "uuid": "70827727-8757-4bb2-8628-be98efe8a562", "value": "1536:b+3k0yIa7NQoeKV8Eh7mLb/Zvt+7fqtAnIsiADGmuwA/nivYaW:poa7N5enLbB1cPIsiADGmuwAfKYaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638679016, "uuid": "54e0442c-d898-44c0-8336-48c58eab23ec", "value": 120259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638679016, "uuid": "be273446-dcc6-40e3-9b0f-99264288a786", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679016, "uuid": "1ef74756-58e3-44d0-b15b-8295b83c4fb3", "value": "6bf547fe15ac7ec3cd83cfdfdb853004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6053c3-55e8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638721894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721894, "uuid": "f0228014-3dbe-4d17-aa3c-51d72afffbc1", "comment": "Malware payload (RedLineStealer)", "value": "f5ca907b9390037f5ee5106abdc71927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721894, "uuid": "d08a3c01-4ff9-4a4c-bc28-739abe520084", "comment": "Malware payload (RedLineStealer)", "value": "565b1484478b1644bd1e8954e079f653b8f71c9f16997d4b7fc53f83da609e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721894, "uuid": "b1b660c1-cd62-4be2-ac5d-171de62c8aea", "comment": "Malware payload (RedLineStealer)", "value": "91471f2d090e8858d2945faeffa17af57b8b2eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721894, "uuid": "74fd3fe9-6509-465a-95fd-8d786e34564b", "comment": "Malware payload (RedLineStealer)", "value": "a49a06d63a315a984766ce6086e52131e1e22344fb5c7de3f97229afe92463e427c95f58d5088f1ce04d6c618fb11c55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721894, "uuid": "bc214213-d929-4729-b448-cb64f7411112", "value": "T13515DE1FA5CA8698EE420B7E76E3B70C8FB564DD432B17D89304ADE0CFF82611B09955", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721894, "uuid": "e91b74bc-df7f-4949-94fb-6d5a158d2626", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721894, "uuid": "86ecfe62-c191-440d-81de-2c1bdb563818", "value": "12288:cOtfEEVSD8C+VpeWjaT7FR154laff462XToa+/Wj2Pljyby5i6a/9jOy:nhID8C+VphafjzOUJ2MaFEeybqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721894, "uuid": "fcafe585-68e3-4a98-866d-6a18088e9d85", "value": 877976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721894, "uuid": "eecca987-1e69-4e9d-8f56-111482151604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721894, "uuid": "8ed011b5-d3b5-419b-b323-dbd4de16aff4", "value": "GloryHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a4df7b-55c5-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638706675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638706675, "uuid": "5c8a3092-6b75-45c5-b879-0f875defe999", "comment": "Malware payload (RedLineStealer)", "value": "17d0a00c32548b7eaa82837fb168ae01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638706675, "uuid": "61e33a65-0ce8-4f86-8de8-4bd8bf92152d", "comment": "Malware payload (RedLineStealer)", "value": "571174b8ae101207a90c2a1033716cedf4dcc5fddcd8e6e506133f4a1b79bb91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638706675, "uuid": "933e2532-c718-48b2-83db-b4ebc713913a", "comment": "Malware payload (RedLineStealer)", "value": "3efbcc40d7be9b555d9c837d5650fef0d0c5925d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638706675, "uuid": "e16434c7-d38b-4ed9-9e85-1e71b7af7a56", "comment": "Malware payload (RedLineStealer)", "value": "dee92d345d7e830199c24a478de69c4dd2343863f06b7e7393a321558d25336f45b06f17bd6dfa88ca069dc3af2924e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638706675, "uuid": "6baef72c-4d75-4df6-97f3-a09b2502ec33", "value": "T19EE4F12132C0C073D05625768919C7B54EBAB8765B6ABACBB7D80F795F7D3C1863230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638706675, "uuid": "2fac1c88-5849-49fd-995f-28bce6f8a9ae", "value": "a65482a1f9e06ba3a44a5530ea74c096", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638706675, "uuid": "87660ccf-bae1-419a-bd90-c1562bc60d08", "value": "12288:z6JXN67y6dWivYA6ENcXGDwX14MKH9KDrcXbZ83k4Fv6j352b:zMXNsy6dWiuENjcX1IKDubSkiijJ2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638706675, "uuid": "78c54193-3462-4358-8bb7-0117f4eab26c", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638706675, "uuid": "df55981f-4a2c-449e-b691-e318be85f271", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638706675, "uuid": "edba6120-727e-47e4-89c2-de0006e53fa4", "value": "17d0a00c32548b7eaa82837fb168ae01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d5ccaa-561f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638745279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638745279, "uuid": "e14b90fd-f0d2-4e16-bfdb-7d6c9beb07fe", "comment": "Malware payload", "value": "0633e40fa1f37b748cf61f04dba96445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638745279, "uuid": "80e84e50-3632-4c47-8cf6-866463293b5d", "comment": "Malware payload", "value": "5781173908ae9208be64f02dd0e5cc0dc6ed0d98b16ae577b560b95cc136cb3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638745279, "uuid": "7b54dbfe-315e-46d9-8f5f-c89bf8d128f8", "comment": "Malware payload", "value": "0710b691613be0f6ccf54f8e0bb4d8d7cf3c930c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638745279, "uuid": "02b1caee-5e5b-4174-8a78-aabc7a716d62", "comment": "Malware payload", "value": "4fecf8657645f245bd7ddac20c8edb05dc8d634c1c59f79d62df9eb3a311c66789832398af16250d3b944944af429752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638745279, "uuid": "2106430b-783b-4192-bdd9-c4aab29a6c5d", "value": "T17516333EAFAA984DEC9D53B54C3A8B18036C2DA630972F72560F3541D670D8B4DAE4C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638745279, "uuid": "ab6cae2c-59b7-48cf-9d99-96b4a390e160", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638745279, "uuid": "8b7995ea-c90c-42d9-99f2-0b23d7546cd6", "value": "98304:OLkvxHBREcc0APWH7tGN9CmR/unPmE0da1rM0BNkR:OLOEHXEGN9CuunO6Ai2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638745279, "uuid": "1916bda5-e26e-45e4-9b50-f67696fdd8a6", "value": 4160512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638745279, "uuid": "d5321792-5a22-46b9-89df-b54ea35fb77e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638745279, "uuid": "1226e52f-8929-44f7-bf8d-e792491137ef", "value": "aInjector Win64_x32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471ac13f-5568-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638666689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666689, "uuid": "013fb0da-a52c-4f16-adcb-59e2f42aff34", "comment": "Malware payload", "value": "293d407e9b6637e6524b28b407fafe1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666689, "uuid": "45068dca-fabd-48dd-9387-e26ec85ea371", "comment": "Malware payload", "value": "57bad7724a2683a2672f01d97aff7a5b247aca56f9e950009c1469407ee503ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666689, "uuid": "a6224a60-96d5-4904-80e9-d66bfcaafb40", "comment": "Malware payload", "value": "72d6003e85c3a271b6e8bd06c24a503d3a609040", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666689, "uuid": "a859878a-2fe1-43fe-8c49-adf8fc0f00eb", "comment": "Malware payload", "value": "31c150cd85b600204230add1230d08e623f6430013c2c6118a2c83d3279b9c0192e663c421335904c17fa42137a83ef8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666689, "uuid": "282b383f-0123-4e4f-87da-c47d528666ea", "value": "T105F45A0623F88F26D2AF1735B8305A1997F6F407A2B6E7CF6944D5B81D677A08E00367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666689, "uuid": "3e6f75e1-9b3f-48bc-b58c-cf5536b005c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666689, "uuid": "6578da80-4a46-4f09-8b03-17c34fd42ae8", "value": "12288:7tIp9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q:7W8m657w6ZBLmkitKqBCjC0PDgM5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638666689, "uuid": "38ab6e72-8c4b-4d42-bc44-a9d77da37c59", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638666689, "uuid": "c71d8aea-9a14-48f3-a609-95037eb88486", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666689, "uuid": "7d5bba64-cd02-44a0-85cb-993d9bdf35a5", "value": "293d407e9b6637e6524b28b407fafe1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9d0a67-55b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638701595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701595, "uuid": "3304b0a0-9b58-4aeb-86d8-d57b392be878", "comment": "Malware payload (CryptBot)", "value": "bf18d793a9c771017c0894213f4631e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701595, "uuid": "9cfd06eb-ef81-4b2a-b412-f8ca861d4cf0", "comment": "Malware payload (CryptBot)", "value": "58bfb3fed6bcc98498a58c3f4855525263b50e356282e4f91825b29397a8d825", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701595, "uuid": "4c28bcb5-0c32-4953-9726-57d036d1e4ae", "comment": "Malware payload (CryptBot)", "value": "8182cc916860407215f23100bf1b2bd94d4d7b81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701595, "uuid": "652c29a7-3fec-4cfb-bd6f-2563582a899d", "comment": "Malware payload (CryptBot)", "value": "66f56c417ade0e7ca080075cd25928dc08571fb8ca87c49c4a4401bb4c4ad22da578fc8b602fbd537d964444c91ec7ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701595, "uuid": "9597ae86-9128-46e2-a2bd-e57774c3c513", "value": "T12284DF1276D1C033D08664768C25CBB14EBAB4701B666ACBBBD85FB95F243D2A73530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701595, "uuid": "fdfeea4d-c871-4503-be19-c2dfbe490598", "value": "57414c9b174f8e0ff83324cb2c99bb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701595, "uuid": "c542b055-e919-484e-bc6d-ce3905fa1f20", "value": "6144:37b52qA3WmGYNIninPX8Emuu8AH1fIc/+THO+K9+giEx:37bkxWmGKKinP8Eu6qd9Mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638701595, "uuid": "c40d63b7-a809-440d-8fe6-c83b5bdb9bd9", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638701595, "uuid": "6d02489f-4351-4f42-911c-9c59e148e217", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701595, "uuid": "4863e0f7-6147-43e7-957e-2e6a5939c7e8", "value": "bf18d793a9c771017c0894213f4631e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a527d81-5594-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638685620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638685620, "uuid": "62ad233a-529e-4589-b519-e58adb09f59a", "comment": "Malware payload (RedLineStealer)", "value": "f41941caeecc6bcd2372f6be16d02637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638685620, "uuid": "250ba218-992d-4e53-800e-08b63f2b9f06", "comment": "Malware payload (RedLineStealer)", "value": "597b9887cdbd91de311270cdc07f7d91e6399e1deaf3ec4a00866318e082af24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638685620, "uuid": "8a4606c7-fbbf-47c9-9ea5-a7db26def936", "comment": "Malware payload (RedLineStealer)", "value": "13f24639d5b143b134ce78b3cdad5862779cc142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638685620, "uuid": "316d75ad-fd53-43d0-8dad-be26e240a3c8", "comment": "Malware payload (RedLineStealer)", "value": "af240cbc29c595b8b93c49f0eb1fe12335a3e0911a4e1e8d796fa47b574b42a2429b3ca14d3dc6703c3c6eb5c0b05da7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638685620, "uuid": "4d4cfeb0-851b-41c6-afc1-7e4285c3e0b1", "value": "T10B549D2133D0C033D59729768525CBB58E7AB4312A266ACFBBD41ABD9F247C1A73530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638685620, "uuid": "f7897f6c-18b4-4c93-ad2f-1dace77d0ed4", "value": "b776dbe5b4a858696713fd07b4876aba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638685620, "uuid": "48f06f53-57cb-410f-aae8-0d7cdb97e7f1", "value": "3072:b+OAifz6+kxG/ALYxGiZ8t6GJi/PdgcEkSjrC3MBg2/8c8EUQMON56X5L9:yQfvkuAsZqa6xfa3Mm2/8c8E7MbpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638685620, "uuid": "2bc34b71-6290-4d4b-a982-36a3a3cb07c2", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638685620, "uuid": "fc31b507-5c91-471b-a209-815ef5d794a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638685620, "uuid": "3ccff49d-f990-49f1-b79a-3c2341c9de97", "value": "f41941caeecc6bcd2372f6be16d02637.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ae14f6-5611-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638739492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739492, "uuid": "b8750e51-47de-4861-a155-a2e68d860dda", "comment": "Malware payload", "value": "83e079a327272e93ebd09c49dd4eb263", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739492, "uuid": "73dac68b-b927-4fd5-8ca6-7b990329177e", "comment": "Malware payload", "value": "5a3d41b89d77f310c7512d694bb14a769a89ae0a65ce170a4dcec1b0125d3028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739492, "uuid": "3738c426-8df6-41e5-9fde-22bedcb8d1c1", "comment": "Malware payload", "value": "80330ceeb486fb37ae951f7df45696e0489b4217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739492, "uuid": "13cd7baa-2d69-4bec-bd58-07f90f6592a2", "comment": "Malware payload", "value": "c18ecf005f46ce797230ba7ac9e7b9ad08ddc2cac005f407a64d27a1a4051ecbd9138a91cefeb04af2dca900ffbffa1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739492, "uuid": "823f95b4-7a00-4e3f-b20a-e85cf5621e01", "value": "T11F7533BD5183D86DD18BABB4FE3107EB006D617AAD4EB192EEF150773A0F8E09742494", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739492, "uuid": "e2e3415e-a19b-466d-8dce-53da27205649", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739492, "uuid": "a11b9215-b803-404d-ac3d-b8514f9f988c", "value": "24576:nZe7Luz9C6LKWCt4n6v40tb2SE1+2Zu32ev3mcN1WmddokEaHNYK3n+K4SE:niIQ6JTnH8K1F8mevm21LoNaB3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638739492, "uuid": "713d2c82-606f-46c6-add6-748e945411f9", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638739492, "uuid": "ddc7f61c-68ad-4a13-a78b-60c86250fbea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739492, "uuid": "58d63278-fa8e-4ec3-abc7-3a9b512991b6", "value": "farcry_v137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4581fd0-55c6-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638707299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638707299, "uuid": "21f1b154-17c7-4e2c-8581-07841d878be5", "comment": "Malware payload (RaccoonStealer)", "value": "99d6163dfb308b86861c37c9b6feedc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638707299, "uuid": "7ad36822-ba6f-4a3a-9a04-e9ec33c45638", "comment": "Malware payload (RaccoonStealer)", "value": "5c40e4f135402126341e3f345eee6bd46e8612988b6df99d6046b546886843bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638707299, "uuid": "3ccf966d-ae21-4a57-b5be-423816bd6d7b", "comment": "Malware payload (RaccoonStealer)", "value": "938c68b6afab8e6abbe0c88f44614fc753731978", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638707299, "uuid": "89a39b23-18e8-4300-8e14-8d3c3cbafc90", "comment": "Malware payload (RaccoonStealer)", "value": "c758b75ddc529c9a7641f353a97951fee1fa85139bd9dff79d2052a2e8938529e2c39ff2b0fc1adf60751119187b6cc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638707299, "uuid": "47be3b50-37a7-4666-be86-ed55078da97c", "value": "T1AAC4E12132C0C172C09721729611C7B44EBA7836577669CFBBD40AB95F24AF1AF3A71E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638707299, "uuid": "27213f38-0512-4253-84d4-008478d9e948", "value": "ace494ecc2c2c2c7ecf836ae6aa78574", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638707299, "uuid": "3459cf04-eec9-4124-b4e7-6269b9e110eb", "value": "12288:r8j6av37wrHr/CQQcsK4GBF9wn4lTeuTi1wtX/6dwgkxCU:r8+ajwf4cs7MF9DlTNTjXA4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638707299, "uuid": "d3e3112c-2ee1-4d35-b866-5dc683c6189a", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638707299, "uuid": "08736395-09fa-4a99-aa70-9da5ebbc9653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638707299, "uuid": "5d6f00f2-d7d8-4498-9d4a-eb85b66264ed", "value": "99d6163dfb308b86861c37c9b6feedc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bc708d-5593-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638685392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638685392, "uuid": "8cb46430-e44c-42c0-8c1d-0d98e0f3aded", "comment": "Malware payload (Heodo)", "value": "dbc66397f68b2d9d11cffe5e43c3848f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638685392, "uuid": "935d7632-5f5e-495d-9847-0c09c97cf4d6", "comment": "Malware payload (Heodo)", "value": "5e3312cc82d10726c4e7063365df227356abe27e24f782ed1327f4a3bf3fcdbf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638685392, "uuid": "b49facd8-0dab-48ec-ad98-2d32eca4dfaa", "comment": "Malware payload (Heodo)", "value": "c6d8f1817dc79985125fb632518e8e38ee64bda3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638685392, "uuid": "9570df14-0d3e-444f-8978-c77f00599bcf", "comment": "Malware payload (Heodo)", "value": "d7c81350a9095f086e2fb36e998d5c71e7b2a5c6d08f247eca18919ca5715817e022174c3355b409fb5769b358893826", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638685392, "uuid": "5beb31c3-c6b4-4189-8208-d17e7a697d69", "value": "T194644C00F211E139E9E710FBCAFB48BD99A9AB00234929CF96C86DE5E7554D43D3261F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638685392, "uuid": "2060b3ca-3e56-4052-abcc-7f48294eff97", "value": "6144:m09MHnGC7LRzxzVZYsuOa31UvQV8yMcSWUMuEpzQDWyGVWHmw2MnvXkhH:me+n9DJGtOal5V8yMcztuEpzZ4GbOXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638685392, "uuid": "86155f36-4217-40e3-ae0f-a905b2530567", "value": 332522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638685392, "uuid": "e34b1cfa-4fc0-4e34-86b9-9037323e0c2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638685392, "uuid": "820e93e6-8b62-4ade-805b-f6e02d5ed711", "value": "emotet_exe_e5_5e3312cc82d10726c4e7063365df227356abe27e24f782ed1327f4a3bf3fcdbf_2021-12-05__062308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8779a0d-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708219, "uuid": "ce8d01d3-8d11-4a97-8add-8dba4c72a5c8", "comment": "Malware payload", "value": "3ba896c7e2f818106e15437f6ae1dcd9", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708219, "uuid": "03300b70-2504-455d-acec-124fe91113d8", "comment": "Malware payload", "value": "5e399231251eb93f3d8a0a436cc2e9360df09e88b12c0472ab2a1283af686c48", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708219, "uuid": "dcce5e8d-5b9d-42a6-b197-0957f99102d3", "comment": "Malware payload", "value": "8888e35d2af881de7bb3f6cc868688c66e073163", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708219, "uuid": "1a1928ce-58ae-42aa-b51c-e721ef12685f", "comment": "Malware payload", "value": "18fb5cb1e1f887eef8f400e4429573612bbf3e37c84a0c060f305ad0a5847d7d528eb3fd7a5dde985a4d1453b8783141", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708219, "uuid": "e29beb34-5e52-4e13-b92a-aca4ebee51cd", "value": "T17DC533106AD107C9E554CE2F2FDC9936047BDFCA78A4EDD782E3CAE1100EE95A962874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708219, "uuid": "06e0a8f3-5bcb-4b79-a3da-9ac0ca82cb82", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXc:G1wwAjzIQOMK2GNKslgus1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708219, "uuid": "6ac6dbf1-ede1-4fc5-ab5a-46ad38095c9a", "value": 2502656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708219, "uuid": "bab56ba7-6c9f-44a0-b1b3-e084e87b98f9", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708219, "uuid": "7857cfd9-aecc-407b-9950-af4c6138f0ab", "value": "5e399231251eb93f3d8a0a436cc2e9360df09e88b12c0472ab2a1283af686c48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba8c033-55a0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638690642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690642, "uuid": "66fb1c9e-e40d-4b62-b852-480167dc1940", "comment": "Malware payload (Mirai)", "value": "40875c39a5de7c6ae901f1f5a20e994f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690642, "uuid": "8e848657-a6cf-431b-9ffb-83bb94288022", "comment": "Malware payload (Mirai)", "value": "5ee34dbde34ea41dff60a8a1fbc0e00d48cb57c97427e576145dc1ca061504e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690642, "uuid": "f3a38ed2-a2a6-4fdf-bcf6-b33dd5da7a7f", "comment": "Malware payload (Mirai)", "value": "a0666ce3e6a8626a986474711356cdcd990fda62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690642, "uuid": "c7ebfec7-8d40-4f64-9b91-1b40897a3de9", "comment": "Malware payload (Mirai)", "value": "9a69491a85b96d910723167f3792661343634db10bcc1e4723d580054683f77167ef334ae196fbb265a56d0f91f7ff60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690642, "uuid": "047c0041-95e6-468f-b694-e5f36b40359a", "value": "T13353ADB2C5185D80C189037570F08E3E4763AD45676F0EB59F8986AA640BEECF61D3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690642, "uuid": "e5535457-1355-4da4-ac8f-42f5892476f9", "value": "1536:4/9MulbnEiOkWAV8qK/fBaw8HP9mgpRZQ/CmplI:4FVDxOkWAHyZaLP99/ZQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690642, "uuid": "709fd1f5-2bd1-4c18-8831-5acbf8c3f1af", "value": 66636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690642, "uuid": "ef242c46-e4b2-41a7-8887-870c1a839739", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690642, "uuid": "2f396ab8-cd77-4836-8b40-dd018e617363", "value": "40875c39a5de7c6ae901f1f5a20e994f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e6d2c9-55d1-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638712048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638712048, "uuid": "cfa1a1ca-c4d1-44dd-8817-cf06c30690cc", "comment": "Malware payload", "value": "5c4fa1717ca690d6f2c73060b034e252", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638712048, "uuid": "9a554fe3-afca-46a3-8d9e-72b49d51ae53", "comment": "Malware payload", "value": "5f5f57909deccde53715c24edecf5a2de41c9aa99ea2d7e57b742b4b26286ef7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638712048, "uuid": "de8b5de6-89fb-49e3-8365-672210a9316e", "comment": "Malware payload", "value": "c6cc5db2563bfff68ad7ace6a1ce4e15e96602eb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638712048, "uuid": "e9fb12f9-1724-48bc-aedd-f79d29ea2c84", "comment": "Malware payload", "value": "37846f50f0a9c5d978640d82990f8911f170280da875a9f19ab81ea958b7ea2e790ec16172b0d953a435fb9d287b1a60", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638712048, "uuid": "349206de-2dcc-4767-80f2-929f11200c93", "value": "T157C5DF8AFB09A86FC4B792328A75465A56074C668783D7835E54723C1DBB9C00F9BFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638712048, "uuid": "3a0babaa-4b71-4259-84e2-1f3b0cba96f1", "value": "49152:RgavRrB9egs+RlFrDYcY2i77pcO8qnCAil7qOvXa:fRrB8gRlRZYlljzilc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638712048, "uuid": "eba87f5e-0916-410a-ae88-8e584c228fc5", "value": 2546023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638712048, "uuid": "fd62c994-50c5-4cf0-b79c-d553836e2e87", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638712048, "uuid": "776e7fe7-85a2-43eb-a9cd-b37a9a791d26", "value": "\uc9c8\ubcd1\uad00\ub9ac\uccad COOV.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e819bc7-55a3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638692150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692150, "uuid": "ee7f96a6-68f4-4f29-99e6-eb2acfec0431", "comment": "Malware payload", "value": "9cbeaec69e8a689be6f44233e904f974", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692150, "uuid": "d35b1891-675c-42a6-a462-f66ef11ad81f", "comment": "Malware payload", "value": "5fc28b6277bc34e758ec1d047cccdb13b7d5358e0ae4d34249f7b017312ee307", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692150, "uuid": "a0f26622-b8fb-4e28-9c4e-6256dd7fa725", "comment": "Malware payload", "value": "e6d5033925172117cb58da906effaf725436d732", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692150, "uuid": "6eaa8efb-7d9a-4c44-9cc4-4136e04dc83c", "comment": "Malware payload", "value": "4d514d06180028d4fde7e94d42b8d9192e0fa64994eadfac58b7ed5a2dbd75b60037f5c1f920484ea7bc20edb3542c63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692150, "uuid": "5e42eb2d-9dff-43cc-b7ae-c674ec4c4ce2", "value": "T100D513B86087B377B5A0E79493F3A1BEEBC745626E2B6028D45D057192C2725FF2C20D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692150, "uuid": "da7aae9d-3ec6-43f6-bebc-bc95e4ac8e7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692150, "uuid": "423fd562-16f5-4d74-a8a2-002a901ac9ff", "value": "12288:P8z1kjhUsiuhJPrmU8CcpkVRISM4RaVIRXe:P8z1yUUpVRIZRse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638692150, "uuid": "ffa0efda-aa2f-4498-9945-3d8570b4fb15", "value": 2898944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638692150, "uuid": "e14a9cdf-2278-46eb-9535-2bb42c7fef14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692150, "uuid": "f49aafc3-7e55-4bcd-877a-9d7ad4ff5687", "value": "9cbeaec69e8a689be6f44233e904f974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478a8370-5625-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638747865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747865, "uuid": "4e0309d6-4684-4252-b9bb-673e37e64bf3", "comment": "Malware payload", "value": "b647e480a06fc75f2529a43d91019132", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747865, "uuid": "8683d7fd-d116-40de-81d3-ccbd0b33c1c0", "comment": "Malware payload", "value": "6015dca5bf8d09053d0fe17b8fd10ab361ea260e2900c071de0c6aa70f91de18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747865, "uuid": "179aa03b-4b9b-403a-ad39-23ea7922f609", "comment": "Malware payload", "value": "dd174352c3c29559cb5a2f62e38c92490cad4d21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747865, "uuid": "5df2635d-7408-4727-b76b-1f4cb1c48eff", "comment": "Malware payload", "value": "14df4edbe9540299d9a0b824cf92db2296773f05c0c37efa65d6f0f13ac803dd3e915145d26a6aac2d1a906a6ba24f18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747865, "uuid": "440e9dc0-24c2-4fdb-b6e5-70c2021d56bc", "value": "T1A584BF24FBE6E8CFD461AF7A80E5511033B2D341495BD7076B866A8C0AE27D53B636C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747865, "uuid": "f188b3a8-8d49-4a36-be8b-019c49b6ab75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747865, "uuid": "acf83718-c7ef-43b2-9acf-be53ba767473", "value": "6144:thZJDzw9v+5eDCSVLCtuAL+c8ioTZqNrpkHcKH+vx3y+IST4DbGVM/YC:7E2sjioTcNYHoxi+P/VMgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638747865, "uuid": "a6ccb5d1-4a52-4a2a-8a8b-52562c0d7827", "value": 405232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638747865, "uuid": "762c7595-145a-48d5-a29e-2ca7079eddca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747865, "uuid": "b8e5b331-9b33-43a4-a932-30f8294bdb80", "value": "b647e480a06fc75f2529a43d91019132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95403a3-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708220, "uuid": "ecacba5a-a5d7-4796-b0b8-61f95be33b48", "comment": "Malware payload", "value": "c23884b8d952760f63cdef9d08ab82fc", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708220, "uuid": "15ada7e1-be3a-457e-adc3-108838288fe0", "comment": "Malware payload", "value": "621a358eeef77a904ebbb24ccd5b6fdb5a3b68b7e32b41fdf188066a1284d212", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708220, "uuid": "596a3edc-f207-497d-ab17-f70f411d2388", "comment": "Malware payload", "value": "ded580ad4705c0b1d77cf6c5666ca815c2f9b195", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708220, "uuid": "3d1c5e80-3228-4d74-b384-de971810c733", "comment": "Malware payload", "value": "7e20b9b3f351c209b40532ca0cad3983359c2cf55d1134121840aaa02c15c186ea02d7797e7850cb8cd64385afb612df", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708220, "uuid": "c710c8a5-0241-4434-8dc0-f7e66a6fbbf1", "value": "T1AAA533406AD007C9D5D8DD172F8CD936047AEFC63864FDE353E2DAE1204EEC5A9A29B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708220, "uuid": "62636aa2-f9a3-41bd-ba51-24049c065784", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeSY:G1wwAjzIQOMK2GNKslgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708220, "uuid": "2cbd04bd-e251-43cd-a49f-eab2a2263c1f", "value": 2236416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708220, "uuid": "08dde05f-eb81-41fd-8e1f-7d0ffcfa0e62", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708220, "uuid": "38b4e335-38a6-4792-a5ff-0d251bb8d5f7", "value": "621a358eeef77a904ebbb24ccd5b6fdb5a3b68b7e32b41fdf188066a1284d212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86796220-55eb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638723060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723060, "uuid": "0ba34251-bffb-459f-83fd-5a224b85901d", "comment": "Malware payload (Mirai)", "value": "6010646dc68e754c29fa6008a267f4ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723060, "uuid": "7528e7b7-8db0-49d2-ab9d-1018ba29c2e0", "comment": "Malware payload (Mirai)", "value": "637402efa34af363b43acb05763d350eb9a79a75b633b4345cef056b8f38bcac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723060, "uuid": "019bacde-1812-45bc-84dc-945d059d5991", "comment": "Malware payload (Mirai)", "value": "4ff5bb46130881300145cdc49c2e66868968e3e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723060, "uuid": "eb97994c-7263-4be2-8c70-5915e76a3d41", "comment": "Malware payload (Mirai)", "value": "c3c70276d1b269b70bd10c971656e9613596de5a3b7cf70784c64904f9c4c6dc8d980a081663131ec6f2db796c8c78a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723060, "uuid": "832eb65d-da17-4377-b96e-d1d6c864f14b", "value": "T166A35B82D643C2F3C4430AF1029F965A0532FB3A8A3B9EAAF75D7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723060, "uuid": "c6f009ad-c1d8-4d2d-a332-3bad8de07619", "value": "3072:uLOqjPQP39VjGWX98732V7kGyNVb5huT87FXnf0OzTyoQQub:uJQP39VjGWXW9NVb5hueFXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638723060, "uuid": "e0e69a15-8bbb-4562-9355-ffdd735cc545", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638723060, "uuid": "a01d6053-b4af-44a0-8d19-63a686186140", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723060, "uuid": "50f436ad-6f33-4b1f-b11d-454be1932dcc", "value": "6010646dc68e754c29fa6008a267f4ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b5ef2e-5625-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638747837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747837, "uuid": "e7724a67-0ed4-4a6f-82c4-31b66ff80d6a", "comment": "Malware payload", "value": "1138d14353bba6d7d9e543e288fbc2b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747837, "uuid": "0851b4b1-d956-4a49-95d7-019ffec79c94", "comment": "Malware payload", "value": "639b175ee2f64fbe3d727666ddc2a4dfe295d4e80962f4948df966d9478dae72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747837, "uuid": "7c65c634-8721-42e8-bd9e-87137204026a", "comment": "Malware payload", "value": "8742d46e9881b85bcbacbebe534ca9e86cfa814a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747837, "uuid": "3c5a2bb6-f44f-493c-93c5-13a5e09e7c22", "comment": "Malware payload", "value": "e8f046e5813498131dcb7cec1481f17d2ddb57a44f035ff928de3b709f93fb7612a7b84aab7a0ca6f94b1409fc32da17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747837, "uuid": "0c6b9fc8-ec22-4667-89a2-ab6339435ec6", "value": "T1F754F151B2E28072E0F7557029B0CB918EBF79323C31459B6790163EBEA17D05E6EB4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747837, "uuid": "de452307-8b1d-4ec8-8a67-7dc5900a394a", "value": "3e8df926fd370bd9eed56bdb3961982f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747837, "uuid": "12739e3d-2f1e-4f87-af8f-faf0970afaef", "value": "6144:4vzGiXPoPITyJgmwAK8Xp/ala6BckhzCnjW4e:4LGiXPoPIpmwV8ZKhzCny4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638747837, "uuid": "81fa9ab7-1141-4ffa-931b-ec4b40c8c406", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638747837, "uuid": "49b1cd2e-edb4-4c14-9f69-b9efc7a96e74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747837, "uuid": "f13cd2a3-709a-4514-8af3-80a5b86041ad", "value": "1138d14353bba6d7d9e543e288fbc2b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe14d0a-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708224, "uuid": "83a1d0ee-8cd2-41a4-a910-25c0daef49f2", "comment": "Malware payload", "value": "9e583b08015bf7026236690a6b9db217", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708224, "uuid": "fe52ed60-5cb7-4cab-aa8a-9a3e9dfbbab8", "comment": "Malware payload", "value": "64027f401168da376f602b30a4f5135e7b738d71fa06123a53b95273b90c294b", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708224, "uuid": "abb2a967-544a-4c96-b2a2-e8a324219123", "comment": "Malware payload", "value": "666bdfad726b6f9781f431da9c4443aafd16f252", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708224, "uuid": "5b6609d1-9dc6-40f6-a433-26d0b0eaa17f", "comment": "Malware payload", "value": "14eb3444c2f97b66747f4448e7d3f4912a1c3deb5a4abec973f346d774fe22dba177b7e9e35b4d83e822bce028b5160e", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708224, "uuid": "af6256f7-ca68-4024-ad3c-1e6d2b8c35fe", "value": "T100C533119AD017C8E594CE2F2F9C993A043FDFCA78A4EDD391E28BF1110FE96A566470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708224, "uuid": "ac81b9e8-d565-4d3e-81f1-a4f6c5d368a7", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQb:G1wwAjzIQOMK2GNKslgus109", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708224, "uuid": "965200bf-1389-4099-965e-647b83e2914a", "value": 2654208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708224, "uuid": "6c2fd553-ca5c-4e10-971c-4b7d559c9f8a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708224, "uuid": "0336220e-fe51-4628-8ccd-6c40dae5869f", "value": "64027f401168da376f602b30a4f5135e7b738d71fa06123a53b95273b90c294b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29effde8-55a2-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1638691551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691551, "uuid": "f3c6ad35-5ddf-46f0-ac61-70c6291e9dc7", "comment": "Malware payload (AsyncRAT)", "value": "341decc2359bf9368c9b0050f432d82e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691551, "uuid": "6f50c48f-c26a-4677-adb2-4520b7b285d9", "comment": "Malware payload (AsyncRAT)", "value": "65f160a3b24884916cc9da0f59ca25ef842349249f39479f512f3f798e1d7ce2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691551, "uuid": "1e3c889f-ed0c-4285-8573-8eee169f17c6", "comment": "Malware payload (AsyncRAT)", "value": "4479cc11ba026511007b6549f3034df46177e9f6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691551, "uuid": "3f67d632-eebe-4374-a889-537c8f55783b", "comment": "Malware payload (AsyncRAT)", "value": "ad704982253672af0de8bdf96b58cc6b115583ff6c76c00cd8b15a516834b46ec7508ee3c76d5d4d63d55858cc147ef0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691551, "uuid": "3d8ceb6c-64dc-4028-8856-f6000b16c6a1", "value": "T1BC21663EC39B45F70B94A1A522D09F2480B4B6A6C0DDAD5031B2CFEA61EE1EC45B911C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691551, "uuid": "e2093a27-158b-4906-8eb6-64181f5fea41", "value": "24:UkTTTTTTTTTjuA39enLHITP9yr7Shw1G2heiz9VZzgR/5ngBBSw1GbesaO:UkTTTTTTTTTjuS9eLHk0vShw1G2heizo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638691551, "uuid": "fda1ff64-3fb1-49fa-a8b8-d4d3065746f6", "value": 1325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638691551, "uuid": "6f8aeb6a-1f23-4811-b0b8-5fe05cce9db4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691551, "uuid": "a0bb5620-96f5-4202-a616-c9d78fb016d9", "value": "HCLGT440605.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848746f8-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638722627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722627, "uuid": "fd6d20f5-252c-4a89-b4f7-396f48faee6d", "comment": "Malware payload (Mirai)", "value": "81cf33f3aa852aee331c47deb8924b05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722627, "uuid": "a170cdcb-ecee-4aff-8b9c-bb551eac13ee", "comment": "Malware payload (Mirai)", "value": "65f45206a3124969e4a399de86862ffed4d8ed4092f20c97c672497e571fdee1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722627, "uuid": "cb3ca8e6-7b21-4461-a197-44a9cb8fb706", "comment": "Malware payload (Mirai)", "value": "01fd9a62b81908a75365e7b8fe04e4792f2c4f2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722627, "uuid": "bb433d10-d5a1-487b-87b4-ff3949d263be", "comment": "Malware payload (Mirai)", "value": "66daa8cc5308da995549a7b315676b63e75a9e95a6b4a4048e08acf6c8ea1989eac9faeeb9b533ea7c17bdde1c8b0c34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722627, "uuid": "7befe87e-49e2-4253-8552-d01185451936", "value": "T16CC31A05FD404B27C7E227BAF79E438D773666586BD333115A296EB02FC1B982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722627, "uuid": "fc5e7776-0cc9-43c1-ae86-153958368685", "value": "3072:SJDZ+6lJQTnoo3DKOzmGfcX5i5hLuVu+6+1AzfqojwQQRh6RYAvZR:RmGa5i5hLuVucojwQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722627, "uuid": "c4544b79-d1f7-46cb-9069-954b044d1be4", "value": 128317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722627, "uuid": "fbdb9342-ed18-4f6b-8379-f82a0a80efab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722627, "uuid": "f176db67-1478-48f2-8d9c-84f8e6a5bad2", "value": "81cf33f3aa852aee331c47deb8924b05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f633038a-559f-11ec-96a4-42010a9c0029", "comment": "Malware payload (ServHelper)", "timestamp": 1638690606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690606, "uuid": "06ae3b9c-1536-4a31-88cc-f7b8a525cae7", "comment": "Malware payload (ServHelper)", "value": "f616975d69da372f403d58ba955dc510", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690606, "uuid": "7c4d8d59-f630-444a-8b69-2959f11d424a", "comment": "Malware payload (ServHelper)", "value": "65f47cd450bd96cba40e838cb0355638a1d43b3ac51d3d6e97a469d5425a7874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690606, "uuid": "7d381008-4e02-42a4-b58e-146dafb64be7", "comment": "Malware payload (ServHelper)", "value": "e22fcb3ec811cba8d74d4f897d495f21e8c88224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690606, "uuid": "28b3910a-681a-46cd-8ae7-ff8ecb7a185b", "comment": "Malware payload (ServHelper)", "value": "e9faddd9b608ba57acaefeef5c278bdaff332b644b1f676c4246eb2c75e2ea29942ddc7ea5651b6289ab38658491c633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690606, "uuid": "8304f6c2-2143-407e-b283-47c75519e1b3", "value": "T16126D083BC9464B5C9A9C232C9B592913631B4590B31E7C72F51A6BF2F737D41E383A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690606, "uuid": "05992311-3307-4422-a9d9-3c2542da3cb5", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690606, "uuid": "390bf361-fc59-4468-9611-bbbd5a0e3d36", "value": "49152:4xvEPKDCcvh/f3rb/TevO90dL3BmAFd4A64nsfJn3QACFYAA27o8Qm8b4vdjOtZ3:avp/fFAfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690606, "uuid": "983eeab5-d194-42d6-bfd5-c12648165a13", "value": 4802560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690606, "uuid": "0b1f52fb-f93a-4847-8582-404bcdeca1af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690606, "uuid": "67459e08-aee3-4ce4-a5d6-165a1a4e4d80", "value": "f616975d69da372f403d58ba955dc510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4feafd-55ff-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638731795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638731795, "uuid": "83194329-4800-4736-bc6f-3676b2eff77c", "comment": "Malware payload (RedLineStealer)", "value": "865b408a46f4b4b1076e85a2d6762aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638731795, "uuid": "f4a8067f-be8b-4172-aac2-ec5bea8e4d18", "comment": "Malware payload (RedLineStealer)", "value": "661fb798fc83399434f9a7b8ac537ab1e0c22a1204a63e401e55c621a46bc35e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638731795, "uuid": "3c27633c-5287-4f95-873f-f5c52a4de798", "comment": "Malware payload (RedLineStealer)", "value": "fd670f3262e43f39c0220e7af4667c466d191db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638731795, "uuid": "af4f0b6d-0fde-4605-a6a0-76f86b1bca81", "comment": "Malware payload (RedLineStealer)", "value": "3a9611018925862772db6c635df6a78bc59f7b126c9e13457ecc5a9b93f2f531a0eee1576f7f4df759c6e1c3c0a7c92e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638731795, "uuid": "ec4bc573-22f2-45ac-9d3f-c164612b8ac9", "value": "T128748E107BE0C434F5B712F84ABA9779A93E7EA16B7490CF52D516EA56346E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638731795, "uuid": "276519bf-ad5b-41bb-abf5-a92cd32bd5b0", "value": "d6d623e55093a29e3463cda3fe58da3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638731795, "uuid": "f35cf317-ff38-45b8-ac58-c13b07b6d124", "value": "6144:RMwt3IS5zC3sKalS35U3riXtH/YKgr2GXBnIt4SpJQdvIMUM8TFj:RZt3DOralS35U3riXtH/YKO2GRnuTpJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638731795, "uuid": "e0d1d7d6-b6a5-4c8c-8b9d-6b3bc62fe8f4", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638731795, "uuid": "eebb08cc-965c-4ac2-878f-e0927e01700a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638731795, "uuid": "0d7849c9-8134-427e-bcc5-26f00a1552c9", "value": "865b408a46f4b4b1076e85a2d6762aaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb2cfe0-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (GlobeImposter)", "timestamp": 1638693729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693729, "uuid": "06f72733-210f-4a83-a351-22bc1c7b10c6", "comment": "Malware payload (GlobeImposter)", "value": "160e7dec4af3bb447093f15c275c04a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobeImposter", "colour": "#499572", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693729, "uuid": "c4576ea7-b72d-4f17-968b-6f43584d5dd7", "comment": "Malware payload (GlobeImposter)", "value": "6884fa613525c3d557cffef160c272b7479656b6d34ef00a527504758274ccaa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobeImposter", "colour": "#499572", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693729, "uuid": "01944efb-d87f-4e29-ab6f-dfafebbc3f4e", "comment": "Malware payload (GlobeImposter)", "value": "dcd81053eedef3cddeae6a356336483eb4e53b7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobeImposter", "colour": "#499572", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693729, "uuid": "368cb692-29dd-4788-982b-ed726883751f", "comment": "Malware payload (GlobeImposter)", "value": "7184217e96601ffa817279c7c3819022378cac5cc5e5287a9596f50cb35678a7055a16f920e0c524a74b32301f9492c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobeImposter", "colour": "#499572", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693729, "uuid": "f58cd3ce-cfe7-4f44-9941-10d127fd6858", "value": "T1D6C5E329418523BFA1469DF49F43F67AA7D193025EB2E639A13F042D83ED318FD48AD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693729, "uuid": "f825b83e-1510-43bc-ba05-71cedefe44b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693729, "uuid": "80f35bf3-336e-408d-8ac8-fcca4148ee5a", "value": "12288:Afp75LbLlJNIyR+Z+KZOnORYn8xSi4z7oxSzRLNbYkZf8lCHmvIw47Aqg+PecV9b:Wf8M8ug+JXLUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693729, "uuid": "4f208cd5-040e-451d-a322-b8fc3618808e", "value": 2661376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693729, "uuid": "5fd52805-9891-4d63-83b7-e1d57129bd6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693729, "uuid": "e717cb89-356d-4b2f-ad79-15700125a9a9", "value": "160e7dec4af3bb447093f15c275c04a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8441f73d-55e0-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638718332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638718332, "uuid": "8b07ccb1-c2b8-4621-afd6-f6255d3a57c2", "comment": "Malware payload (RedLineStealer)", "value": "f5c7d6578b40ff6d29756d780f5f7037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638718332, "uuid": "e4d9fb91-6622-469a-9f35-4f9c3edd224d", "comment": "Malware payload (RedLineStealer)", "value": "6904e92f5db2815659c771bd08ea0b40a339eb6ef88a1bb743cce63df44207ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638718332, "uuid": "18b5a66f-456f-481a-b16e-81072a90976e", "comment": "Malware payload (RedLineStealer)", "value": "cf2c39cad82665bc001f6e82f62464bbee9a4725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638718332, "uuid": "dd06d3f6-d226-4cf7-90bb-b6e512433da3", "comment": "Malware payload (RedLineStealer)", "value": "221176f0bdf693a8a97d482583ecf9561350d94259c6674632d823463a2538cfadf6f2e351794dadbfb823c5fcf7a9f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638718332, "uuid": "ce587335-ce32-41c5-b567-d701eec45190", "value": "T1094533959BA593C8E15F01F1CFF5BA2C8A0676067EE16070FAD1310BC626593E20EE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638718332, "uuid": "cb5eba31-68af-4476-a926-eb33c4800cf3", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638718332, "uuid": "c773610c-907f-49db-b6f1-ea0ec91ca2cd", "value": "24576:C7EofgHwdp/OAJMmvghDwkk6BDBVk7obeVS9tE8ltrf:C7EYgH+p2jmeDwkdBNVk7GEcNzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638718332, "uuid": "03abe88e-9f5c-4a2e-a831-d101acd5579f", "value": 1192960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638718332, "uuid": "ffc1fe59-48dd-41c0-90cc-849707024468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638718332, "uuid": "1ba07880-c518-4a75-912d-cdb3c91e3bc4", "value": "f5c7d6578b40ff6d29756d780f5f7037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcee5330-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708226, "uuid": "c5c39564-27ad-4daa-9b35-d7eca765651b", "comment": "Malware payload", "value": "7852972ce6c5a917c901e9560e53476f", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708226, "uuid": "ee853554-7baf-46b6-89b7-7bbbd9439e22", "comment": "Malware payload", "value": "69369b60e936d32a19090c9ba504638c5068965ebde7a85bd26bbcf980af99eb", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708226, "uuid": "eab3eb63-4a5d-4b69-91cc-97c6782b55f7", "comment": "Malware payload", "value": "54c892248ed7ff8f776cb5777cd19a284b44833e", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708226, "uuid": "a3476845-9c4e-4aa3-ae5a-96c78fb065c1", "comment": "Malware payload", "value": "3314f579100330a129a01c4bc37f092d49fc897562be406c8d7aac33f2c3e366ce950ddb56e5d9ea51292537bc5a69cc", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708226, "uuid": "645e1b09-2da6-44ff-bfc7-08a8daa81d50", "value": "T16DD5331099D116C8F298CE2F1B9C9536107FFFDA78A8ADE7C2D28BF1000FA819972574", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708226, "uuid": "cf6a77b4-4dfa-4502-b572-8750ac22bd1a", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqE9U:G1wwAjzIQOMK2GNKslgus10Yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708226, "uuid": "6d7cfca7-1a3c-48c3-898e-c6bcde4ead24", "value": 2965504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708226, "uuid": "0185a273-9c34-4359-a0da-a436e59915b2", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708226, "uuid": "a6217719-ff5b-4f0f-899e-3d11daa55ff2", "value": "69369b60e936d32a19090c9ba504638c5068965ebde7a85bd26bbcf980af99eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feef5b9c-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708230, "uuid": "3a7851ec-236d-4ae6-af22-3e9285490e71", "comment": "Malware payload", "value": "5073cd791ee8741d707db7965f5667c3", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708230, "uuid": "ce2cc451-5406-4603-99f3-673281078491", "comment": "Malware payload", "value": "6a22d050d487ef64245e3cc37ae0b82d1af58fb5644c451de3ed7ec52cd93414", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708230, "uuid": "36bc1d80-23ee-45d1-9f8e-1dc4500f0fd6", "comment": "Malware payload", "value": "a662384f42f2fbc2863580614187c7d27dc58fb9", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708230, "uuid": "23fb48b7-f6a4-4b57-9811-6fc4f95ceca7", "comment": "Malware payload", "value": "518a0aaba334e89ff0548771375a21dd41a85ff67ace93ab364265ef551c17eaa5b07a60548b7a3e8191457b1da404c9", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708230, "uuid": "e1a0d7d7-fe78-4f96-b649-fcb86eb939d5", "value": "T16FD533109AD116C9F598CF2F1FDCA936147FEFCA78A4ADD792928BF1000FE85A562470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708230, "uuid": "9ba5887f-8a9c-464a-8535-cc9e88fdb866", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQv+:G1wwAjzIQOMK2GNKslgus10A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708230, "uuid": "54244e85-4f43-4e8f-8f59-1752498b5699", "value": 2781184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708230, "uuid": "683a178a-f69d-476d-9e0e-95ad34b59d86", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708230, "uuid": "0ced8f56-7c11-4634-9792-d900b39baded", "value": "6a22d050d487ef64245e3cc37ae0b82d1af58fb5644c451de3ed7ec52cd93414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478f56bb-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638693749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693749, "uuid": "ce38044b-a6ba-4469-89d2-fa11e2e934e6", "comment": "Malware payload (Mirai)", "value": "39030eac67841e11e8b320607e5a6098", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693749, "uuid": "307d4e2a-856f-4cf0-b2e9-a7f7c13827f1", "comment": "Malware payload (Mirai)", "value": "6b639dcec2040548e70afee6bfa810bb16ec59010eb525c413974eee96371f0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693749, "uuid": "795ea904-b721-497f-b715-26997948dbb1", "comment": "Malware payload (Mirai)", "value": "886731d69c056b9774bafbb856a9d02d58dde4b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693749, "uuid": "5f9b37b6-b010-4550-938f-5a26127cc43f", "comment": "Malware payload (Mirai)", "value": "dfbd57d396556101944b3c46a5274c64227f5151b50f0efe0d34583a561a0817893a9393c9e2e6fc69e749f4622e3f99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693749, "uuid": "ef531d22-5c3b-44a9-84c9-f732564e451b", "value": "T184E2E13CD4D91891E2F7BDBB3CC292D06BB02B3A263ED361151A5B32057B4796A50ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693749, "uuid": "e4077d63-d64a-419e-9ec2-33ad7457bd7e", "value": "768:SCyzsyO3npjYWfJsOTjwciOHCsPcYaNgNcoEwF7GX4uVcqgw0RNWXXP:SHlLWB1McPPPvvF7u4u+qgw0bWX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693749, "uuid": "499f470f-902d-47ff-b365-704d5430ddb9", "value": 32084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693749, "uuid": "714e25b9-a6c6-4834-b590-6dc146680069", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693749, "uuid": "5e397375-8d17-4c31-b5ca-aece7758d91d", "value": "39030eac67841e11e8b320607e5a6098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0016fd0c-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708231, "uuid": "abf83f5f-193c-4c94-81d4-b33b8f94becb", "comment": "Malware payload", "value": "c1e304eaf260ac06b24c0d8f4ad3d485", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708231, "uuid": "1cc322bb-5bf9-46d5-bdc8-18cc0920405d", "comment": "Malware payload", "value": "6f9931c026dbf657f5e9272e5bf106f3b19ac7bb52d839d4f37504b6061c2e48", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708231, "uuid": "8f525311-4954-4ce9-8859-9e389fb23857", "comment": "Malware payload", "value": "ef39d2971b0c95edaaba86ebc95e02a467cc99f7", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708231, "uuid": "7ef3d176-74ac-4a51-96dd-b3a10fdc2bc9", "comment": "Malware payload", "value": "ecab33eb1728abdbe0fd21449dd89969532ff46205a3bcf173714ec51becbcdfa1b87889bc463cfb1cc93f22f57cf9f5", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708231, "uuid": "c683b52e-48df-4aab-8bfd-0df1af4e8969", "value": "T1BBC533106AD117C9E554CE2B2FCC9D36047BDFCA7864EDD782E38AF1100EED5AA62874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708231, "uuid": "b616d378-2386-45c7-b212-aa55d361943d", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXw:G1wwAjzIQOMK2GNKslgus1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708231, "uuid": "62e37db4-ef4e-4c36-995a-0fb94a0d6502", "value": 2498560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708231, "uuid": "4b314493-5ee4-45d5-b37f-6a69c47f8852", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708231, "uuid": "65dbbb18-6b31-46d4-85e5-e7093f76636a", "value": "6f9931c026dbf657f5e9272e5bf106f3b19ac7bb52d839d4f37504b6061c2e48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022cf431-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708235, "uuid": "f35cb7e2-0ff1-447a-8f24-57bf59530a8b", "comment": "Malware payload", "value": "2e7b4a83d9002a0b0383909e5413fc79", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708235, "uuid": "01dd2a3a-aa0c-41b8-94be-81977d446535", "comment": "Malware payload", "value": "71a3d4f147ca4ae2e5a814eeb6c9e29559f4266355aaf2c4890949dee1986302", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708235, "uuid": "e02a41da-dc3d-447b-9008-e4380e4aa51b", "comment": "Malware payload", "value": "7166852b1da4a76a0ab0c39c50b70a69ec6ab484", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708235, "uuid": "1c23be19-3562-4a88-9b7a-8cd6aef7d260", "comment": "Malware payload", "value": "e6e67fcf094413460ef0ff3aa2eec32ca1dac7388694ec59e0f17b6c48cc88f01d850c2b263a7100d2596a5ce71453b7", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708235, "uuid": "84265c49-ece3-4870-853e-00203bf0ff20", "value": "T1CCC533119AD017C8E594CF2F2F9C993A047FDFCA78A4EDD391E28BE1110FE96A562470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708235, "uuid": "3bfb1523-8e7e-4963-9a34-cde03e5cbba6", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQa:G1wwAjzIQOMK2GNKslgus100", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708235, "uuid": "27ce0ae8-9854-4cae-a229-c58ca15fdec2", "value": 2666496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708235, "uuid": "f62d679e-cd8e-44b8-b05b-ee11df7f3197", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708235, "uuid": "0e37ee93-7d77-421e-9dc1-68815e1a0112", "value": "71a3d4f147ca4ae2e5a814eeb6c9e29559f4266355aaf2c4890949dee1986302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a503c221-559c-11ec-96a4-42010a9c0029", "comment": "Malware payload (DarkComet)", "timestamp": 1638689181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689181, "uuid": "6b98949f-0412-4ec9-8626-8544206a814a", "comment": "Malware payload (DarkComet)", "value": "a72f3d7698f6126013cff4e4ad1fb808", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689181, "uuid": "fbb345c9-689d-4183-8d72-48c16eea5373", "comment": "Malware payload (DarkComet)", "value": "71ae3e49cd3e22ac2de6cc53dd6b662d8f65d8f4d9f4e882e1b88d3cff18e18c", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689181, "uuid": "24dda6a1-a6b9-4431-aafa-82c6c90399d6", "comment": "Malware payload (DarkComet)", "value": "cd44ae59eb8ae4111c53e8b4a3da5e7ba1af48bb", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689181, "uuid": "f9088d9c-1ddd-4475-b51b-5716548557fc", "comment": "Malware payload (DarkComet)", "value": "e85ec314ab5e67acb918cc0edb6e7b3774d02899ec3a785025fe9bf1fd60a6ca3368b2b70e45f38725828999b1b4c70c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689181, "uuid": "e7962a83-1f22-465b-b8b0-6442ae32e6b1", "value": "T19A85693C29BD222BD2B9C7B9CBE59867F05499AF3110AD6458D3576A4B13E4234C323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689181, "uuid": "211ae2c7-0d3e-43e0-bd8c-b7d871e16ded", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689181, "uuid": "a343af53-d67f-4613-bfa2-d310fcdc373b", "value": "24576:olsWIgramvBeIc9QMpLdYBkyrMaRCFlOCKyslGEXrqKP1kVWV/Nm/y12NhmY:opImamkI1Mp5SryvnHgrFQyYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638689181, "uuid": "1957bc28-f230-4b4a-a2b2-8174149560db", "value": 1833984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638689181, "uuid": "3cf05383-1b23-48dc-9de8-94813d8bdebf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689181, "uuid": "54383b18-3f02-47d4-bf0d-75acb4f81d0c", "value": "a72f3d7698f6126013cff4e4ad1fb808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effe31dd-560c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638737410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737410, "uuid": "e6223fe6-b0c5-4933-9763-3a003a8e0d25", "comment": "Malware payload (Mirai)", "value": "c9a4343681d87edb7d675e9de1e1fbe1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737410, "uuid": "09220455-6274-4888-b83a-ee8598972f66", "comment": "Malware payload (Mirai)", "value": "726208e68170a31ddd41d4dc18e5bdf652535aefb108dad0c964390b1c7b667c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737410, "uuid": "adaf4be1-04cf-4cfe-a0ed-6360700ad30e", "comment": "Malware payload (Mirai)", "value": "e15319fb7a45beabe6612a93a2b67c320cbb25b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737410, "uuid": "b8cfd6dd-f5cb-4c97-ba35-530080de22e1", "comment": "Malware payload (Mirai)", "value": "6928603bf02ceadc0b0af674f50d4198f639fbde6f7eb19bb2eb15291ff10588eea0618c2a947f8b5b9e687508dc7a6f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737410, "uuid": "3a849bb4-924e-46a5-aef3-4e579dacc222", "value": "T141D2E1B4968638B2C1B00131FADC97EB42572D74D0FF72A37620247679F72893AE05E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737410, "uuid": "973014a5-9012-4cb9-905e-477eec4ca9d4", "value": "768:BA4uBc0T/nVvqV072G+IFYoXHZCx3GKqKs3UozJ:BPuB7/nVMYn+Kf5AQzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638737410, "uuid": "cef78333-9b94-474c-94c5-5b7ced7d61e4", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638737410, "uuid": "e21153d4-444b-407d-9d86-20445287e545", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737410, "uuid": "ca4653d0-33da-4f5d-bade-aa400c950851", "value": "xd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073e4183-55a0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638690634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690634, "uuid": "77eb8d73-5024-49e1-8481-82d503661b14", "comment": "Malware payload (Mirai)", "value": "145b3fbf4d3cddbb193adb072ba9efc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690634, "uuid": "eabf1d74-0fa1-43ba-846e-6834bc010736", "comment": "Malware payload (Mirai)", "value": "7275e3dd942d19b4fe82344ceb53efb27ccb1f5371e507e2a25e445f33a9f669", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690634, "uuid": "a4d8be6a-48c4-4734-aec5-7bc7f46f2692", "comment": "Malware payload (Mirai)", "value": "d958431cb8999868a45ef079a8a12418d56a8b4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690634, "uuid": "2aeed638-e86c-41d7-83af-e951eced9c50", "comment": "Malware payload (Mirai)", "value": "5db12875830642d9a4dad69a6807df6fee66a77da5833bd8e432c86a730995a665ffdb5ae46a63486d2b1a4081e92a5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690634, "uuid": "1e7e6f17-ad45-492c-b2f3-7e101d56d39d", "value": "T1A2734BD5B4019E7CF94BEAB741270A09B920A3454F930F27F367FCD76CB21949A16C86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690634, "uuid": "660bf7af-74e8-4db4-b7a0-0102cc0d8e16", "value": "1536:bx5yih06LguTkiX7H8gggqkITwQVibYhfY8o303:F8NgzoIYBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690634, "uuid": "9499006f-8f1e-4c6a-bba9-bb8dd61596cc", "value": 73844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690634, "uuid": "6b1d80fc-4ac8-4565-a2c2-104182be7364", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690634, "uuid": "ed4938e7-505a-4723-9515-58730f3ee573", "value": "145b3fbf4d3cddbb193adb072ba9efc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e935db-558c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638682097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638682097, "uuid": "a283ebb3-1ee5-4e39-8cb0-bac5c9feaefd", "comment": "Malware payload (Heodo)", "value": "04178230d6af661b8c8e3c96a2c6e832", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638682097, "uuid": "5f267130-887e-4572-91be-618f7bf77704", "comment": "Malware payload (Heodo)", "value": "738af2b060c9449a5727a094a87d6ea5b4277dc05c1776c6d63964caa1db9202", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638682097, "uuid": "b367c8f2-2c2f-4bd4-a51e-b8a9fcd95537", "comment": "Malware payload (Heodo)", "value": "6cb284d30add383883e080af2826b2782623862a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638682097, "uuid": "9b898dd9-7ac4-42f8-ab5e-66e94c7f09d7", "comment": "Malware payload (Heodo)", "value": "5ccfa0ef8b9e6062bfff050eeeb7e52712b327cb3b2ee340bc127b2ca47c89d16475ec98125841da6de16bc3dd5fa28a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638682097, "uuid": "2910e2ed-28c9-4b56-9825-ab149121d7cb", "value": "T125358D00A6809137F4E710B581FB97B45A7C6E30236492DB57C46AEDAF316D4BE31B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638682097, "uuid": "855c68c0-30ed-4f4a-8c67-6aef82fbb755", "value": "5607b60d2043ceb44befd6bbf5fa6d91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638682097, "uuid": "1877520b-183e-43aa-8e3c-50f90f54b8d3", "value": "24576:ygM4dPmrYDJTfzafe47o4GbOXEgDh/+cNeTpO:ySTT7z4QmmcNeTpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638682097, "uuid": "f0fbcc06-b040-4fee-b8ca-2983a5f8846a", "value": 1135104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638682097, "uuid": "4daf2a8c-b10c-42dd-876c-25b113bf61ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638682097, "uuid": "f8404375-ca75-402a-86ce-0464daee5294", "value": "emotet_exe_e4_738af2b060c9449a5727a094a87d6ea5b4277dc05c1776c6d63964caa1db9202_2021-12-05__052811.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fac019-5610-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638739056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739056, "uuid": "efeadf46-88c0-4248-a2af-6eca814e771a", "comment": "Malware payload", "value": "62b1b6abe1468dd8ac8915e6a8ff7018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739056, "uuid": "e719e4ce-fd48-4b2c-bc01-efb4f89eef46", "comment": "Malware payload", "value": "7463e42c277c26f4d3b9e34ffe0cf3bf866df5238eb4c4ce0da2b719f6501255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739056, "uuid": "be6b0c7a-99fa-4ad6-91f5-ab407feba349", "comment": "Malware payload", "value": "9725183f3722d1255369e7555920d50b6d1ef34e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638739056, "uuid": "9e99399c-cb29-45e4-86c1-630b53c6258b", "comment": "Malware payload", "value": "bea6927c3bd9d0d536850333e0716b986b5f3ed75cef4b811d8f8ebb1e62d5ed8c2666605eb6b66213bea4014fc5923a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739056, "uuid": "bf418adc-09ac-42f6-94e4-7afeab9d6e2d", "value": "T1ECA32A6437CC9A14E6FF0FB078B0211443F0E5A36412E75F5DC554EA2E66B81BA26AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739056, "uuid": "1d89cdab-e098-407b-85de-d3832284e6ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739056, "uuid": "d082a418-09b2-40d3-9c97-8bfaa24c4700", "value": "3072:/D6jD4w3MReYJUuzsDqUgZk40f3t4I9vg1M:M4sMReYJUiYe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638739056, "uuid": "ad68adc1-8645-40cd-9c48-59272198412a", "value": 106720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638739056, "uuid": "aa1833d2-3923-463d-b200-d4c7ec8ca94a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638739056, "uuid": "306ffdab-c2c4-4658-9729-bc00700d1433", "value": "FortMod 6.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1124f9a7-55cf-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638710837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638710837, "uuid": "2b199770-4e6b-4e68-8da6-8879e1b0ba02", "comment": "Malware payload (DCRat)", "value": "d6c2a7fe705e1303325b13c51d244914", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638710837, "uuid": "da043efe-31db-41d7-ba46-3727fc912516", "comment": "Malware payload (DCRat)", "value": "74ad99457bbabe425e8cf39918b9918d7191e609ce25e48aab61fb0186888d49", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638710837, "uuid": "08402639-fd73-4c58-a8ac-d139a8ba6091", "comment": "Malware payload (DCRat)", "value": "c72312693b7df014fb52f3406c37a7abc7d8721b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638710837, "uuid": "b68d5ba6-8d58-4fe1-97b0-1e247ad6e053", "comment": "Malware payload (DCRat)", "value": "44ba200b3c19e7274721266b37d1c933e193b8c9cb2362797bfcec3ccad53c620810d4fc66505369512ac5a1d0464627", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638710837, "uuid": "64ee755a-3824-479a-a997-dc1e0842da1d", "value": "T1B14527023E46DD03D0692777C9EF446807B8AD007B66CB1A7EDB33AD65967A70D0E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638710837, "uuid": "6a262643-7bcf-4d2f-ae3e-1abb690e5dec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638710837, "uuid": "f9c92dbc-30ca-470b-84aa-5dc759e7713c", "value": "12288:sbRqWCo7CGOjfZIlBVXlzWSI7Ay0gCvJaqky8Uv1z9048BbyOapBTaybgQqn4:oLthGkVkQ/HaVS1z2TBbG/Tayj+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638710837, "uuid": "de31a444-43c8-4eb9-9290-0f297595b3c6", "value": 1221632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638710837, "uuid": "0a875af4-e095-4681-8d2a-e9749a314cfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638710837, "uuid": "ce035c95-f910-4f51-ae37-af12aded0c8a", "value": "74AD99457BBABE425E8CF39918B9918D7191E609CE25E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2a5176-559b-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638688847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688847, "uuid": "7f9d27e3-617d-44aa-8a9f-b1dd89a82ab6", "comment": "Malware payload (DCRat)", "value": "f5505eb7c39ad86f08d792639777e52e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688847, "uuid": "a6b31c6d-ba74-472a-8037-5b3840cc0b17", "comment": "Malware payload (DCRat)", "value": "758c13d826f252d3bf62db08900519f34bca0ffebf4c8ef0d86a1f624e967021", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688847, "uuid": "3715c4b0-d084-4dd8-bf9b-6627850d0b06", "comment": "Malware payload (DCRat)", "value": "dc33ae95ffc6019a9fb2a08fb95293a29ecf2465", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688847, "uuid": "40a0ea78-914a-468d-ab0f-18bd5e259de7", "comment": "Malware payload (DCRat)", "value": "51b929749720dbc9b9cadfb93d959852f031bc1020e2ebf927f38dc388e154ab817e595e7b200d7bf95590a123a057e3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688847, "uuid": "58f6b1a9-4dc0-4a08-bfc7-a4028e7c125f", "value": "T15B54AD1132E0C033D59725768525CBB58EBBB4312A266ACBBFD40ABD9F247D1A73530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688847, "uuid": "7fab934d-2fb4-4336-bdac-f316da50722d", "value": "b776dbe5b4a858696713fd07b4876aba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688847, "uuid": "af4fd76c-f56a-4d4e-8971-d78448cfd780", "value": "3072:++O/ifz6+kxG/ALYxGiZ8t6GJi/PdgcEkSjrC3MB/UoWrO1Oexc1pvQQMaN56XG/:3HfvkuAsZqa6xfa3MhTAexWpvfMf2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638688847, "uuid": "2b391d65-930b-4eee-9e94-3b2bebf44ef4", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638688847, "uuid": "155f6a17-4316-4612-96fb-8655eabe45ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688847, "uuid": "08f80961-b3d1-4cb9-b5e7-05d2d57d991b", "value": "f5505eb7c39ad86f08d792639777e52e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0411097a-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708238, "uuid": "fdda44bc-a737-4d00-b62d-6e4e528e2818", "comment": "Malware payload", "value": "cacb3bf29c6233e7e19399ad1c4e1480", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708238, "uuid": "9e5e60c3-02ad-4797-a668-bbfbce0a281c", "comment": "Malware payload", "value": "766ef5f93ab1fcdbe038681226c960e8f993a73abe0b692ecbbd5ff1bd3b543d", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708238, "uuid": "c2f04065-eb63-440c-9a4d-831e0eae4274", "comment": "Malware payload", "value": "5d81d440fbe4eef719aaadbb0f28cb734c098507", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708238, "uuid": "029a5be0-9fbe-4e8b-b264-dd398027edbd", "comment": "Malware payload", "value": "5bbe9ae149e7fd4d2e6be5732149b94976367d62cc30480feca5c79a95faa0ab045ef36638a70d4ea84f58135c703140", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708238, "uuid": "08a7c411-78f7-454b-a1a1-191d4f5e6641", "value": "T15ED533109AD116C8F598CF2F1FDC9936143FEFCA78A4ADD792928BF1110FE85A962470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708238, "uuid": "399a68d8-ec92-4e0d-9338-714c973d51ea", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvI:G1wwAjzIQOMK2GNKslgus106", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708238, "uuid": "f7a8e6d5-86d4-43b9-b2d1-ac9280b6df9b", "value": 2768896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708238, "uuid": "cb105485-6fb2-444b-9116-ac761235e633", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708238, "uuid": "d09efad3-e2a2-4339-81ee-a6a5483b3b1d", "value": "766ef5f93ab1fcdbe038681226c960e8f993a73abe0b692ecbbd5ff1bd3b543d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0f451a-5590-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638684143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684143, "uuid": "b8b17b2d-d550-4d7c-8961-ffaa87d90508", "comment": "Malware payload (RedLineStealer)", "value": "f118c5d35478b3f97a4ea01de61e4c85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684143, "uuid": "4294a013-4a7d-4683-ac70-ff603f802e5a", "comment": "Malware payload (RedLineStealer)", "value": "78bcb8651339ab0460a3c5d5dc8cc726b68b382a0f8d7df60215c99bdf102c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684143, "uuid": "df858875-3ac5-49af-abee-11309e9ad6f2", "comment": "Malware payload (RedLineStealer)", "value": "7d31dfde5dcecd20396ec1fd0d061bc63eccd23c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684143, "uuid": "51965bcf-650d-4e0b-b922-84b5493ba1a3", "comment": "Malware payload (RedLineStealer)", "value": "887400dd60652b95c7cde8eeebebd46439de8a12c5b5494ea2ea55bc67b51d10da7fd901ab55bae09a2f0b0535d8841a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684143, "uuid": "a6e0c4eb-190e-4c71-8eff-54a7e448229d", "value": "T1E344AD2132D0C032D55725768625CBB58E7BB4306A266ACFBFD81EBD9F247C1A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684143, "uuid": "57467701-9b80-4868-a219-711b4a199c6b", "value": "c5abd64536bf33cf9d17453c6dc09550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684143, "uuid": "500f514b-8503-411e-967b-6ab8cc14d8c0", "value": "3072:7yTB8F8fejmNpVsYWJZYIDx9pJi8dKgMXUaFv1gnwaj03AHYegQMwu56Tv6X:21JfBVMsIVN67v17a4D4MaTSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638684143, "uuid": "e4226acb-e763-4984-bd8c-022d599bd68a", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638684143, "uuid": "4cd9b3f8-9e36-43ef-bd41-9eda5f2eb694", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684143, "uuid": "a4401f59-c9ba-4c92-9bfb-19a7fe0a909d", "value": "f118c5d35478b3f97a4ea01de61e4c85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c693e69-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638722587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722587, "uuid": "dd6674e1-337f-4ee8-9635-cc1b3f0a074f", "comment": "Malware payload (RedLineStealer)", "value": "535662f9f112fe69fab73a5b6abaed82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722587, "uuid": "f761ea21-cb54-439d-9dec-c2de4ad4f0e9", "comment": "Malware payload (RedLineStealer)", "value": "78cbda0dabcf63ad7a7790c8b50ac6941b071d0ad07716208157373506b1348e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722587, "uuid": "13fd34a7-396e-4758-97a8-3d677715dee9", "comment": "Malware payload (RedLineStealer)", "value": "6f15761ce9d2e493106acf146a0de8e646ff1d43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722587, "uuid": "5c5fcbc1-37d0-4a7b-af3d-51ec7b47d157", "comment": "Malware payload (RedLineStealer)", "value": "8ea5aebd723779d172edc61c7f74bdd7cb52be7bca8fcc897ace889b3b6779e9263f401cf5bf814ad7fe77780e1415f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722587, "uuid": "d9873fdd-8bb7-4e7d-b005-465fdb1ca506", "value": "T16494DF2272C1C033C1A660B18D25C7B15EBAB47407666ACBBBD85FB95F743D2A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722587, "uuid": "79c44193-6163-4315-9b2d-0fc35d574054", "value": "0b870a764fe48d43832954ba0c8fd163", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722587, "uuid": "f6a94e65-d34e-48ea-9610-d4d9e1ba9ef9", "value": "6144:xbOLkN3idZRQOEVDH3J3JhOq1BPKth5UjUJq/qe+HpRGzi6qj4ZPC3:xbOL8mZRIH3ZJ06oth5pq//mpRQiBaPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722587, "uuid": "45fa9767-9548-4e17-b5dd-ab04b5747c3d", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722587, "uuid": "9eb2c974-eec7-445a-badf-aa0b9faf4066", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722587, "uuid": "bab5edeb-7856-421a-89e0-eef843246f63", "value": "535662f9f112fe69fab73a5b6abaed82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef308d4e-560c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638737409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737409, "uuid": "46228ce5-e0e7-440d-b3cc-b9618440d3c0", "comment": "Malware payload (Mirai)", "value": "b033387845342b6c2767c999c72ce969", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737409, "uuid": "ef4352df-3fd0-4fb3-9d7a-864e02606a12", "comment": "Malware payload (Mirai)", "value": "798870c2cc058fd83cfdae3c3d2543afee3085e19ce28df0a897e031bc0cb3ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737409, "uuid": "650a8209-3279-4fa1-baf1-fb079ad76021", "comment": "Malware payload (Mirai)", "value": "9814c1acf39a196f149bc692dd5ec65851a47018", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737409, "uuid": "17a45eee-5d6e-4e22-a956-5f718a738801", "comment": "Malware payload (Mirai)", "value": "cfda3a70bcdc4b3c362c743f9aea9378d08e0dc5f0cfe892aed8253ce1ffbe5df989b1db73618fae89dde97add62faef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737409, "uuid": "ac91d6c5-b485-4fa0-b28f-c910417f37cd", "value": "T10A33F155B4047561C6703637FC372193BF4A1BFED2E23837052843A4A8EA4A779F6CA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737409, "uuid": "54ec7f57-f148-42a3-bbaf-27a4035a4db2", "value": "768:xMte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrO9q3UELbOs8qMLK:xM84ISRX63dZQbS5rzZzLIVmWjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638737409, "uuid": "afc08d2f-7af8-494a-b75d-3c71438b340e", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638737409, "uuid": "3f88aa87-2cdb-40d3-9987-b773f0887167", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737409, "uuid": "decd31f1-ce7e-425a-9683-5d93e91cf9be", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035abb49-55a0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638690628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690628, "uuid": "c59dd444-0314-4a6c-80f5-8c12a5cfe88d", "comment": "Malware payload (Mirai)", "value": "69cfe6ee9ae32c29ddcb06d9b3dfae91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690628, "uuid": "cd227f16-e2de-4a82-8fea-ee144dbd0d91", "comment": "Malware payload (Mirai)", "value": "7a864558f1640868d6f9bfed4edb330ce03d1d360384e9d77d10247264460b84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690628, "uuid": "027e6cce-f53e-44b8-a167-2803b4f0bd26", "comment": "Malware payload (Mirai)", "value": "bc6b45cb76caee4207415196b9ca7a1fd162c45d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690628, "uuid": "223f03bd-916e-4c9b-918a-c165983f4fb4", "comment": "Malware payload (Mirai)", "value": "238b71e7cf2e228b732610faeb047cbe9decda0151d7c7808d4e847281fec990bd781dbfca1687fa04d94941f6bfb76e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690628, "uuid": "aecfed99-463c-4ab1-a5e8-36b29278f492", "value": "T12BB2D0607542B8F1CAF27CB6F94D8092B641AFB891E57071A54403F9DE46B0E2C783D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690628, "uuid": "d63a4f74-ae55-4d07-9fe4-528152ce8eb2", "value": "384:yIyerAjUmmi9nrAj0VWrSut3H4Gig4NJW+d2g/KKsR3ohymdGUop5h7eA:5yqAImmqr8uwXN4NJW+IgY3os3Uoz9eA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690628, "uuid": "72be9abf-1887-4a9f-8abe-286acd6efb50", "value": 24808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690628, "uuid": "524d2be4-2521-4771-a000-c541b8699662", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690628, "uuid": "119a0d3f-03bf-4470-aea6-83426a50dbd8", "value": "69cfe6ee9ae32c29ddcb06d9b3dfae91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457adf2e-559c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638689021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689021, "uuid": "0a8560da-7b34-4da8-bbd1-35fbb62b3648", "comment": "Malware payload (RaccoonStealer)", "value": "b50be5e158844383e5652d13a046c2aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689021, "uuid": "e1cbfa4b-74a5-40c8-bad1-a1f65bbacc3d", "comment": "Malware payload (RaccoonStealer)", "value": "7b0b9a47e7d16d73a905d6bf44b14bcca96748473d4da62e7a5fd2db80eec982", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689021, "uuid": "d36d85a0-8672-4be1-b9c9-e187961a55fd", "comment": "Malware payload (RaccoonStealer)", "value": "07e83dc176a271b3ea1065ade6e29b802d3ae63e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689021, "uuid": "d5df9215-39c1-47eb-abdb-c2b68593ea21", "comment": "Malware payload (RaccoonStealer)", "value": "83573bfd442b3c48482e51d365ce6b55ca98d8cabe242fab95e9aca3e10a82a4e65eee1a20c0d61240891d1adfb009df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689021, "uuid": "90ba3d25-1c48-4359-ab8f-b0fbbd3d0155", "value": "T1D1C49E6679718077F07200B0AEBCA7A1567DBCB00A624DA773C9063D4FB15D29722B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689021, "uuid": "56f6be8f-9595-4b72-87a2-3148efda22e7", "value": "f7a4afcdf813f5294fbbf20bc23d8f02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689021, "uuid": "0bb52f05-ea4e-4954-924d-f38cd9ee46b5", "value": "12288:ygk2kFdddKvOn3rn0Gq/1nmrcD94AsuxWXFeLkQJIIdSOLzjygH1:ygXidKOn3rn0R1nmrc6uxIJXOeS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638689021, "uuid": "049b5422-f898-49d4-b2ea-33d178c4e90f", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638689021, "uuid": "84670a95-db93-499f-9395-9fafb96363b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689021, "uuid": "bb1a23c7-9487-40dd-816f-b6be07b9affb", "value": "b50be5e158844383e5652d13a046c2aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76be1a5-5604-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638733853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638733853, "uuid": "8dddf097-67ba-4225-8ed3-37137c8ac174", "comment": "Malware payload", "value": "bd909027c1cb08bc109bddf89a8cfe1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638733853, "uuid": "94d1846e-e24a-49c6-aa54-665feb01455c", "comment": "Malware payload", "value": "7b78f37ade729464194676ac2d6d35d400dedf985121a1e1c61383835da2159d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638733853, "uuid": "38075d04-6573-4d5a-b834-a024bd80f899", "comment": "Malware payload", "value": "e4ff40ce30606f9f7996d7a3afe2a32faedf6379", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638733853, "uuid": "47860672-6739-4ee3-a85d-0bc4b301bd9b", "comment": "Malware payload", "value": "28557c8d67a6e27bb952dece74e7a2f970d68011b4569a1f32b075ed8632d76bf2227b3fc40d8d1600983945fbf0087c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638733853, "uuid": "17cde8eb-7e17-40bd-b480-11eb0e614420", "value": "T14E75AF29E6E29E55C256DA37942ACC7086D1D7803263E356F6F702A32E4F3B04D963C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638733853, "uuid": "e3450895-3839-4a39-8cb8-079a21bbe949", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638733853, "uuid": "8354bb52-a1b9-4694-9f8f-c77e0421e7f2", "value": "24576:dJDbOOcTef0u0Lne8egiVrq3W5/+rTQz9oLIbh:dJDbkM0uwFegHQ6m9oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638733853, "uuid": "e82b427f-7171-40b6-a42d-9a42defeb350", "value": 1629912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638733853, "uuid": "bf47287e-f39e-434b-82bd-f6610515bfcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638733853, "uuid": "99afb686-6c08-43e4-bbc2-154704615c23", "value": "bd909027c1cb08bc109bddf89a8cfe1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687f1846-55e6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638720862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720862, "uuid": "6404fd7c-4b46-426a-a155-097a14e880b4", "comment": "Malware payload", "value": "e3dff209b4f56d09b8510986f57d699d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720862, "uuid": "51bfecb6-f3c7-4cbf-a1f1-2fae62d84ba0", "comment": "Malware payload", "value": "7c047beda329621bf736ffdf4aec67f2b6a39a9e8fad54a07a3faa54acfc8c02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720862, "uuid": "e841081f-47da-41f4-b878-f4053ee86148", "comment": "Malware payload", "value": "03c0f16dd99fc29a138485728bac6d07e60163e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720862, "uuid": "6c94203e-c17f-4776-a8a4-0bb3c13d15f5", "comment": "Malware payload", "value": "c5a2b6a89cf47d3896a7c0176648d8331806d7cda2c9d9af8158377149c7984f458e324d82464ec1da72a34d48a9b4ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720862, "uuid": "e964ed0a-7691-471c-980a-869a2e964ecf", "value": "T1C195AED73640882DEB2A4FB8A1D8C28AF2355D092C3553ED6FBD7D62A6B155C8CCE05C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720862, "uuid": "98f30364-eca5-4a4b-8598-47aef73c9845", "value": "24576:DIqz4Ra7L9zev8fg+Cv3KHLubmM7arCPLzIsWXppB1SfTXeyzM0Pw36ZhGkEaHNP:EqNev8S32M/Y591yTbo0Pw36ZENaj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638720862, "uuid": "418927a5-4e5d-4c7c-950a-7433daa5fb2d", "value": 1917440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638720862, "uuid": "f1677fe7-1608-4a31-8ad9-6bd7d50a661c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720862, "uuid": "6547aa80-b010-4e36-a2ee-d47a5c186701", "value": "AmiraHack[Cracked].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6404299-559f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638690606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690606, "uuid": "cdbbd219-9a2f-4df0-864e-49e2b159d355", "comment": "Malware payload (Mirai)", "value": "f77fcd53c530b2d7bf66aae3a4f64079", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690606, "uuid": "dfad3a47-5f32-414d-847b-dc7b333ae352", "comment": "Malware payload (Mirai)", "value": "7ca71e5410421d6ebc29a1795d470bf410aafd0846d189ab02bffc691d0f28f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690606, "uuid": "dfde41f8-287d-427f-a456-62e479f3c22c", "comment": "Malware payload (Mirai)", "value": "8fca886128502561e3e1f8cc09dac699934ebe26", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690606, "uuid": "ff32388c-6023-409b-bdcb-ca1b909e10c9", "comment": "Malware payload (Mirai)", "value": "66ea4cb66aac1b847a5ca14c2cf1d95c2449408a17c1221b442ef4768bef251dcb1fd0875378bf967ad17e9d5ed5694f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690606, "uuid": "109d8e2b-66b2-447a-bc18-09e7fefec9e4", "value": "T1A1E2E1F8DEDB4615EC3D94B563E6968022F43808DD159301BEF91C2117FBB60A36C2D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690606, "uuid": "8cd94226-96c3-4e66-9183-7857fe8dd0c2", "value": "768:d8fRsMv2XbC07hFF7oVo4aK8xty0A07mNjEc19ToKc:dgS2gnNFFL4aK8xrA0UEMMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690606, "uuid": "d525cb47-a7b4-443a-b3a3-bf72112871d3", "value": 31212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690606, "uuid": "7b8c0bd2-3759-4bb4-a20f-c959ed3c1d91", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690606, "uuid": "cb0f2e88-309d-4144-ab70-e7d3e793731c", "value": "911.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d1977d-55e4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638720005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720005, "uuid": "56289da0-bd9a-4451-8d1e-9b0c8e82b052", "comment": "Malware payload (Mirai)", "value": "0e13c2fd37649b149911d1aa54a8eabb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720005, "uuid": "3470eb55-661f-45e8-83a4-a42098131469", "comment": "Malware payload (Mirai)", "value": "7d5361d6e90c411019da670f96d0a0e2758051035edd720e2d092f6b21f2c2b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720005, "uuid": "951460a7-1c35-472a-a93e-5a7b76d76f2d", "comment": "Malware payload (Mirai)", "value": "6cfaa3124dfcad8983af9290e1ae4b09e434d71b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720005, "uuid": "38e15277-8b7e-4716-9ba5-09edc80b5390", "comment": "Malware payload (Mirai)", "value": "bacc2175322c9a7d6e5998c7c56be35e7a34490ce69cb3996415d1d4529c133825e4ce29e6933c1ce9640b8b41a1f3e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720005, "uuid": "27f480a2-4900-49ca-94e2-172b5eb771e5", "value": "T135435A43518100FDC8DED6F856CF6919E823F43823B3B559B3C4BA1A7A5DE902F99329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720005, "uuid": "ec5fd23b-807c-4c0c-864b-708a2d21a969", "value": "768:rqYX5qmob8c73Eg06C4cEgYz5QbeSn/Shjctlt83fk7nAIZ:umob8kEz6CXELlQ/ltl1rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638720005, "uuid": "71fb49bf-e665-4ee5-9470-fe29ad58d22d", "value": 55280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638720005, "uuid": "cc1fb5a0-5fcc-49ff-b435-a51dfcecbccb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720005, "uuid": "4af43427-7487-436d-bfb3-1bcbde908505", "value": "cbr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9c4e2b-561d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638744329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638744329, "uuid": "dedf2dfc-0a78-4890-9ca1-615503c3492d", "comment": "Malware payload", "value": "deb60a23233d6e4ba4e9048b65c9cd50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638744329, "uuid": "6b4ef5e0-fc04-496c-803d-aa7985d4aab7", "comment": "Malware payload", "value": "7e0150a3d7bbc38f40afa31e78a1e280954ccea8211f98f32e2c65ec96bde43c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638744329, "uuid": "9ea97f43-baff-4a30-9781-0dbf570040b2", "comment": "Malware payload", "value": "f16cc16b817e772e20cd44f9d82b06a14ef6ffdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638744329, "uuid": "47080a33-b463-4a07-a6e3-ae2aa8f6192d", "comment": "Malware payload", "value": "2ecb380f793f097a04cdfc75df80cebf0878ab3a1780c635289c37544af7b8dd45340bcc2b33ae7f2e7af45c03b8d0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638744329, "uuid": "ae49cc38-cd81-4257-b79e-91cbefffe86a", "value": "T15E7523CA849ECA09C28BE5B04D70ED46E478C96758D8B291FBDBF5A326491A7C70F44C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638744329, "uuid": "6871c76e-d025-46e7-b161-61e4eba5692a", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638744329, "uuid": "49306655-456a-4ec4-8cf5-2a931c5e2e78", "value": "24576:SVhkCtxMLSNG/GpgY2WUPfywRGzgIfflznTL22LtQk92kEaHNYK3SAKAtKe:SVuCtdNGlywRGzg2lznTtQkkNaUAKAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638744329, "uuid": "2a2c2ad0-8ffd-4502-9758-518a39a4f6c0", "value": 1597312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638744329, "uuid": "55a6a482-e4d1-4271-878d-0154f2de00d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638744329, "uuid": "10dedf6c-4580-4221-9d05-9dcde48c50c0", "value": "Cleaner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be1f17e-5581-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638677569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638677569, "uuid": "041dc68c-0e29-4e11-a38f-58826bdbd776", "comment": "Malware payload", "value": "64836ed7e069bec90721e95dff109c8a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638677569, "uuid": "7c70faf3-7b63-44a0-9102-7bde66c4a163", "comment": "Malware payload", "value": "7e9589d301e35f4a02d01a792093979b0f8eed2dc142e17c67faecaee507bf2e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638677569, "uuid": "28d8cd9a-e612-4c82-8ba6-f6e2324bd978", "comment": "Malware payload", "value": "5ee00aca164a893e8863fbfd89d0784e47830979", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638677569, "uuid": "dbd7be39-e51d-4d5f-83b1-b16e9c6344d9", "comment": "Malware payload", "value": "eba1a76dbafec7ec078bd9ab9f41e4dba636501d34c75692b9692c2ef346dcaacdb17681e441df20e4f2e8824d0886d1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638677569, "uuid": "2fe3b380-e74c-43e8-b165-7e143d50def3", "value": "T1EF255B00E600F12BEAD300F686BB95F985786730235555CB52C86EFAEB256D4BD31B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638677569, "uuid": "3907ee6f-e171-4b45-a215-734914b59acc", "value": "24576:ygM4dPmrYDJTfzaf+4RY4GbOXwRDh/+cNm:ySTT7j4CvmcNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638677569, "uuid": "04a7cb60-4d32-422a-80e4-bb3110c7bf53", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638677569, "uuid": "691f8c15-b254-4f32-9251-ce1a537d292c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638677569, "uuid": "10d4051c-8af8-46ca-8419-f767ed5a6093", "value": "emotet_exe_e4_356e617dfc84566f5e7246a5a8f70607f562141356c0e66d7f82271decc30f84_2021-12-05__041241.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f5756b-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708240, "uuid": "58211bb7-9579-4da5-b37c-dac1e16921b3", "comment": "Malware payload", "value": "68458398af1c46651c6bf18362d2f11d", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708240, "uuid": "2b89a5a2-4824-4c4d-8e51-fd7e20be143a", "comment": "Malware payload", "value": "7f1e103769044a1f31af1c3c15ae29f716cffe49ba2ab5da52b5fa34e41aa8fa", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708240, "uuid": "7aa216ed-50e7-4744-9670-615bc805a6b6", "comment": "Malware payload", "value": "a1fe55d36080a2cabf0bcc596892c59843cee802", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708240, "uuid": "bb1788a7-0f6b-4544-bc5c-abdcd22d91d3", "comment": "Malware payload", "value": "b211c0bc92f2229e66f9eca72eb4484523b4daa83a790deebf986b26cd131fca486ac2f3ec468701675e4490f746276d", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708240, "uuid": "d97dc4f1-c6b0-4121-96c7-c403c3b49a9d", "value": "T1A8C533119AD017C8E594CF2F2F9C9936047FDFCA78A4EDE391D28BE1110FE86A562570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708240, "uuid": "fe2e0b07-4643-416c-8578-d204ff1863af", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQj:G1wwAjzIQOMK2GNKslgus105", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708240, "uuid": "ecd9f700-0145-484d-9271-206571631dcd", "value": 2670592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708240, "uuid": "40e2f4d5-2a4d-49f3-a5b9-3fa93e011059", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708240, "uuid": "183c3a99-3389-4fbf-8dc1-427c25398224", "value": "7f1e103769044a1f31af1c3c15ae29f716cffe49ba2ab5da52b5fa34e41aa8fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3708d6bb-55f9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638728940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638728940, "uuid": "b6c35a31-81ac-4e3f-8bc3-9c6389535367", "comment": "Malware payload", "value": "409367d7c4ddf7e3d0e1bde3227bc37b", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638728940, "uuid": "b0610cf7-7d2b-4046-96f6-3d26a54c5874", "comment": "Malware payload", "value": "7f8048951379614c56a10eafa2c60712038a833cdfe7835b1e3af1dc5f220b74", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638728940, "uuid": "99378abe-d425-4c01-bea5-740fb5cbc406", "comment": "Malware payload", "value": "041a497ae5a87ccb6a6cbaf787c46b06f28e56b7", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638728940, "uuid": "98a8016e-e6e1-4595-9024-3ed6b599bc97", "comment": "Malware payload", "value": "7d1d18ecb1b51735cdd0525dff9cdf7319b2b5983ada91907eacb74bf8b7f2ee616022176ded420638a8507fb6974d08", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638728940, "uuid": "5250debe-c549-4d8c-8793-2da4f4faab41", "value": "T1E6A4CEC806C9E519C752F9D5AE56B00732D2F70D31EC83BD29AAC6BD11AAF28D13352D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638728940, "uuid": "238e70d7-1793-4212-88ef-387cb5dfeba0", "value": "12288:GeTOx27Aj0wB6vCs/KQi/VaBMKzIkEkR9BJhrmI:x2jXB6vCsCy6PkECv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638728940, "uuid": "9e12846d-16e8-4a6f-a2a5-112cd27cfc35", "value": 460884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638728940, "uuid": "2d84624b-8d24-4480-957f-cac271028191", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638728940, "uuid": "7907ed98-e22c-435a-8ef3-a87264dc8b6c", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.28034.32480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08e172c-5575-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638672530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672530, "uuid": "4035b186-e8b9-492f-9021-000c37ead3ec", "comment": "Malware payload (GuLoader)", "value": "08d3af9d9cee3e02189a75502010a65d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672530, "uuid": "82321a51-85c7-4633-b992-58c70e41a99b", "comment": "Malware payload (GuLoader)", "value": "80509073506573641c7e354f276c7968015a01e52a23c506a7fe484a68891915", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672530, "uuid": "97337830-f74c-4d9a-858f-626a6e3ac85d", "comment": "Malware payload (GuLoader)", "value": "74668401c1715c554377008937b8dd25fde2c20b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638672530, "uuid": "b22766b3-a0b3-4fae-bb8c-dc2fe06042b2", "comment": "Malware payload (GuLoader)", "value": "5ecfc078309c737de92295379679899cbd71a9af3361a348c5a46e3aa9146cbaf70c2e2cf9cc511129a98ba4e4c574fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672530, "uuid": "c4d8e535-20ec-4c27-be72-56807221f299", "value": "T123D3E0007370C567E4A206710876A7BABBBE692949715FDB07602B9C7C336D08E2EB5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672530, "uuid": "99b9818f-59f3-4e60-b5f3-569f924ec497", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672530, "uuid": "9b28b468-fd1f-41f5-9e21-d86726053f0e", "value": "3072:gbG7N2kDTHUpou4ubwpffvRapbyAZo4x8yAmiWE0e:gbE/HUjqooIiWRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638672530, "uuid": "ffc40328-9ea3-4961-968c-444bf598b004", "value": 131191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638672530, "uuid": "a50a6ddd-3c8d-4b38-89b2-d94d1d4d3737", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638672530, "uuid": "7f388dab-898b-4ab6-b73d-51d6ac7802c5", "value": "08d3af9d9cee3e02189a75502010a65d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05dba918-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708241, "uuid": "89ddc16f-f8ce-4e5a-a879-8d1b776b20db", "comment": "Malware payload", "value": "d480cd972f29b4fbe515de4ecee79cf4", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708241, "uuid": "07571d27-d23e-459d-b699-8cbd41330b47", "comment": "Malware payload", "value": "80a673d4aad5474a332d18bb5a738cf8664bfbd0ca7ccb5ae6e48bbe3b21feb0", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708241, "uuid": "d08d89f1-d113-4d2e-a570-f77c61640a3b", "comment": "Malware payload", "value": "8db8ef1363c8c8dc1207c18edda1630dda7d8236", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708241, "uuid": "c81a0a19-b9bf-4f12-b717-b263b9863593", "comment": "Malware payload", "value": "2e6f00adb80daf9872602f84a934198ac56bd5b89d50043b559c401b518afb92d64dfbf06ddc7e578682368167c9df66", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708241, "uuid": "c6bce875-9080-40c5-9209-cb70c4b42640", "value": "T15CC533105AD017C9E594CE2F2F9C9936007FEFCA7864EDD391E38BE1110FE96A662474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708241, "uuid": "40594e04-507c-411a-9907-8e00c47ab917", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYm:G1wwAjzIQOMK2GNKslgus10h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708241, "uuid": "31fecf5a-7238-47d7-82a6-03dbfd43eb3d", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708241, "uuid": "27de839d-06fa-44f0-abd7-e271f59c5643", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708241, "uuid": "27ab07a5-56b0-4fcd-9e06-51bff446bf8b", "value": "80a673d4aad5474a332d18bb5a738cf8664bfbd0ca7ccb5ae6e48bbe3b21feb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578e56a5-55c8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638707949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638707949, "uuid": "ab53f7bd-17ac-48d3-a123-6072f6979fa3", "comment": "Malware payload", "value": "58651879c80b3e12cab699d288f8d40d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638707949, "uuid": "e2dc913d-643d-416b-8368-96e922f5ecd4", "comment": "Malware payload", "value": "80f6bcd7a6fe916afd64aeab328224d199d7e8dd426d2199bc852b6909965a29", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638707949, "uuid": "5ae130c8-11ef-428f-9b5c-7fd98ed933a3", "comment": "Malware payload", "value": "adfb1a09203c5b8fa1251c7b35908af40080aac0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638707949, "uuid": "ee9dee8b-1d2f-40cc-923d-6998f93c77ef", "comment": "Malware payload", "value": "8d82988342cffea594dd98599d142597f593dd813ee99953df0c14509fa96a68a95b86542c250cc85b1796a703e311df", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638707949, "uuid": "d0b132bd-fb51-4e04-9f65-8c8491b4f4ac", "value": "T1C1C5DF8AFB49A46FC4F797358672026A96074C694B83D6871E58713C0DB79C04FABECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638707949, "uuid": "8bd04116-5783-4441-8598-afa94a7b2f6a", "value": "49152:cSw2ilvhRr2zb7m39aoiv7AdfNpRpWbusBSQfaVDD2Jhqz:peRr2zbqMvsNpKJSQCVEqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638707949, "uuid": "7b5e1b34-f183-4d2b-b7c3-24ce5baef727", "value": 2698458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638707949, "uuid": "a31f25d3-81fd-4a3b-b466-db031b8b6d72", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638707949, "uuid": "74b0304e-b521-4677-b225-48c142b40d89", "value": "\uad50\ud1b5\ubbfc\uc6d024(\uc774\ud30c\uc778).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4412fd1-5566-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638666121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666121, "uuid": "9f0be132-7fe5-4df7-9419-dafdeaba19d5", "comment": "Malware payload", "value": "cd0dc5f56b4c147c4d09f163d6094b5f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666121, "uuid": "adc2c24e-bd92-4b56-bf69-f6015f28a876", "comment": "Malware payload", "value": "81ef834f3ef389e52a0cf5ff98aefe64f9137bb20f4cb287e42003824307d6b1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666121, "uuid": "ebefe0f0-0c77-4c3e-815e-5696180986ab", "comment": "Malware payload", "value": "6ea4784fe33ee06ccddb224404962bf9705a32bd", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666121, "uuid": "6548d68e-0bac-4dcf-a36b-65a22f322c24", "comment": "Malware payload", "value": "5dc74a347c03c1a375b43b92b2c75d985a3c3bed5ecf1eeaad90c17ce87fab6bd7a3fe04a5f04d891cee9f4e8a869bed", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666121, "uuid": "5d8da6db-fc6c-4372-b5bb-da7d4e575467", "value": "T1B0C423E85F94B014829567252D8641C70A5654C0E3FAFA808E9E3C549368EF7FFACF1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666121, "uuid": "79fcf312-0047-4abf-85f6-9ddeab832905", "value": "12288:vHO85Ra0deG7/STAmgsUSueeddruVB3AKbm/sT06F9zabJN7LdXlq+sa2O4:vHr75J7Pm7E50AKbm/sTHzA7LhlQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638666121, "uuid": "ed33171d-18b3-4e94-b36b-5870f87b1bc4", "value": 585872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638666121, "uuid": "e3f53952-a433-49fd-a888-86efe8215a71", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666121, "uuid": "8e3edd23-64fd-4749-b21d-411f100a7b6d", "value": "\u6781\u54c1\u8eab\u6750\u7684\u9a9a\u8d27\u88ab\u6211\u989c\u5c04\uff0c\u5185\u5c04\u89c6\u9891.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fba9211-55b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638701627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701627, "uuid": "96ff5800-dcc1-44cd-9bba-12bb70931968", "comment": "Malware payload (CryptBot)", "value": "fc0701924aed7be6e65f20c16d222ef6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701627, "uuid": "f6b7f971-0e25-49ad-8aac-151f19d66d95", "comment": "Malware payload (CryptBot)", "value": "82a634123b202b7960b6cc3b52125352a2006e40cc2ccf3d62c1519191981e71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701627, "uuid": "18a9c35c-901d-48b3-8f2b-d2f31677d217", "comment": "Malware payload (CryptBot)", "value": "c04d8dee265d5ed32f30f9bf466b6d2676dae4eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701627, "uuid": "ad19b7ca-1c7c-4dc2-99ca-a51610ccbff7", "comment": "Malware payload (CryptBot)", "value": "e826e82934c13ccc67c9cac9345289d7c758c3bbae35e7e29b7b8f33c35b175c3f4a861ec2798f631053c43ec6b58da2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701627, "uuid": "c5d17a02-c01d-42d7-8794-c7ee89659ba3", "value": "T1B484DF1176C1C033D08625768C26CBB54EBAB47017666ACFBFE85FB95F243D2A72530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701627, "uuid": "ee2e7016-8b50-4fec-bec5-72951468b97b", "value": "57414c9b174f8e0ff83324cb2c99bb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701627, "uuid": "7a337187-1948-46d6-949a-ed8b2af476ff", "value": "6144:5Ub52NA3WmGYNIniSTAxCKmqZyAyi2dSokgs6oTxdISL0V:5UbkKWmGKKiSAUNUCS8s6oTJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638701627, "uuid": "22807e9e-1b29-4145-ab81-b53b2bf165b2", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638701627, "uuid": "fc653bf0-cfe3-4240-84aa-c1bf14904892", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701627, "uuid": "4ac056d0-f0f9-426c-85bd-7e57cd60696c", "value": "fc0701924aed7be6e65f20c16d222ef6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c7e89e-5614-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638740722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638740722, "uuid": "e88df3da-ae5c-4c61-97dc-e05421e7a4d4", "comment": "Malware payload", "value": "c733ff505fbabde49f8f608934a33a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638740722, "uuid": "5eff9143-6286-4a6b-aa6e-4182e88e7319", "comment": "Malware payload", "value": "85df80da12514f08d07205b35b8259e9e24b274bbff1bb4fdfe8d0816ba97649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638740722, "uuid": "ffb382da-cb24-48d7-a019-40442c21a0e5", "comment": "Malware payload", "value": "23227dbd6bf71ec563e56b3e662969b77e6bf6df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638740722, "uuid": "047716cd-990b-4291-9db4-6af87732f576", "comment": "Malware payload", "value": "f59a00e784d6b5ee2e8ec5a71a31e3a35ee3d52cf50f9e637bedd6aaef0a9248724462f076f1de44531ecdde3fc2d126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638740722, "uuid": "fbb64f26-fb04-4280-bb4d-df2bc7c6dd1b", "value": "T12B2612993600F78EC162873ECA589DF49A50AC65D70E8137AC53FE6DBC3C876CB541A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638740722, "uuid": "8e61e232-e002-4a48-89b8-8958d2ae54ad", "value": "98304:mZAWK7CavX7vOvumuRc+20TtqyqzOCyJco7bLsFUV:mZAWNUMu12WQy0ZWLLES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638740722, "uuid": "cb92e486-8ef4-46bf-8162-f27625e59276", "value": 4435968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638740722, "uuid": "6e88b0f5-263c-4533-bc73-0887e5851be0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638740722, "uuid": "449381b3-a5a5-427f-8d05-937c9b654d25", "value": "Updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305a5b4a-55a3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1638691992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691992, "uuid": "ebf28a9a-b2fc-4488-bd8c-9f3559bc564b", "comment": "Malware payload (Socelars)", "value": "c24fbf4ebcc863480d4df76143730830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691992, "uuid": "473dbaa9-2d20-4e6a-a16f-5faacd67ea55", "comment": "Malware payload (Socelars)", "value": "89385dd502035dca3a7a599c4f1ed2f2b133ff355e550f793311cbf084741fd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691992, "uuid": "c8b6bbbf-857f-491a-a1d1-7dc482dae987", "comment": "Malware payload (Socelars)", "value": "ddcedbde8f1ce1f3bb8e35f6bc7c1fa61559482a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691992, "uuid": "af924e5a-78cc-40eb-87e4-8e5a3da54723", "comment": "Malware payload (Socelars)", "value": "69fd02d0c91fd77c648cdde80662830dda84e939d6bb136407d4a83636f94173a88e856dbc264f0e9186aaeed6dd2d04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691992, "uuid": "50d01a1a-0a8a-4005-9226-dc7616d88b87", "value": "T1F8659E11F642A036E8E3007286FF5AFE8D686E21030854D7E3C47D695E719E37A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691992, "uuid": "ddb7325b-9643-4a12-bb03-d6db1d0314b6", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691992, "uuid": "a42b0755-dca2-4bbd-88bb-36da6ef7cccf", "value": "24576:aCjpXA4U35ozW03XRp/hESVE5uU2xbVN6pZVnoYL1ZgSLoyQinn:fpTJxPNl0PVnoYL1ZZLoy5nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638691992, "uuid": "a3dd9594-b5c9-495a-86ea-2e9236841506", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638691992, "uuid": "e4ea7b7b-0398-424d-8ba9-8d1c31cd1c47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691992, "uuid": "53a6799f-f6f6-4cb0-8da9-16164bb72c21", "value": "c24fbf4ebcc863480d4df76143730830.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab1babe-5585-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638679312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679312, "uuid": "211ff593-5d01-441a-8f7a-0dacbc1d7a1d", "comment": "Malware payload (DCRat)", "value": "a1e709f8b3e78f64a6eb6eaa3ba08677", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679312, "uuid": "b1210dc3-0336-4497-a1df-bf7fe020fa56", "comment": "Malware payload (DCRat)", "value": "8adc5e4a857304bff719b9801c5928104946aa65d9bf2dd61b1c0c877238a56e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679312, "uuid": "421f03d9-b675-40eb-8e9a-fc3c423392d4", "comment": "Malware payload (DCRat)", "value": "0cffbd9090d10d90b90cb61f18dcbaef9e6feb65", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679312, "uuid": "0f68a463-cadc-48a7-9376-1270187e4a08", "comment": "Malware payload (DCRat)", "value": "af62bf5196f935c8be1e5a140e20d2a043b3374f26eab36c91186b8a0bc06df1725623a21d8a7007622d7f8f67e646d9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679312, "uuid": "c932bf40-6763-40fc-be90-849af31a891d", "value": "T1EF456C123A44DE02D129173BC6EF405583BCAD457A62DB2A7E6F73AD25513AB0E0D8CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679312, "uuid": "fb8a3227-58e5-46f6-a80b-a7428cd9cedc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679312, "uuid": "3801ae31-f42d-4b78-b85c-9d5225eee6c1", "value": "24576:+fD0xM0PfkpQULK/ZVAQNaqEtwHKWOb/fCrSr+4:N604jLKQmXHbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638679312, "uuid": "fb991429-e51f-4243-93a2-bc4a2a325dde", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638679312, "uuid": "ee7b3501-e585-4456-be97-f64b3eeb6bc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679312, "uuid": "c6bd8bf1-afc2-4932-8862-b9242779e5fc", "value": "a1e709f8b3e78f64a6eb6eaa3ba08677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aae5e39-55fc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638730207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638730207, "uuid": "bc3665c2-bc60-4d9a-9feb-44e309175cf9", "comment": "Malware payload (Mirai)", "value": "3b67af2398f4ba1933949f51b3070374", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638730207, "uuid": "04827b3c-510d-44a9-8e33-bb125d196439", "comment": "Malware payload (Mirai)", "value": "8c33a56aaf9546724c0abdec527044a351d852744e36e86e9e954e14686a930c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638730207, "uuid": "b6647800-3c8e-4ce1-ae52-1b7a06ca4d1f", "comment": "Malware payload (Mirai)", "value": "3f012b31ae043ee057a6806e564f49e81ac238f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638730207, "uuid": "db055eee-73eb-4f64-80d8-75fb18f74336", "comment": "Malware payload (Mirai)", "value": "4cab75dbd3050aec5b83d386821a9808dd7cba3e0101e6f07841dd87a9c34b6c33509678fae9e27fc9ca1c9fb767a1e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638730207, "uuid": "03a8c8bd-5b71-4260-9bdf-2b756aa10754", "value": "T144E2E1716700C4F3F6C9FA72E174110E454389F17A2F71B16F2C526951DA8A3AAFA623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638730207, "uuid": "af9e413d-749c-40ca-8331-88d40b71ebe9", "value": "768:t9BJA6UN+be/eRSCL2zhmv52vZ5KXnRBL3UCyQ:D1UUbce9FvgK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638730207, "uuid": "b68c8eaf-ef50-44e3-98a4-21ac24de86cf", "value": 31904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638730207, "uuid": "dd7d9689-3fd0-486d-9f70-404c5c74d153", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638730207, "uuid": "941c0f6d-bf4f-4418-bd65-db92b62cdb2f", "value": "z0r0.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89de1bd-55bf-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638704246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638704246, "uuid": "b5a66f03-eefa-40e6-92a7-74d86a0b9a30", "comment": "Malware payload (Formbook)", "value": "f2ad6cf09ec9872ba9180e069aadbfbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638704246, "uuid": "895c5da6-7878-46e8-bfd1-144baf1c10cf", "comment": "Malware payload (Formbook)", "value": "8c6441d2f5e108a63524430674b8f711cc7b218a2a06fa2c43e24b1de1d76088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638704246, "uuid": "bfe5c70a-0b5f-43e2-af54-969327001825", "comment": "Malware payload (Formbook)", "value": "6bc55e609f4d66d20ad190408d854a015f1d7aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638704246, "uuid": "7d94be9c-8be7-4e51-a8f2-4ead0c1e735d", "comment": "Malware payload (Formbook)", "value": "33c7813c03716ca7a73ec53c0e426dbe881cd637417426a8fff236919eb006a46bde8cfb21453cff6f279e16888de61b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638704246, "uuid": "e6ab99ae-ff33-4df6-8cc4-4ecbc21b1f33", "value": "T1D5F46BA26C839981FB8C0972D16A8D354723FF760D01596F52733E2D3E670C2EBA6716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638704246, "uuid": "c77b8904-3378-45a6-b800-3ac22cd3df65", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638704246, "uuid": "c8063d52-df15-43f9-bab5-c70a3a78cd4a", "value": "12288:IJuhG9DyRN4kjNOyN47So/mdrBNpufx5GC3kHhQN:KutO+qb/ArBNpu+C3kHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638704246, "uuid": "0c0f9fe2-f4ea-4cc7-b9e4-d7b2b8b81341", "value": 760757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638704246, "uuid": "461a8da6-0d6a-47b3-bb41-34a8eed73624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638704246, "uuid": "d300d8ad-b726-41d2-98bf-7d3b69633aa1", "value": "Purchase Order # 1014397-18NA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9343e898-559a-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638688292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688292, "uuid": "fac51c5a-40f8-456d-b7bc-7946d250b030", "comment": "Malware payload (AgentTesla)", "value": "bdbe237f3f3ad1f9c2d40312358a9b58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688292, "uuid": "8f21c0f2-1c82-4a32-9509-1f0c22330753", "comment": "Malware payload (AgentTesla)", "value": "8dab5bddfddb624070853f72442bd8264163d92a5caeb9c7583e6c8138a6e122", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688292, "uuid": "dead2bb5-5c5c-4997-ba0b-e22bf73200c9", "comment": "Malware payload (AgentTesla)", "value": "0baadee51078d21997f9d560cf830a6913360668", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688292, "uuid": "257bdfe5-c753-49b7-a698-08c0b6a8c3f3", "comment": "Malware payload (AgentTesla)", "value": "f8be1b01045531631830e9a60bf14866e30b0abec92f7d395afe75b1e892af3f8aa93eea18ff74d19f3a029a629dd5df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688292, "uuid": "b562eef1-0d0b-433d-8789-b41aff1f6d21", "value": "T163A423F4B1CF2CD170305E23E6A39B8F1219A35D6852F4E8BA7154B0E0F55EBB462196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688292, "uuid": "3c269a34-0879-4d2e-8b34-c0c976195a09", "value": "12288:6fmE3X1342PRl5M7qUVQc27jsvpPluN1uwX5AA5802h1Ch/P0qxJjD:mnhHUW9UhPlEgYl4huX0qxJjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638688292, "uuid": "9406207a-6c4d-4787-8df0-bf1b66c3d2d8", "value": 490317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638688292, "uuid": "0ff8aa13-baba-4742-9585-27fde7c29663", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688292, "uuid": "1dbfa844-a1e3-4168-959c-75a774867495", "value": "Factura.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a18822-5573-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638671712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638671712, "uuid": "97083bc4-6bec-4c86-928f-e2c2e7e89d90", "comment": "Malware payload (DCRat)", "value": "a3fe625cede6bf9611cd4f44951c2c0d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638671712, "uuid": "c1de34c9-355c-46c3-90e9-ab290d55c987", "comment": "Malware payload (DCRat)", "value": "8ef06fbc9704fd9bc1b609e68f16b6e21746bf6472ec88a523f58e9295e82f48", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638671712, "uuid": "14870c80-abf5-4597-b661-71a48793107e", "comment": "Malware payload (DCRat)", "value": "307f7c64fd73b972c17a835a689f28412120125f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638671712, "uuid": "e81c64ab-6134-4027-9e5f-3261f0640be1", "comment": "Malware payload (DCRat)", "value": "4bda95d506256a63bec983b2fb678453f142257025c90dd077b596be14d0a7e0f6a65f57b9ad6cb0bd9eb76684ad4dfc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638671712, "uuid": "dde5deac-fce0-45d2-bf53-c30eecd64785", "value": "T1A0556B123A44CE02E1691A3BD9EF805447ACED417A72DB1A7E6F339D65523A70E0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638671712, "uuid": "eeca8db1-a567-4ac2-a507-a7d037f44d46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638671712, "uuid": "d0ca46e3-83b8-4350-ad2d-864dab395d29", "value": "24576:AcqbBXNCnFGAT9nE+5VmgFWhp2Wd7hKN0OFjX6OYJQI3SJKPWGDai2t+4:A7bx4oA97czhWFu+5s+GDo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638671712, "uuid": "9555303c-b7d2-4911-a2f2-5e2879b1056b", "value": 1378304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638671712, "uuid": "fb9a915a-0857-49e0-a7d5-f1ab014dc6f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638671712, "uuid": "a7bfb020-8320-46c9-bc02-d17b5faf2802", "value": "a3fe625cede6bf9611cd4f44951c2c0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5e5b8a-5614-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638740491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638740491, "uuid": "a97bf659-47e7-4118-8bdc-4d7c9d883e91", "comment": "Malware payload", "value": "30344f773566016aaff859c73e64bd16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638740491, "uuid": "9fb6f79f-0a53-445e-89fc-b9f799cb27af", "comment": "Malware payload", "value": "8f5b85039bb231546bcea5c8962f44db81af9c292288beafc93216a932d50b12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638740491, "uuid": "631fb478-96ca-43e8-9c95-daa5aba3b939", "comment": "Malware payload", "value": "d33c23f1ce23c36d74a37d6bb137e3a09b00cd6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638740491, "uuid": "92661014-33c6-400e-8d1e-930ec0cd030f", "comment": "Malware payload", "value": "20fd14f7861199d017ecf6e88a6271da5d19e05318712e34289d7fa6582086c0cc1e28350856ca004c5dead6ffb984d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638740491, "uuid": "1af9ad26-2ada-41b2-9b6d-2e1e7a08d2ea", "value": "T1F87533FEE3522F3ED208A17E606F6B0F92D63D35ECD8A8558B7EC2051A0E51C58536E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638740491, "uuid": "de1b4e9c-debf-4c96-b1b6-7a70511c5e47", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638740491, "uuid": "aa1b0078-a0bc-4fd3-83a0-70c2c55a85f7", "value": "24576:yV5g8LTt49yu2Rs7I47SmDZqzBHZjsX3XKmyLKPw5IV60vXQcXfyul6Q+E0xja4f:yV5g8LR49l7JemdqzlRA3Eyw5s60vXP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638740491, "uuid": "4fca372b-e9b0-474a-b8e5-5c31b9bdfbc3", "value": 1571840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638740491, "uuid": "4fc04718-6d58-4a0e-9056-24058efeb719", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638740491, "uuid": "7d8e0f2a-8eba-4506-b56d-4f9822fcd0cf", "value": "Fierohack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74bee19-5566-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638666046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666046, "uuid": "225fba53-add6-4c01-976b-b12e1e7aec88", "comment": "Malware payload (CoinMiner)", "value": "e31775fa249d465f847eaf509b80e9e5", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666046, "uuid": "7001c88b-2839-4293-896a-f0a2df112f1a", "comment": "Malware payload (CoinMiner)", "value": "8fd8c53c6f6fcdacbee5f8a320a0d46e6defad7fa6f2ff34b0e283c2ed1249b3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666046, "uuid": "c770dabd-fbed-4d61-908f-d8698ee30c36", "comment": "Malware payload (CoinMiner)", "value": "d7abd66ce84f18254fdad3b4dd7606bb86374940", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666046, "uuid": "57e1d86c-75c7-4241-9e53-5d7941567547", "comment": "Malware payload (CoinMiner)", "value": "381c905101f973d45c97a4f701b17628dfee98b31817ca4c4f0ef33e298eaa122bfa9096abe37ec0eb30e8a15ebb9bd3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666046, "uuid": "c8289da1-a789-49c4-96e9-e4e10fed455d", "value": "T105D423384E964B67F4D986FF8CEC457E27FADC2AD82503926D10194BC3ED409AB84CD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666046, "uuid": "b21fc593-21af-4985-aa0b-94a3aedd7389", "value": "12288:g5CIHlsSn9JeuSXDpLV2GtTScEEBqNnhuPKoIokNv8fUHN6:iHlsG9J/mpLVjTzBqNnhuPKA+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638666046, "uuid": "ba3a0ce7-b958-4c75-8ac7-904b3903fcaf", "value": 630975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638666046, "uuid": "e4789912-104c-4de0-8392-816bd91df1c6", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666046, "uuid": "ffdc39b6-e918-4010-9e4e-684419d173c9", "value": "\u4e3b\u7ba1\u900f\u9732\u516c\u5f00\u5229\u7528\u5f69\u91d1\u5145\u503c\u8d60\u9001\u8bdd\u672f.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92b087d-55e8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638721937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721937, "uuid": "7d77ed3b-2160-4bca-8c4a-af69d8bf59fb", "comment": "Malware payload (Mirai)", "value": "056e86e9df4e7721e472b4334972600e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721937, "uuid": "44eea674-9b62-4a17-9226-4aab5d0dd6d7", "comment": "Malware payload (Mirai)", "value": "9048c53950ef58aaf34947b39865da1d7d86cec355b74620eb922debe6b0cf11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721937, "uuid": "2a5a6bd8-05aa-4700-b491-7c84870fc28a", "comment": "Malware payload (Mirai)", "value": "9363a01a968440ebc11529dd095dfc3d68310057", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721937, "uuid": "f6a04bbc-5e8d-42c4-b7dd-d99aaaadefc3", "comment": "Malware payload (Mirai)", "value": "e94c4770c68a89476c5cbc5a61466fc70afcae602d7edf25860a7687d8628d5061fab716b51c817408cc3e9736713d68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721937, "uuid": "e152a401-4ff3-415f-81c1-7f8c0249af01", "value": "T1F783615E3E319F7DFBAD823897B79A20920933A616E1C584D19CED021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721937, "uuid": "6d91b47f-05b8-4bb0-bb38-458317007d6f", "value": "1536:hMqfcnXqzzEJMq+Yiq0Hb/Tz/Y6zX1lHfhGYqTPNREv4:iWcnXqzzVq+Yiq0778O1lHfhGYqT1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721937, "uuid": "9b9fc924-318f-4ae8-aa98-014cdd7cc02c", "value": 88508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721937, "uuid": "2594c3d2-0160-4e4b-94a2-159f0d4af3b3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721937, "uuid": "2133a2ef-692f-40fe-bd3d-3b8bbb532c9c", "value": "056e86e9df4e7721e472b4334972600e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a49231e-5568-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638666722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666722, "uuid": "adf71ace-6126-4cfa-a92b-a2c0f079fd3c", "comment": "Malware payload (CoinMiner)", "value": "5c348974148e05088fa00a2eac27b3d7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666722, "uuid": "db22f1ab-df8e-4036-8b36-70b02a8c4355", "comment": "Malware payload (CoinMiner)", "value": "90fa2e42dccbe0cee20dc699258245acfcfca155ca771010c68539062f8db414", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666722, "uuid": "9c3fbebe-655f-4b28-9f9f-542b197a8011", "comment": "Malware payload (CoinMiner)", "value": "d34c38eed48d8893b234f476023c9cdb5098d82c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666722, "uuid": "f84e7d21-7965-428d-a7a0-45a633b52ce3", "comment": "Malware payload (CoinMiner)", "value": "baad15397b3f4c26f951a76a1db93384dff4a8a25a8d8d2f4fd6edf538040e9f7c6894419c8406d2f7736b562f06c30a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666722, "uuid": "c74266f1-cc0a-47a3-853e-e498ed9c7ac5", "value": "T11DA5330E3134B1DDC557C637EAC90DB49E2074AA9623C11394E7A2EA6F4DA8BCF494D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666722, "uuid": "d40d6508-4d82-4e81-ad9c-299ecfbb737b", "value": "49152:vL7RreVmCmRmIS4EDMacLdNzBOFX2Pm6T10dJXElT1:z7YWmIq45XBO92PmUyXER1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638666722, "uuid": "b1c1ec63-ae4f-4a9b-ab6d-1a079aca666f", "value": 2064896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638666722, "uuid": "24d4b6ea-9545-46d7-91d1-d5fa168533c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666722, "uuid": "32ecd171-fd57-4ab2-bd8c-aedf7cef97fb", "value": "5c348974148e05088fa00a2eac27b3d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5796f9e-5584-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638678954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678954, "uuid": "4d35fecd-5c9a-48e2-9901-e3a4da6e28e2", "comment": "Malware payload", "value": "8dc28121e48d5167d999c865b5c4e304", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678954, "uuid": "9c94c429-6e22-4b2f-a9ed-8988da3f0d9c", "comment": "Malware payload", "value": "9143cf4529cd01305cf7453301ceca49b85f237f27493ac7729341e9e51729f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678954, "uuid": "dd2e7ae5-9935-4197-858a-3e9793e30c17", "comment": "Malware payload", "value": "605f1f9288970c049f0a6a5242fb7a19b992e864", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678954, "uuid": "c9070afc-bf2f-4c4e-8a72-d64dbaae89c2", "comment": "Malware payload", "value": "4daef9951e9ef764a64b2b0f27c0a79c241531d5bfa447ece8cedcfdc2cf2a032bce09725f4af7f27f50a9c0ea5cbc64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678954, "uuid": "443f94f4-6d93-45a2-aa63-71fd39562c2a", "value": "T172B31A93F511D9B6F40AE63708D78B247270FAA14B53153263177BAAEE361C4386BF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678954, "uuid": "35e4cf37-85e6-4c6e-b05b-3ae96dae6dc1", "value": "3072:Ow/QeqacWucW0JcWcBxG4VPKIS3m278OGetqXuhx3mmHBzTQLHSLW:Ow/QeqacWucW0JcWcBo463L78OkqZmm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638678954, "uuid": "91970b7e-8686-46fd-93df-924b20c4d204", "value": 109847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638678954, "uuid": "dfc36a78-71ef-4b63-94c9-cb115761afff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678954, "uuid": "d5bb082f-0ad4-45a2-8328-fa95fae8a168", "value": "8dc28121e48d5167d999c865b5c4e304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08790fe9-5585-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638679040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679040, "uuid": "6f7e292a-8e53-4596-979e-282cdaa27a78", "comment": "Malware payload (Gafgyt)", "value": "e5b8683e573a465e43053ffe7afec285", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679040, "uuid": "57be60b4-2205-4683-989e-e4ee8d6a4a57", "comment": "Malware payload (Gafgyt)", "value": "91896dbeb9fb656c054a6e4f4c73ffafcdfcd11fca41dc4e90322f2582508dec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679040, "uuid": "751882bf-ab57-42e5-a74e-7289c0111dcc", "comment": "Malware payload (Gafgyt)", "value": "ec5da9847588ea0c088bbf626266d8d3804ee29b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679040, "uuid": "2166a965-8865-4e9a-babb-290e930b676b", "comment": "Malware payload (Gafgyt)", "value": "4a4ac76eec490f9460ae120ee6f7d2c7bbddb9691e2c74cf96d888c23182792b12acb288fad34993ff1400fffc03b722", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679040, "uuid": "9e3230cd-f1e8-4205-87ad-6c093044b1f3", "value": "T1F8D3C72E7A21ABFEE16D963107F35F7083A625D227A19345E16CDB181F3128D5C8F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679040, "uuid": "604cc77a-9de1-4541-95d7-ac0ca10d3244", "value": "1536:nHfGlkuAauj4uXcE2rK7syUFhfiNH9jVaeVB+dQczPaUF7rs84lQDskHrMnDbMri:exMXVaeadtaUli+s2AAm/BgxYy0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638679040, "uuid": "29f1821a-056f-41ae-9508-99b52142c7e8", "value": 140067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638679040, "uuid": "b8c1cc67-df68-4079-803d-edb3216f3daa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679040, "uuid": "03a11eb6-0c9e-41d9-9956-7715932d0c94", "value": "e5b8683e573a465e43053ffe7afec285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f139d239-5566-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638666116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666116, "uuid": "0ffac3d6-a336-4f42-bfbf-adc247735fcc", "comment": "Malware payload (RaccoonStealer)", "value": "45cf4ea0f9268e7306da20dea9d14210", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666116, "uuid": "0b6897d2-33b4-48da-a130-55d86c10ead9", "comment": "Malware payload (RaccoonStealer)", "value": "919ccc1f90bae8d58cc6ef51359e15af853de90a7083c640b5c2a99eb1a61281", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666116, "uuid": "a18fa85d-0cfe-41e8-96ff-1522fd640a92", "comment": "Malware payload (RaccoonStealer)", "value": "3574746d1d089f9989ee2c9e2048f014a61100ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666116, "uuid": "0f7003a2-5cb9-47a6-a358-cfd0194e8cfb", "comment": "Malware payload (RaccoonStealer)", "value": "46ba83fc7711150415d0129a85b68a4472615a79cd6cb160c47e2e6807df89341855dad34b06fdddda400001b9a351c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666116, "uuid": "3aa43594-5a18-4746-9127-655eed7b4562", "value": "T1C5E4012235C5C472D16720768916CAB14EBAF9600B766BCF6BC44BBD6F287D2873530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666116, "uuid": "e7a1c79c-18fe-4177-942a-9ada5b390c2c", "value": "9f6871ff9d0361461862aa217c74f9e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666116, "uuid": "9651c5a1-8536-4aeb-95af-03c5e2dc0965", "value": "12288:O7VvDGQGh+/E/4Im+1Pj6o3QJamyiwpBwfJJgCJbxVeJMakn+SfyQE:OhvDGQGh+/EBPj6oqPyxpSvlTINkn+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638666116, "uuid": "72b0a2aa-864f-49d7-9dd3-f9835ef0decb", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638666116, "uuid": "bcf3f0f2-6c7c-4c1a-ab12-fda1cfe2a8ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666116, "uuid": "6cec4fec-ef6f-48a5-b43d-2805a5fb2752", "value": "45cf4ea0f9268e7306da20dea9d14210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3118b0ab-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638722487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722487, "uuid": "7cdc9fcf-1762-4f74-b7a0-d7ae6febb070", "comment": "Malware payload (Formbook)", "value": "94724b4cda3ff6dde7b9daa854c38e21", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722487, "uuid": "531fae58-1167-4cd0-82fe-1732fd5864c4", "comment": "Malware payload (Formbook)", "value": "91e8dc31ec6bbb3ed8f8e3bd53db2d16afc8796a503502e3de13f91a5a288682", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722487, "uuid": "3e3d08c5-f88e-4353-b1b6-7599cdc8235b", "comment": "Malware payload (Formbook)", "value": "93554e6b3c8580c7480464843dc28a03a0d481cb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722487, "uuid": "ffed468a-ce89-45c8-b85e-7b641c1c0c6c", "comment": "Malware payload (Formbook)", "value": "1210c32d1ea3a4ad1150621171dc1a0208a6f273cf5ce4b4dd476ea5b10aecc2624e2f77bebf467987749a978f43973c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722487, "uuid": "2fa4c4b3-ed44-496f-b64f-462041523968", "value": "T125341355FFAE430DC882747CAD1AB5FE0092CD894E18B3872895FE9C13B097B59E2653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722487, "uuid": "e5c83d3f-0ab0-4ed6-86f6-51308bef300f", "value": "3072:W49z0W930rTq2xnkNWDy3pevD6Xh3EZgjNDlhsedKO6+jTIwS0TRcd:W49z05nFDy/RJZQ3GIY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722487, "uuid": "1fbd7fd6-5e16-473e-94c7-06bb92c14ab9", "value": 234504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722487, "uuid": "5085c7e1-2722-48dd-b1e8-5c16808ed6ae", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722487, "uuid": "b8247840-358c-4822-b1f4-f2c08821c2fa", "value": "PO NO. 019-B.K2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbdd1889-55a2-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1638691850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691850, "uuid": "f1ee25c7-5e3c-4e3a-b164-8836d183b31a", "comment": "Malware payload (njrat)", "value": "bebd941b4409078ae28ca82a57a01267", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691850, "uuid": "b41a9426-8efb-42e6-838c-169b57013ec2", "comment": "Malware payload (njrat)", "value": "926d056638d111d3d7f7605ba6e584a71e1c0d36fb7f9e78762ccc2669b30ad9", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691850, "uuid": "30a1682a-76c6-4247-af0e-af5b9cd8cf47", "comment": "Malware payload (njrat)", "value": "f52c249b1b844d30267d32bbde4e54eda2bcf892", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691850, "uuid": "40d50cf1-4807-4507-bbea-04601121b682", "comment": "Malware payload (njrat)", "value": "04bdf4f0038b854431625eb802368e9a08f333eead69f0bea3c81c000f7b2095ebace3477b6d2a082e8c0232148b7adb", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691850, "uuid": "11cbe301-19c8-48b0-a995-76249ba97182", "value": "T19DF05C299C04BACE0141ED9BC0D70C6FC91180860E6455256171C2FF82565CE90AD05D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691850, "uuid": "6693de20-9c28-4101-b425-97969a54add8", "value": "12:rVlZoY6aVXaAUzVE4wdMDJ5Y3nLjGTOb5NjyNQ+y4OIlC:rVln6aVX5U5EGDMLjywNGNxy+lC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638691850, "uuid": "c202de1e-643d-40fe-b6ed-ca5ae2dc40d1", "value": 555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638691850, "uuid": "6981020f-b1d7-4b6e-b3c8-7717433ffb13", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691850, "uuid": "f7c326a9-60d7-417a-8371-caf91784c8b1", "value": "746390_Invoice_Payment_Copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a3dc40-55f9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638729065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638729065, "uuid": "28f62ba8-1dcd-4442-b5dd-5248620deffb", "comment": "Malware payload", "value": "c4cef95787a2631a8acdaea146402d79", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638729065, "uuid": "4078b244-5785-4889-93c7-d0c069ad07d5", "comment": "Malware payload", "value": "92e93fcefa196af22f19e85f52ab21aedea3f38d2d90e5a67cc5bca6297cb683", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638729065, "uuid": "dc2c21fa-5005-4f3e-b098-07e61191d920", "comment": "Malware payload", "value": "07352b53332f999617c43816560c5aba65c78344", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638729065, "uuid": "467b5085-bd3c-48b5-8e3a-4a52b2420c34", "comment": "Malware payload", "value": "0437f2c0ad1c8c74c7d198cfccf93a0dc3ca0e5cb9ae7f85ea56cdf61736709c57d5c13d452f8f7a6efb9636fe6e1ef2", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638729065, "uuid": "962432cc-ce82-480a-8d5c-7a5e7dab7516", "value": "T1FE51851AFC47D14C6BB9236BED87C622FF1B811B5D96100C71DCC2491F30808A6ACF8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638729065, "uuid": "30599f51-5b36-4d67-9dee-c8d1dfcdacf9", "value": "48:AdD648OjOLuDQjvUKmc4TQ7QZE96pAUYRAz+oyWKLrj6l1CelkEJmZK620oGhl4X:tWChrffUypvK0elkEYZN8Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638729065, "uuid": "67469871-403b-4f7f-a089-2ffa856e5fb9", "value": 3162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638729065, "uuid": "96b92f1b-758e-421b-91a0-5178a44a7bbe", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638729065, "uuid": "2ec81487-e2fb-4587-8b79-d6343049a7a8", "value": "kRybpCas.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc94ad1e-55e7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638721459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721459, "uuid": "39bd0ad7-650d-45b0-86e1-257cf8cbaa83", "comment": "Malware payload (Mirai)", "value": "fa42a76f603cca2fd628214c81e53e2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721459, "uuid": "8292812f-6af5-442a-9ed3-cd322dcd157e", "comment": "Malware payload (Mirai)", "value": "9401e350475384077beb7afb948c4bbe1598fccc62c102f185aaf4838dd1c938", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721459, "uuid": "36ed82a8-e232-4377-908a-565cb1d29455", "comment": "Malware payload (Mirai)", "value": "a945699edb14a471251e768ee272541eb18f0b23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721459, "uuid": "a45c4431-cf09-43fa-af98-6748ba48643b", "comment": "Malware payload (Mirai)", "value": "65b5eb2c22ccb9563c6160dafce381e531aedd482a98f1793408b0b05df946510b02f3883c3ab35095fde83cfec86df7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721459, "uuid": "30fe06a5-0639-4016-8d5f-fead1b4b3b53", "value": "T12DE3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721459, "uuid": "36526802-1ff0-43f7-87bd-363308a482e2", "value": "3072:OaRBoUm6Oq+loza5hdyXzhsURxuZq+1uPNd5R:OaRBoxq++za5hdyqURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721459, "uuid": "634d064c-2929-4a32-847b-c18818eacfee", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721459, "uuid": "86c50a58-5178-4caa-9e07-30b5e1c0a6ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721459, "uuid": "9c1faf43-f148-4465-beae-0b667fbad75f", "value": "fa42a76f603cca2fd628214c81e53e2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2322d4dc-55a0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638690681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690681, "uuid": "9e64a3cc-b512-4ab2-beda-92e30589ac00", "comment": "Malware payload (Mirai)", "value": "494c5c59b07db9c4d9d01c9c821e807f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690681, "uuid": "e1ea53b2-3f3e-40d5-8af3-2764483f135d", "comment": "Malware payload (Mirai)", "value": "94a0ad56aa83455362368b992f60eaabc67c2b45d8f80080f70bd3e3d3b6f16a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690681, "uuid": "3cc20432-78bc-43a5-9cf4-527f020b1441", "comment": "Malware payload (Mirai)", "value": "643cf7e44dcf6de4be132d91e8c90039985c2069", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690681, "uuid": "976daaf8-57d8-4fb3-aea2-e3c0bdb0aa75", "comment": "Malware payload (Mirai)", "value": "5da65c20951c21f130bab3f3a18d415444053ea90e539b46921ef4203e8a4ba4a72fada219e236a9c9a58274f5105664", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690681, "uuid": "f2f67651-962c-4e5e-8d59-e68a9c490e32", "value": "T1EFD2E16C8D150BD3EA88D0FA26B48F813D959AD1B8956E17636DC3F34E414F63B118F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690681, "uuid": "05524f74-2838-4421-9b06-36df87c7e026", "value": "768:T8k8kC4tQMgW1fC05S8M2Bx4l3JgGlzDpbuR1J0:T8kdC4rdC04qB2l1VJu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690681, "uuid": "9c0cb1c6-f8ff-463e-8c10-435f271636cc", "value": 30692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690681, "uuid": "4b3b823b-b730-4a66-99df-11986e7a01ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690681, "uuid": "d00cc37e-e5c7-400f-bdc2-f1d23cce4e26", "value": "494c5c59b07db9c4d9d01c9c821e807f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f40041-5624-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638747320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747320, "uuid": "dcd7d2e7-e5cf-4383-a322-0623f6a78c86", "comment": "Malware payload", "value": "39cde58579f83bb24785406a542c799a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747320, "uuid": "3cdf7dcc-8526-405e-947c-dfc75ecc924b", "comment": "Malware payload", "value": "94b105b922a1b7393fdb334e6cc632daa67fa48ec85b3212f5d98773d140bb87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747320, "uuid": "5af82bed-7d7e-4483-bf9d-1dda9a170238", "comment": "Malware payload", "value": "53edd4610936e0841f15cb2e12f9edd2cd6be83d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747320, "uuid": "06656310-9dd7-4708-943b-935396de8ffb", "comment": "Malware payload", "value": "af08a66dab297d4561aa12e275783e844e28a2947d7bfc2292a2a4a6b8fff922c793a6c9c5ce5fe9e06cef1b70a67e0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747320, "uuid": "c619bf67-4bf6-454a-bbf1-14cf09ca2ffc", "value": "T156452313AAE16679E4E653B54FFE95B20778B8E00375435F7248E2D998101C27F38B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747320, "uuid": "68259735-2ed1-4bb0-baa0-3fc04c1db74c", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747320, "uuid": "75d9f145-01a1-478a-8966-6c8d1aab4860", "value": "24576:ySXfCWEHPx3Vrm0TNii/3fY1LJYogld7ZE/rq1svljRSIntPJ/tp3F:NKWuRVrzEi/QrhglVZqq1slRSIntPJFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638747320, "uuid": "fc145323-83ea-4ae9-b417-8c9d0d9d49a3", "value": 1253376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638747320, "uuid": "5ceab484-afac-47b3-993f-b1c91e87b5a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747320, "uuid": "08cd5cd8-6905-4f6b-b673-065f42b32296", "value": "39cde58579f83bb24785406a542c799a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d422203-5626-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638748277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748277, "uuid": "bd37ccd6-824f-4c77-9f19-2ac12075b877", "comment": "Malware payload", "value": "a9bc4aeb94664b8938a00b5301225d7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748277, "uuid": "72d5bdb2-3c8c-43d9-92c5-c70121fc34d9", "comment": "Malware payload", "value": "94e99f4dbbf9739b71ee8dad26651b8cd01cd3c5bb6eb97da26d88991351cf6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748277, "uuid": "4be5c9d1-87b4-455b-8f94-00957e1fdb79", "comment": "Malware payload", "value": "9a0ecb70fc029faeb968de0e639537d6baf525e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748277, "uuid": "1db49a89-64d9-4111-b7a7-8af2cffc72f1", "comment": "Malware payload", "value": "b7f6b03cde71e005335ee673dfb48c1bdd80f75eef8b600ba99f8ab201422fb887e93236a2a30bbb00f6be42687bbf54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748277, "uuid": "f5c75994-74d5-4257-babd-e6e7df3b3d1c", "value": "T1D2D5336272C8903EEBE1277483D5E5AB2F3C75F01FAAA39B500825E968506D13E3475F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748277, "uuid": "1cc4ecb0-89c7-4457-ae3e-4b2386d93f0e", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748277, "uuid": "8a52b339-a799-491f-a19f-6428dc42b467", "value": "49152:O4YsCnm+G5CwFsdS4oXeL6gP0DEZ1kMfAvMySPqrNdI+1pNqNTwhSSZrsYKtn5Ej:O4Y37wQLJUw1kMfA0mk+cuhQYKt5Eo5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748277, "uuid": "55571e29-4ead-4a5a-980f-6ca4d8b972b8", "value": 3003392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748277, "uuid": "648a369d-5114-4b76-b8d9-772b36a80a5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748277, "uuid": "27bc24ae-da13-43ae-9dc7-38ed1a4d9cfb", "value": "a9bc4aeb94664b8938a00b5301225d7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00c8bbe-559c-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638689280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689280, "uuid": "bf2e7073-8db2-45a4-bc5e-7b35c25f8bd4", "comment": "Malware payload (CryptBot)", "value": "35e94bc26685c416ae982b1ab5576706", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689280, "uuid": "6f41e088-6c82-4194-8778-4a4a07fbed87", "comment": "Malware payload (CryptBot)", "value": "955faeef4e0bcb2222b987b9ff740f76d15420802dd56761196bada5413465fc", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689280, "uuid": "c19e22c1-491c-44ee-824a-1c13386ee1a6", "comment": "Malware payload (CryptBot)", "value": "10998640beee9fe1322f596fc0527c0cadb61a6d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689280, "uuid": "e73b9845-c140-4820-9ec0-a699a8e47974", "comment": "Malware payload (CryptBot)", "value": "c9d2ed7a226b02447d52aefc2bdd6e73ccb30d3ef04b434d902818c9e530a905c18c987357523f10653ac7bc86fb4145", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689280, "uuid": "74be4098-a001-4deb-82a8-901317f8da15", "value": "T16884DF1576C0C032C15225768A15CBB14EBAB431176A6ACFBFD94EBD0F246E2E73534E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689280, "uuid": "b1b68099-9869-489e-b7e3-e4f49532487d", "value": "ace494ecc2c2c2c7ecf836ae6aa78574", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689280, "uuid": "f5eb8480-4810-40bf-93d7-69d82d9707cf", "value": "6144:erbO80/WC5S7uKS2F870utDUCCda3k6AtmZ6Y3OF:erbJQfyuKS2FeNCda3GYFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638689280, "uuid": "e25d2a99-70a5-4a2d-b932-e1a2237efe0d", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638689280, "uuid": "4958349d-5407-4c0a-b70c-7cf4a57e4b38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689280, "uuid": "4a597ce7-6de4-41d5-8d97-6b3334ac5353", "value": "35e94bc26685c416ae982b1ab5576706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ff3a3e-55d8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638714702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714702, "uuid": "0792cb92-18e3-4d84-b85a-7a42695c26fa", "comment": "Malware payload (RedLineStealer)", "value": "eba3619366f4f6e9734b2d855e9a22a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714702, "uuid": "c685cb91-e970-4f07-9de1-60c4439e3eb8", "comment": "Malware payload (RedLineStealer)", "value": "97999fbdf6796e404338f1ad462f3743f217646dcd882f839ea5294e8f54c14d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714702, "uuid": "7ea2b47c-3e0d-42eb-8ce9-aaafff637a31", "comment": "Malware payload (RedLineStealer)", "value": "3adbbd5a794de93562bf84aabe7e1c1c146ef859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714702, "uuid": "26a2a714-52ce-4d6d-987e-2da0999f36e6", "comment": "Malware payload (RedLineStealer)", "value": "6b538c8931f265da0e4319c75bbfb40f22db8cfa0ccf47b8377bbbb80ab5ec4d317cfe545099423c04ca595e9a49304b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714702, "uuid": "59166fe5-e048-464d-a988-7d4cbf722279", "value": "T11445333DE3243D5ACACB7978F18CB215F6E0F765A6F4E34B980A889E415A44BB44C0F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714702, "uuid": "2bf53d82-7c55-4642-a9f7-1bc48c667629", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714702, "uuid": "ce9431d5-555d-4625-8a02-65248d171ae9", "value": "24576:SY8H8VKSjKtbYVLyJQzwViFjByNsnzy9kEaHNYK3T7oy3NVzL:D8cVKTPRg6NaFU6NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638714702, "uuid": "4dca3c93-6818-4cfe-839c-96dadca3694b", "value": 1269192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638714702, "uuid": "4ebe8cda-4448-46af-ba6c-d2220ba6f49e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714702, "uuid": "b98f2222-609b-4fd4-b297-206f02605a3e", "value": "eba3619366f4f6e9734b2d855e9a22a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898aa6d9-5570-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638670237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638670237, "uuid": "977d2faa-46b0-4d79-8150-1debfb4654cc", "comment": "Malware payload (RaccoonStealer)", "value": "7d40254a8763b424ebd4ac3897e986ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638670237, "uuid": "5a4abb43-107a-4d49-a183-0d0d9a71bb18", "comment": "Malware payload (RaccoonStealer)", "value": "9817fe25bbb0efbe65661bb22fe3d3f43b666f4013a6d2673c6f38b12d3af35e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638670237, "uuid": "4d03cb84-c201-4c4e-99b9-e84d007e71f4", "comment": "Malware payload (RaccoonStealer)", "value": "cd7c670c879d76abfc6c8c7893cc619c610a0125", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638670237, "uuid": "7503a26e-5e52-45f9-919c-75c866ad9634", "comment": "Malware payload (RaccoonStealer)", "value": "ff68fefd5f04de197cc149d68ebd70ecb1dceade5b59b105e3bb3bbe4c38e658c2862f07b3700aaea22cd260503a2952", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638670237, "uuid": "47734e21-08a0-460d-8516-32466262a121", "value": "T177C4F12133C0C173C05724729616CBB19ABAB871577A59CBBBC40A795F24EE1BF2631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638670237, "uuid": "e029b6da-7ab7-42f0-b7f7-6633fab4dce1", "value": "ace494ecc2c2c2c7ecf836ae6aa78574", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638670237, "uuid": "2098077b-d5ce-4579-98f8-a1924b01affa", "value": "12288:yX16av37wrIlww91nDdymaxCzCzrEfphWVU:yXQajwy91h8nzwfpAVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638670237, "uuid": "8df6e3f5-7c9d-47d6-a46a-0bccd900615a", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638670237, "uuid": "052cba24-5a4c-4369-845f-06b13d215718", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638670237, "uuid": "34a9445f-fa10-45b1-a691-1c9a6504d6e6", "value": "7d40254a8763b424ebd4ac3897e986ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db1f710-5625-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638747822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747822, "uuid": "03d8bf18-5b08-48a3-821f-880c9f00aada", "comment": "Malware payload", "value": "f74de7d2209097e3d31544d0197cbdb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747822, "uuid": "f301caeb-5acb-41a4-b232-8164d6e3ce2b", "comment": "Malware payload", "value": "98d93834f17d6f7bc2c5251740d38b8ba569c03b84e6f0124c2e519b9c61e40c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747822, "uuid": "5c174f87-1ccc-4726-a44a-b5949086c497", "comment": "Malware payload", "value": "f647675317df4e10dbc91dcf181be7bbe5ff1da4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747822, "uuid": "83a70083-6e45-4188-a428-55d0e61badbb", "comment": "Malware payload", "value": "4b880c84023242846caa1a16536b7a13a62fa89c6cea7ed00a0ccdde8eec22b39ecd4c2d438bf43d03d8f4c68bafd2b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747822, "uuid": "cc45be4d-97ce-4571-b65c-144786d19c6d", "value": "T165254AAA7797FD0BC2D62673901EC45086E1E7015262E336F9B702A32E5F3B18E5B1D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747822, "uuid": "d322d90a-a6c2-4f60-b590-67441a3607bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747822, "uuid": "621f9625-03d6-4048-b62f-60f450ad20eb", "value": "12288:LoTEp3/wsY3nBPf+o58LOeqFXWg5Wb9kYAwObZxHBxEbVqHGpaGhV:LwEBw7nBP2xHyDUb9krZ3oYpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638747822, "uuid": "88674cb0-d26e-485b-b7bf-9b8c6320505c", "value": 1024736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638747822, "uuid": "6cd1f40c-57ca-41fe-8e31-9fa29bd6ee4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747822, "uuid": "a7c0cd99-8232-4676-aa70-ef461ff3aa25", "value": "f74de7d2209097e3d31544d0197cbdb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a6cf29-5562-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638664003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638664003, "uuid": "3e5d65c1-3c1d-499f-b30b-3970e6b68982", "comment": "Malware payload", "value": "cf8e6965fe371fc68e2361cf66a06006", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638664003, "uuid": "09a79c60-c7eb-4744-8d24-bd820437dc92", "comment": "Malware payload", "value": "9a75208b354c06d55dead340250992759b50756a4ca942d82c5a09e3956fd11c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638664003, "uuid": "be098ec9-99bd-468e-9603-76573114865b", "comment": "Malware payload", "value": "2e0361edef7568edb59033ab658b4c4e1c6ba8a2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638664003, "uuid": "35db6a07-ae5b-484f-9318-00b0730604bd", "comment": "Malware payload", "value": "f8ff038335dfe2359d86d54e179ebbd173b9613d888073d36ac8a08506f4d718abcb686a7cdd6261a639535f3376f5e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638664003, "uuid": "62dd614a-d3d2-4854-a188-a88f148d4ca4", "value": "T19AD4AE1277C1C076D56F02314916831C72F2FD908FBA86876FE96F2E6E701D2AA35726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638664003, "uuid": "2e02f8a4-0ab8-4e5f-a187-4dafd5eab47b", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638664003, "uuid": "e2fc65e9-0b8d-4fb8-bf57-453c47d5f9a1", "value": "12288:WKEUkuAOLka1miSmuYr1V7sAobS3qTHPR101D:TEQLka1nBV4AoS3WvRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638664003, "uuid": "34083f81-5d6b-4276-8321-aa222a185ae6", "value": 654888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638664003, "uuid": "a128fd7d-48e0-4679-9c3b-211e7de45020", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638664003, "uuid": "ded8aecf-a6fd-4fda-8192-0de08feabe30", "value": "emotet_exe_e5_9a75208b354c06d55dead340250992759b50756a4ca942d82c5a09e3956fd11c_2021-12-05__002638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9961ab-5613-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638740121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638740121, "uuid": "f53d7309-74e8-477a-ba53-a04122ac9d60", "comment": "Malware payload", "value": "99ae9a54f9f9e7c26579ae432f4402fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638740121, "uuid": "a8edb737-01c8-4740-beb2-efb28c29a7ac", "comment": "Malware payload", "value": "9b5ed328b480c04906ccd41ce1a536cfa5607e51acf66fb21910b1859eb0a73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638740121, "uuid": "e3d559ca-fcd6-4c5f-82e7-12d940d5defe", "comment": "Malware payload", "value": "37a4e7e337165cf476f8d4797829435051043f12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638740121, "uuid": "16261032-2717-470c-a218-31158f15ea45", "comment": "Malware payload", "value": "ca2cee9ae5bff0500f9280146ff2a9c9658d338b81bc6f8e3712f94b2966d7b7c65b5927dcab31c96b01cb0cabb0c254", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638740121, "uuid": "5e6acd8e-a890-4c10-b61f-07496d332d99", "value": "T1B075337F2A89267FC5671C363021BED4A230B2F7F1C04975A6CB7613E9B4060792F696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638740121, "uuid": "36d6260c-5066-451f-a0e2-d1ad2922fad0", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638740121, "uuid": "d071c285-b7c9-4617-a468-6644da492f72", "value": "24576:b5LYuiWN0nkrSr4b4CXSuFlZF2NvA7bcNAPxhLE0Adjkf+BkEaHNYK3oxT/:b5kdWNEr4b+uF92NIBhLEdjkcNaW5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638740121, "uuid": "f7769d69-28b5-4939-b352-abfa57294c5b", "value": 1585664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638740121, "uuid": "12916cab-d5b8-4dea-bbb2-1f3b7abef1df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638740121, "uuid": "433f4b23-5570-4e7a-8587-b992f25164a3", "value": "Glich Hack 1.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63f0f81-5584-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638679009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679009, "uuid": "edf46569-084d-49bb-bfa9-859d43d730df", "comment": "Malware payload (Gafgyt)", "value": "f62f0fee128a2d41bcefd4d2668e6158", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679009, "uuid": "b35e081a-2032-4562-a5e8-641a71dab9a1", "comment": "Malware payload (Gafgyt)", "value": "9bdaacbd7844ec35dbb190546494b5b2b1274046cfd0cb04d97d5b5e78dcb364", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679009, "uuid": "38fe2c33-8f45-4699-8c3a-178c4b2a5999", "comment": "Malware payload (Gafgyt)", "value": "9f6cd4f60a4041cf1641e3cf20d5e649d0e4fa5d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679009, "uuid": "3ef3151c-82e9-4f57-9708-d8fa86474c35", "comment": "Malware payload (Gafgyt)", "value": "cecaa918867194de8fbac025cd536ce5d96646696941feac295d594c254fdb33cd6a68b6739aa4ea6f12bd5b97ce524c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679009, "uuid": "0da91ecf-bd82-4002-80ba-855c3737dad5", "value": "T1BFA32907D660843FC48B93761BDFD2229123F8B91731621B63D4BEA92F269C9DE59343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679009, "uuid": "d8dd38b1-8d1c-44c4-8190-699227fd8063", "value": "1536:Lfr23bInjBwTxb35LrGWO4XJM9wyNZzEv/FpWugL77e9hBKCmsITDUZHo1/:LvnlQL5L6Tm6ZzqPLgL7mKCmdTDuHo1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638679009, "uuid": "e923e557-0879-4d9e-af87-484d7e2536f6", "value": 102445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638679009, "uuid": "445b01c1-b5be-426a-962f-9023c6320091", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679009, "uuid": "7ce43baa-d831-49cc-9d2c-073372798248", "value": "f62f0fee128a2d41bcefd4d2668e6158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617e006e-55b7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638700664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638700664, "uuid": "b7f78871-1af9-4b0b-a2aa-86464af851df", "comment": "Malware payload (Formbook)", "value": "6f94fda6019ef17bb6018b3775113da5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638700664, "uuid": "f133747a-bf21-4652-bbf4-6e3b416d3c36", "comment": "Malware payload (Formbook)", "value": "9c87ae78442d9bc2148c24b455e344deda13c70feacd75c4796ab9c91b18015f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638700664, "uuid": "2c488024-662f-43fe-a00f-732a062e11d9", "comment": "Malware payload (Formbook)", "value": "052a4dd798ae37fa7867eb6809033fde3d396382", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638700664, "uuid": "f37c3208-87fc-4e81-8af7-e9c323fc5e62", "comment": "Malware payload (Formbook)", "value": "f0d5d00b4d8654e1e1c7dd04b8e01c93bd4923d7549cdbb540f721ac6ab816e9befa1f062c15d77f63b19beb79f1d5f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638700664, "uuid": "2ddeb14a-6976-4c41-a76a-bceb71d99a19", "value": "T12754121317C9F8AEE6C205392EF3BB39F7BE92E602615C132BC81C5B5C611C65393566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638700664, "uuid": "7f9938c7-276b-4edb-886b-ac61ec6563e7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638700664, "uuid": "e65c2047-41d7-4b3c-af3f-139f855a56fb", "value": "6144:rGiGHm919I/0deczYtM69ZtiIB9RPbPsgQVGrtPHXl:6HW9IkrUZ8SzkgKGR/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638700664, "uuid": "7a35fa3f-386d-464a-8be8-01cfdcaa2a85", "value": 300704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638700664, "uuid": "24209e65-84bc-4b96-b87a-4e1d31563a4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638700664, "uuid": "555921fd-0431-40dd-83e7-1c3bbc204377", "value": "6f94fda6019ef17bb6018b3775113da5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6202f9f6-559d-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638689498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689498, "uuid": "9564f9ff-98fd-4a36-a14d-437d66cd846b", "comment": "Malware payload (RedLineStealer)", "value": "2340130368d9e758b1ad16c99fc731c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689498, "uuid": "13dddd49-1d1a-4f6d-bc60-867393a3ae5a", "comment": "Malware payload (RedLineStealer)", "value": "9cd310fb686501850284a07302aa98a0248a4bb362767dae0ee9db2fa6f062f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689498, "uuid": "d47d25e4-c602-4a31-a828-4a53ccbde5cf", "comment": "Malware payload (RedLineStealer)", "value": "05c733bf658bdc5ed0455e114cc79c3c2ee67eba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689498, "uuid": "860e554e-4f78-4c9e-8653-9eb371e016d6", "comment": "Malware payload (RedLineStealer)", "value": "a8b20a90c1a8e1b5078360ae851d7d0c47dcc236cce34568ffc6d558e408348c61c3d1fe38b37c8500432f35e5fd882c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689498, "uuid": "b22d79d8-1dd6-4b1c-8118-0d2d95e4cf02", "value": "T13F25DC1FEEC686A9E943077685F3BB804BBA50D9DF3F13D89318A5E34B891701BC0965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689498, "uuid": "4600169f-525a-45b6-b3e6-fb1a2c7692c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689498, "uuid": "ec16227f-7167-45b2-ad12-6818c7226f0a", "value": "12288:u/yOyu56zUR4vybrV65uEaTKE1FGBkZl7zmuyfavZnBjg0qkc:u/x1vV6UVF3GBAdbkkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638689498, "uuid": "48cc11ae-0d29-4688-bf3a-ff87073402a7", "value": 995736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638689498, "uuid": "3a2b1c24-8c44-409b-9d5a-ab0845a7e1a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689498, "uuid": "f9e30baa-d022-4675-aca1-7596135635fd", "value": "2340130368d9e758b1ad16c99fc731c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70616e28-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638722593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722593, "uuid": "fcaa6127-9fbd-4aa0-b213-010c6c6f4080", "comment": "Malware payload (CryptBot)", "value": "91bbff1742b342de1c4c44fb60e71d31", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722593, "uuid": "14c081ef-9a1f-46d7-88b8-6557d26cee6a", "comment": "Malware payload (CryptBot)", "value": "9dbbcad853c71490032395a652d1fb05ce5b744be82edafc6d573a7fcfbed2c7", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722593, "uuid": "0955708c-c16f-4dac-9a35-a9f1d9f4f39c", "comment": "Malware payload (CryptBot)", "value": "719b8c5ceb5cf0c626a267d5fdb48aca8c532b4d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722593, "uuid": "a93a7f46-f578-49ac-88a1-824e0fabfde9", "comment": "Malware payload (CryptBot)", "value": "baf870663c7e587f1ed397d039b24d3acd75db8eb7b84c36548002f90d8cd831e3b81ae40886e1c70a20255998c8bd75", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722593, "uuid": "fcf3404e-8390-469b-9d77-273eec973c85", "value": "T1BA84D01172D0C033C08665768826C7B15EBAB5700BA66ACFBBD85FB94F247D1A73530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722593, "uuid": "faae8c69-f045-4f60-91ac-9c04b1480df0", "value": "0b870a764fe48d43832954ba0c8fd163", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722593, "uuid": "35d132eb-bf34-4755-b41d-9dd90acbd26f", "value": "6144:yAuLEtzidpLR3nCDnCPPvRGFpSz33P3vT/BVaVG+f+yRnj7g95P6:yAuL8KpLR34nC3lkxRqfP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722593, "uuid": "0d7ff950-3eca-41b1-9656-a907c458b6f3", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722593, "uuid": "22611e2e-ed23-49f5-9fef-e90eef9d1692", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722593, "uuid": "a794df79-89d3-40aa-a678-072d9f7cb2d9", "value": "91bbff1742b342de1c4c44fb60e71d31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec62cae-55e4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Neurevt)", "timestamp": 1638720148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720148, "uuid": "92e75269-2802-40dc-afa2-6120508eecd9", "comment": "Malware payload (Neurevt)", "value": "fbff18a879c2a26601e5d4f366640ede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720148, "uuid": "7a9a0aa8-1fb0-4424-83ae-0a3b6dfee8ea", "comment": "Malware payload (Neurevt)", "value": "9e4037f440474202a6ddd5194a9dca8dbc2b9f51e399ec42a465ba98c7920912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720148, "uuid": "66e51468-d1e5-4f83-9e76-66e38a7ad94a", "comment": "Malware payload (Neurevt)", "value": "ef666c7d7ec1667b668ebf1c7e38876382da2fd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720148, "uuid": "5ad06d17-95a0-475f-b0b9-1f84c56ccfaf", "comment": "Malware payload (Neurevt)", "value": "17c06c18bd15c94f8fcad618b3cb9df886d4910110e9781257b504a90273ffa1c000201eb1da4a8af334ff69dd1a184c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720148, "uuid": "af41c11c-419e-496e-8d28-805ce4c046f9", "value": "T1E7D4382839EB6C2AF1F3EFB25FD4F5A7DA6BB6233A07941E104103077522981ED91539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720148, "uuid": "f6f0d506-95d4-44f7-8769-5080c70221ff", "value": "52b75015bf1b3143b8d858eebbaf32a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720148, "uuid": "ee4559d8-9c39-4f97-9d8d-3c5a51f55e9a", "value": "12288:nGfi0rOGwPLH92gDkoH73oxsUEyditPgcmklfrrlY5dHe:G60rORr9jb7Y6frNTaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638720148, "uuid": "cd1f449d-598a-4d80-93ca-984c50fb5a1b", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638720148, "uuid": "57ab31b8-f272-49b7-b987-4b3a64a20a2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720148, "uuid": "39bee01f-43d0-4e40-90fe-6371e737757a", "value": "9E4037F440474202A6DDD5194A9DCA8DBC2B9F51E399E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6ab3db-55e4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638720006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720006, "uuid": "0df42675-f9be-463a-b9d2-ad53287c6795", "comment": "Malware payload (Mirai)", "value": "66cf03c37b3ed29b1bdd7ea7fe6457b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720006, "uuid": "791c8828-3bc5-47d0-bd71-6f1081df3956", "comment": "Malware payload (Mirai)", "value": "9f02853a383218a8d0056b8390d52b0b48fc756da693a603244df4e2f6ca8765", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720006, "uuid": "7ec5ae12-6af3-4661-841d-1bebf01cbf1d", "comment": "Malware payload (Mirai)", "value": "dcf658e3f01bea8b8474c4c1b34c4f979b47691a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638720006, "uuid": "222ba93e-a318-44b9-9cd7-5963566dba96", "comment": "Malware payload (Mirai)", "value": "c442b8c677e49b9b6959874a7d45dcd7fe7dd71ee86891b2fd19a67bdaec31603f8795e309fd95260abc60c11aed49d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720006, "uuid": "cf14dd61-848e-42e1-b24d-8a5880c5dbb2", "value": "T189432BC5F941A622C7C15677FF0F0289371A978CE2EA330399295FA537CB9570E2A216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720006, "uuid": "152fbff6-8b7a-4222-9c65-055f40babf32", "value": "768:Lkjodt/+nrD+B9TagcFpaNDpHeGXfO+ybDgVNIhIxeC+rs+4cqbJ6lftm6bEUHK0:r2nS9TxsCoJoClEQJAsAbLOav1svkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638720006, "uuid": "6e6df2a4-0a1a-40cc-aa45-043c1c351e61", "value": 57316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638720006, "uuid": "ae8cd978-c238-4456-98c8-f78747f61214", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638720006, "uuid": "21c6ec8b-325a-45ff-a973-4c44537195a4", "value": "cbr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e98b4f-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638722549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722549, "uuid": "fd739af3-b696-4400-a719-e146c771bd12", "comment": "Malware payload (Gafgyt)", "value": "3db80985e0f8dd4dd7da9ab0d24c070a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722549, "uuid": "a4a2fca6-7de1-4f2e-973f-e260c8d10bfa", "comment": "Malware payload (Gafgyt)", "value": "9f3f487ba6c97f760cc4f7af8b7e3895eef881a4109bbd3c4992f4017bfae361", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722549, "uuid": "70634c9c-60cb-48fa-a3d9-12a7b66ecc3b", "comment": "Malware payload (Gafgyt)", "value": "557cb3f4bf8124bde65c43dda30d8b50b9811b50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722549, "uuid": "9f66fa21-6c6a-42e4-a3a4-fff7ad73e2c2", "comment": "Malware payload (Gafgyt)", "value": "e445e01b566e85a217c9d7172082d63dccee783e0de3e75ffd69ce30d826dd020e6fa627f9d96158b2992eaf952bb050", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722549, "uuid": "3b3ef4b1-5b24-46b9-b051-5eaf6182fb80", "value": "T1B593F793F901DF73F40A977604D74B217630FBA14A932A62732739A6AE722D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722549, "uuid": "8a70ebe4-a001-41e4-bf6c-f476f254c1e4", "value": "1536:k4lQ71Sh8LrjAGJ0+QmiaGEe4V987Dtgiyrug+P0jwKTmQ9VqXjewf2Le:V671SWrBJpTZo7RgiyrurdOmQ9VqXywp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722549, "uuid": "cdff248a-fd93-4173-b016-b33f3c105796", "value": 93258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722549, "uuid": "db3a9b03-e217-4430-96a0-598474b3cf04", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722549, "uuid": "685fcaaf-e2bb-4084-9df7-f055384fef18", "value": "3db80985e0f8dd4dd7da9ab0d24c070a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210bc3d8-5627-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638748659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748659, "uuid": "80838e28-6b52-4787-8a29-f8babbf5a9ac", "comment": "Malware payload", "value": "29b96ad6db686fe1786edfc466eb6a2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748659, "uuid": "80069f93-dfcf-429f-a149-49673cef82f7", "comment": "Malware payload", "value": "9ff74673a7307c3625a0f61fec014e79dbe25d3c467647d5c192c2185ebf128a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748659, "uuid": "cca1dd70-267f-40f3-8659-2e9002e18215", "comment": "Malware payload", "value": "f061f5e0d767074d452c02d8647a7fce10da6288", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748659, "uuid": "748200b9-83c5-4565-ae48-ca3aeac10c5a", "comment": "Malware payload", "value": "008dc417d58f3c9eb901e9826da66e09b86a08c7f58037d0796b15ecf700299eb8c7a11f6b40d07ddedee20e28344bad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748659, "uuid": "567b3429-c40d-4b07-ba08-3d77b336b9d4", "value": "T14A255C2A77D7FD17C2E626339429C45086E1A710D252E376FAFB02A31E4F3B14E6A1C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748659, "uuid": "d2bb5849-caa8-451a-ae23-85e1814013e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748659, "uuid": "9411a223-089f-4183-9319-cd00296f1523", "value": "12288:f1DQVwq+VezkObjIEvcgRVo3kavgMRHOAm8QE2p5vEBKj4eXZ:fS9DtVo3n4AAvEI4ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748659, "uuid": "bb2784e8-fbb3-43dd-b40d-195faa85ef8a", "value": 1024200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748659, "uuid": "e11e0b3d-8e76-4a63-9a67-27906b8902ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748659, "uuid": "038dda9f-b8ea-4f1d-b1c5-f65a2704ad82", "value": "29b96ad6db686fe1786edfc466eb6a2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8124ce1e-55a3-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638692127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692127, "uuid": "1d5f8055-0fff-494b-a4f5-083c175b5115", "comment": "Malware payload (Mirai)", "value": "683113f3b13ba85899773c46e017cb1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692127, "uuid": "2b7247f8-6434-4f61-b0a6-9f6def7ffb4a", "comment": "Malware payload (Mirai)", "value": "a0f3f7576f19d8a1971c0f559013e84dba109ee750b407427dfe654bf05ce8de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692127, "uuid": "7a3f7ed2-5fbf-4fdc-a890-60c06e4a33d4", "comment": "Malware payload (Mirai)", "value": "f54fd692709bad8098eee3f7b9a95d75b055017c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692127, "uuid": "a5f2da80-1d97-46f2-9d76-b9a1a7744a33", "comment": "Malware payload (Mirai)", "value": "9a36392a628f537e2d1ba79ca5dbe4d19b13c5eb30494683bb99d4e08021b3cde2b388644d8f792251916ad8d1a84452", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692127, "uuid": "bc75a413-80f9-48a7-a6df-d474f639ccfe", "value": "T139F2E1AEE6C029C6DB9C69FDC6FD0352EB59A4C25C6C2E8A77188CC4497144BB85C4B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692127, "uuid": "4e096ca2-bf7f-444a-bcfa-0d94c53330d6", "value": "768:EkeQkqkDLoy2AGloL5R+FQQNJhrOckoXF+dmsATZ3WMm:EkDxkglO+FHJhrooXodmBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638692127, "uuid": "855a19c0-cf6b-419b-9c1b-e39f93a0757b", "value": 35128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638692127, "uuid": "92392fc5-e2fb-4a6e-b123-255578299402", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692127, "uuid": "d00e6c9c-3302-4e44-9b45-bac08aedcf7c", "value": "683113f3b13ba85899773c46e017cb1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c0465e-55eb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638723033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723033, "uuid": "bc6de536-4055-44ee-89f1-6c7c3ab08ca8", "comment": "Malware payload (Gafgyt)", "value": "f5b0773490cfe8c01f69a39716554bbf", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723033, "uuid": "99b7d873-ecb3-456f-9fa6-763fb45c2f8f", "comment": "Malware payload (Gafgyt)", "value": "a17e0d12c89da0774afd8a27ca7ec1beccaf9e9bb9b64579a01b5852b6f52856", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723033, "uuid": "90f9177d-b182-4bc3-9461-b8422620f607", "comment": "Malware payload (Gafgyt)", "value": "9d773ef66ba54d2e00c4b5c24cce2ca1e3d65010", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723033, "uuid": "8be5f2e5-73ea-4406-a433-13981e1abae7", "comment": "Malware payload (Gafgyt)", "value": "464615f31917545e62b0c5f2f96305230eb4e9166faadaa67769ab2d4aaa435ef13e9627c4cf0c56ec608fbafc053924", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723033, "uuid": "be7f6b50-0a58-4886-a629-8c5daab34fbc", "value": "T1D6834B27A552C67BC0C753B42BCBA9225433B4B90B37720A73F47DA92F168D92D5EB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723033, "uuid": "889306bb-decb-4c27-96c3-bf0c02b91a34", "value": "1536:u7p8Y/JjzN1NOql/udP2OfR2lFhref3j5CpvCowmoIYuOVje+ZNne:AHtzN1kBdPlQlzrevj5lmrYuOVy+ZNne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638723033, "uuid": "1c19e58d-7445-4136-a74a-72796fd0ceda", "value": 88650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638723033, "uuid": "b1f6f6bd-d19a-4504-8375-4a0d98df44a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723033, "uuid": "9f3fd6f9-81ac-4186-aa7b-33d6c90f4742", "value": "f5b0773490cfe8c01f69a39716554bbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a09c4a8-55e7-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638721214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721214, "uuid": "b33095d1-c174-4d29-99dc-0cf635bfebc6", "comment": "Malware payload (RedLineStealer)", "value": "49eae2dc90699f42769b651a8c69d227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721214, "uuid": "8102729c-a048-4a07-9c6f-a819f0ac029a", "comment": "Malware payload (RedLineStealer)", "value": "a2a016786b8fe135450ba0580450df69d6c6a859f8ed980138db8d8c3fede92a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721214, "uuid": "0d037a1d-96cf-423c-a570-8717d6214b62", "comment": "Malware payload (RedLineStealer)", "value": "450b3236a234ae2090f6140b520880b876253df2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721214, "uuid": "2e1bbbb0-f97a-42ac-93e7-d3744a625df8", "comment": "Malware payload (RedLineStealer)", "value": "e23a4ea085e6e8dafa6964294486881b97b1726e699c468eccd9b04225f2d86ddba4f82c45f9cd5dc86f182da8148903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721214, "uuid": "b3adf9e7-f464-4c24-81cf-4df9cc4d04f5", "value": "T1688533DE9B0C918AD5DF2FB8916421F5438162F0A3D0AF6A731B43B2DE540922AF473D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721214, "uuid": "7fa7a846-46c6-4bd2-8b80-21147a60317a", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721214, "uuid": "fa388ad5-eb78-4179-9862-dfa63f95ccdb", "value": "49152:49UkboWB/IjiZ5xencqSs4RTJXYGMO9d3/Q8jC2lNa1yNIQ:4aqoWwizxsatIGn9dP7rdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721214, "uuid": "9f594511-aae3-49aa-9eca-5ed537a7f545", "value": 1741824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721214, "uuid": "42f32b0c-57a2-405d-aa36-a19867addd60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721214, "uuid": "ff601624-84fa-45d1-9919-af08905c02da", "value": "DullWave Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815d3cea-55eb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638723051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723051, "uuid": "ea306d2c-838d-43e5-a986-d3ee6659b15d", "comment": "Malware payload (Gafgyt)", "value": "5a2c74f53cced58464342b9b214313b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723051, "uuid": "1101539f-50bb-4c66-ab9c-d69d384b806b", "comment": "Malware payload (Gafgyt)", "value": "a361cda0360fea2c9b810d97c50297a25e80dcb05c45fc1986807a4fd8286262", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723051, "uuid": "94bfc3e0-0d88-41f6-b239-aeb4cc3b2c18", "comment": "Malware payload (Gafgyt)", "value": "0477cec2ccf1ee511e3f9a630a11f74dfc4deb13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723051, "uuid": "0afb13b8-12dd-448e-9fb9-ca071f822aba", "comment": "Malware payload (Gafgyt)", "value": "053e0233d149a739e00e44a24be8539601581dd81d93af579491486cd4994b5de32bde6ddc3cadceaadc39bfc9fc26a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723051, "uuid": "dc9ae6cd-b569-4a64-ba0e-92dae7a6aa25", "value": "T191733C43B9619F77C0866AB522B75E300B23B9911F4F1B95713CAAF4474B8CDB80EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723051, "uuid": "c8af8643-a9c9-436a-bda0-a8f4da4bb86d", "value": "1536:WPM0nfJMKoe1tO8bfL0aiNa4Cm9Rx1uOmj9VqYLe8f26e:eHRToqbfIu4F9Rhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638723051, "uuid": "7727b1ba-c8ae-4d2e-84ec-9d00c8e5ebac", "value": 80432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638723051, "uuid": "2d6d56e9-eb81-413b-8709-55787aacdfc2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723051, "uuid": "105f9e92-6067-4df6-99f3-cbd264357fa3", "value": "5a2c74f53cced58464342b9b214313b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ce16f5-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708243, "uuid": "15158458-c037-4cef-ba29-9172964d46df", "comment": "Malware payload", "value": "9182e907dfc88cb013e0133438c73135", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708243, "uuid": "b6119b94-8e2f-417f-8fe6-ce55ed02e98a", "comment": "Malware payload", "value": "a4b2c8815fd3a7ecad7928472d4a1395e8f5cf43e8f63abd81e5b960d01f86ac", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708243, "uuid": "9e413161-c063-4788-b323-a181a54e437e", "comment": "Malware payload", "value": "108b1eedc301294a3a8065403ce0f0838ae47160", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708243, "uuid": "fac1ff6d-af8d-4a0a-a7eb-4376b5538f2d", "comment": "Malware payload", "value": "fe0546a0934a118c4b108c21ea5c3ddb0ff14031da90c436104072e2679576fe38f70092b86761d642c0d1d530162af9", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708243, "uuid": "5dd4ff1a-6e73-4ca4-958e-ecf0ae1d9e89", "value": "T19FC533105AD117C9E594CE2F2F9C993A043FDFCA7864EDD391E28BF1110FE96A662470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708243, "uuid": "e5d29bab-beff-42ce-8001-1e5d911c3703", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfY1:G1wwAjzIQOMK2GNKslgus106", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708243, "uuid": "d8ce0119-3e91-4358-9498-ef1649a918e6", "value": 2633728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708243, "uuid": "47c0259b-9fa0-4703-9e0d-9d505f34a6a0", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708243, "uuid": "7ad640d1-4ce2-4e96-afdd-dcacb89bb9c3", "value": "a4b2c8815fd3a7ecad7928472d4a1395e8f5cf43e8f63abd81e5b960d01f86ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c061ed-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638722567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722567, "uuid": "cb8118fe-0786-4ff4-b65d-21ad320b97f6", "comment": "Malware payload (Mirai)", "value": "46d9878529fb4ad1b831f012e5d25db4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722567, "uuid": "73cb6cf8-bfa4-4be3-ab66-b3e13eb211eb", "comment": "Malware payload (Mirai)", "value": "a57511faec31771f3cca69f741992ca18819a987ab1ce963bf6071590923c54b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722567, "uuid": "a5e71df5-78ae-4cc7-9469-2d997ff6644b", "comment": "Malware payload (Mirai)", "value": "c966e812edbcb96ece3a9f300a54ce5c6a4bd399", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722567, "uuid": "0d2a1539-b075-4c65-b7fa-adfb10251387", "comment": "Malware payload (Mirai)", "value": "0d3163e624a81583632ecdf64bdb0ae1cb6862588720941d00f6e6b53f9b8f62e0720049986d63e7cbdd38966acbbe5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722567, "uuid": "e1ee6e18-bf7d-48e7-95e6-8def3abf96be", "value": "T133632B4AD6C7F9F0CD850978206BAB3DC536AC323130DFA7E7C9B517AA66212605276C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722567, "uuid": "decb53fa-9783-400f-a370-5460dcd49d8a", "value": "1536:TwD0m25fMDoQidnT/0KCw8dccVpf0RZCmsLTSzOz3E:eiEifCVdjVx0REmUWzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722567, "uuid": "cce4e65a-8cb0-4fa6-b966-05d82d060ac0", "value": 67292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722567, "uuid": "db82c688-cf30-4cea-82ac-52c97039887f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722567, "uuid": "b8e53cbe-408f-4d6e-b6a7-3507dd34342e", "value": "46d9878529fb4ad1b831f012e5d25db4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081d7c1a-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708245, "uuid": "f5fa0112-bb38-4ab1-9ec0-89cfea1f427e", "comment": "Malware payload", "value": "35a5e284506784e52ef85a5c30946dc0", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708245, "uuid": "57d65c27-03b9-4dee-94ae-396e1a7402c2", "comment": "Malware payload", "value": "a5cba5de1fed529cd9324595aa41709785136656977c34eff11ba0dffb1da735", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708245, "uuid": "6f7e4b83-69e9-410c-b22f-f4bc0e891671", "comment": "Malware payload", "value": "27c66cef863d700084b096767bab75b40b4234c4", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708245, "uuid": "d4b8fe49-67c2-4b22-ae6c-95af607ff57c", "comment": "Malware payload", "value": "d4b595d85a915060e2b38630e0474cd5817d74a05abe270ff8ff3d625b5198059abd383ba5282284043b1e6b6a169b2f", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708245, "uuid": "e732c228-62c3-4c53-9ed1-81d2dc2ccf52", "value": "T18BD533109AD116C8E598CE2F1FDC9536143FEFCA78A8ADD792928BF1040FF85A572874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708245, "uuid": "0436ca1d-26b8-45d2-b089-cfb2a8857ac5", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQv6:G1wwAjzIQOMK2GNKslgus10Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708245, "uuid": "42570efc-ed77-45e1-8ee0-ef4c6107f96d", "value": 2842624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708245, "uuid": "6a2eb887-031f-4e38-970b-3c196aa9fbd1", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708245, "uuid": "21c8ddaa-17da-4e6c-b1a3-29c7b17af3a8", "value": "a5cba5de1fed529cd9324595aa41709785136656977c34eff11ba0dffb1da735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41933ed9-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (GlobeImposter)", "timestamp": 1638693738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693738, "uuid": "d99f8fda-56b3-4f29-b4fb-eed3dd6128c5", "comment": "Malware payload (GlobeImposter)", "value": "656a5cfc0f176a53f5da1635497c886e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobeImposter", "colour": "#499572", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693738, "uuid": "bce35e29-10f6-4405-8d9b-fe896cd3e49f", "comment": "Malware payload (GlobeImposter)", "value": "a7f49d965383c1d18343a3469f482820f41ea3d8a908d3e8cf43de0c20aa7442", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobeImposter", "colour": "#499572", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693738, "uuid": "d717fd98-6709-4ed4-affc-783cd5d353c2", "comment": "Malware payload (GlobeImposter)", "value": "1934b132e695562df0d36dd8df13dd2e47aadd35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobeImposter", "colour": "#499572", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693738, "uuid": "a1aba3f8-301e-459f-b9c0-f71c872a8947", "comment": "Malware payload (GlobeImposter)", "value": "0271498112880160cc60cdc20c9408f50aeb1d8218dd42ddf9dbf1bc8f5204216e805be95564d25a42a97fc33ca292fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobeImposter", "colour": "#499572", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693738, "uuid": "c76bf5f7-8702-49ce-ba34-3b7d6f550a4a", "value": "T130953EC6B490EA0EB2378249E64305FBC16F40F2E15BF239B62E06D205D1CB55DF9A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693738, "uuid": "40e8ae68-f550-4ab8-8042-718321d5d725", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693738, "uuid": "7d1c8543-36c4-4dea-8659-62deb25395b1", "value": "6144:DdY1Dz/qA4W/PDAAllmY8Gv2mHMf9aaZTPZ9BFQ:sPv2OML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693738, "uuid": "d8e30c88-76ed-40e5-8a1f-07947e659db9", "value": 1963008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693738, "uuid": "420087ce-621d-47e4-af70-7aa92e8e2904", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693738, "uuid": "abf564fc-89e3-4b40-b024-119d3f5a4daa", "value": "656a5cfc0f176a53f5da1635497c886e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e31ae1c-5585-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638679049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679049, "uuid": "53e21778-e212-4921-83d8-c10df5953e16", "comment": "Malware payload (Gafgyt)", "value": "d845079c107054536279c73019a0fc49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679049, "uuid": "b02811b1-1d3d-4253-a209-d469d412255b", "comment": "Malware payload (Gafgyt)", "value": "a82d05e0520b84b6883277f79b20aa1b8fcc09bcebb254d62b0ee3193eb1002f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679049, "uuid": "ac46bc54-5c3f-4078-96b5-049938e9de2c", "comment": "Malware payload (Gafgyt)", "value": "c7a31d9a3b43f8ce04366e760a180ff574aa6f3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679049, "uuid": "98972e33-5592-44ae-9621-59a897dc1b0d", "comment": "Malware payload (Gafgyt)", "value": "a8187968ebc466fbac0747f4b4584e6d388d947f5f5f57d210378099a63d8f9322ad98f37fceccec0e3cb81cefa87178", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679049, "uuid": "ec86fc83-becd-4308-98f4-ac3c801bdc18", "value": "T13FD3D717ABA15EBBD81FCE3301E64521109EE49613957B2FB178CA1CF74BA8E09E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679049, "uuid": "03796c5d-b12b-43cd-a5a1-7dcaca98a61b", "value": "1536:16ejYOS8RO+hFWUQdYwurvqpxcAxMDq0ndkm/nBgvJYy0h:1If+7WdWm0mMDqmkm/BgxYy0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638679049, "uuid": "572bcac8-b5d2-4127-b611-aba06c044041", "value": 140067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638679049, "uuid": "3cf39cf9-3e89-4628-b388-1232d0711f67", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679049, "uuid": "5c90ee50-864a-4723-912e-9500f66dff85", "value": "d845079c107054536279c73019a0fc49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5c4a71-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638722587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722587, "uuid": "bf0b2d78-4432-4bc8-939b-e1eae8626a49", "comment": "Malware payload (Mirai)", "value": "cc5d2a5ec67cdf058855afa6fdc15064", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722587, "uuid": "254aec4b-836a-4bf4-a835-a5387e888bf7", "comment": "Malware payload (Mirai)", "value": "a83a556ec3e833f51a1c7ed724ba70a457a66c2b61ecf6f09ff9d61e21ba0193", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722587, "uuid": "10bc3b9b-05d8-4e25-852d-b05a563ba441", "comment": "Malware payload (Mirai)", "value": "14b42b6365318ca53321ec42a6c8b2f7063154e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722587, "uuid": "59206b57-09a9-41b2-bb31-e45f95de096f", "comment": "Malware payload (Mirai)", "value": "207f00d7fe631ee59a03654e469a5b14c29869d2001c0020751d9cc3961ab429d0571f0e2309039501d4fb9125299b6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722587, "uuid": "630e9ff1-ed6e-4389-9c47-2013d2985641", "value": "T162A34A82A780D5B3D19306F6129B8B150133FB3F4A6B9EA6F35D3CF48B509C57221B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722587, "uuid": "cf67509b-ce8d-4aa4-bf6c-cb763ccc9374", "value": "3072:dUICodUWUh917j8mc2deiPUDAZURyPfi5hVTFvxinf0OzTyoQQub:tdRu917j8mc2H5Z5Pq5h1pxinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722587, "uuid": "f3b60284-0d2a-47f0-9472-11023764846a", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722587, "uuid": "ff727b10-335a-44e3-ad0d-f75c8c448d46", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722587, "uuid": "63312015-0cea-4f21-9d07-2d5da4d8d95a", "value": "cc5d2a5ec67cdf058855afa6fdc15064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4119425b-5625-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638747854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747854, "uuid": "6510f881-688c-4ccb-80eb-1822a5d11738", "comment": "Malware payload", "value": "f1dd5423ea3f033961b953fcd8ac50ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747854, "uuid": "ae758932-65be-4f8f-bd3e-83ba101bb950", "comment": "Malware payload", "value": "a852cb7d026a381e651188d0b7a88fa5cd8720c46b29f7331ec3fddc40d6167a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747854, "uuid": "dde4dc80-7a2f-4644-8d1f-eb6df7c74d67", "comment": "Malware payload", "value": "43fb2158311b212d79097bbae4beb447c89ebd55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747854, "uuid": "75659821-a39b-4243-9146-60b1ccb3e973", "comment": "Malware payload", "value": "dfb5fc6292f6e2c1cbb747cafd5858a0b093462e8bc90a69254fd72c0ddbaeefb31c7b986e50d82f4584b484acedca77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747854, "uuid": "8761736b-8bb4-4760-a358-ab660f099092", "value": "T1DE257D7AB6F17E26C2D63677C01AC46086E1E70416A3E35AF5FB06932E4F3B50E5A1C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747854, "uuid": "cae3692d-a365-4301-8756-9741e8ea6cf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747854, "uuid": "e38e29e8-f948-4776-8866-338ba5849a3c", "value": "12288:J7lL/Bw/nk15gdJVEzHBFnUidOOm2jTKn3gMwsONRRFQdbeMB:juCoVyoidOFSfMwidb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638747854, "uuid": "15e0e546-c61c-45c4-956a-a7f0ec99a3a3", "value": 1019632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638747854, "uuid": "bf4974de-482a-4a3a-ab0d-8738fb0d23b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747854, "uuid": "8983b182-4e6c-4457-81de-206c78a919be", "value": "f1dd5423ea3f033961b953fcd8ac50ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f89021-5584-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638679000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679000, "uuid": "be32706e-b995-4366-affa-d118124659af", "comment": "Malware payload", "value": "6f69d3e73873be85f1d2b31fceddb70a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679000, "uuid": "4f0ac723-bd67-42ab-8721-bbe91ef55099", "comment": "Malware payload", "value": "a9c9358d431d16ec58705322b4a64e3ecc4edf5335cbdf65f3b6cf12f1141cdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679000, "uuid": "6fc7def4-c8e3-403c-ada6-bea3ecf0f11f", "comment": "Malware payload", "value": "dd3396d24b6f73dbb4d9b2244ada6a534fa7e9b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638679000, "uuid": "eff25aed-c5bb-4c13-a266-b4444e74b07d", "comment": "Malware payload", "value": "a98a0a53373725b7e3a1ba148d7b2598674dabbeb0731841a4ccfcd03c4c0de8c4d221d4ecb63c55ccbdc1b1a064eabc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679000, "uuid": "f2b2e59b-ac6c-4419-a108-7aa74076f346", "value": "T1D7E33905D7408B57C1E2277AFACB424933339B54A7D733095A38ABF43FC2BA95E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679000, "uuid": "39061640-db68-4a48-8d64-96b8521000ac", "value": "3072:YtB+B7aEuNwWPaEAseCnrW7rz0JH/W7DF+mLwfCDQSAW:iB+B7juCWPaUDnrW7rz0JH/W7smLwfCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638679000, "uuid": "a0d34e84-34eb-4072-bd55-d8542779b870", "value": 150365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638679000, "uuid": "08de7a00-528e-4402-8b31-428c9c6d9043", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638679000, "uuid": "eda19efd-ab87-4a72-9eee-2cf8525da5fc", "value": "6f69d3e73873be85f1d2b31fceddb70a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da1d768-55dc-11ec-96a4-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1638716522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638716522, "uuid": "2f01c038-aae2-4558-8d68-3f32ba6e67ea", "comment": "Malware payload (IcedID)", "value": "f14d9fa24ca050a8228636777f207e92", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638716522, "uuid": "219f3ff4-9730-43a7-9a25-1822acb1daa1", "comment": "Malware payload (IcedID)", "value": "aabe2606a6927e2d420d59769df47f6056c412f38960bd97a3f4d6f4ed1d7341", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638716522, "uuid": "18cbc317-3475-48a3-bf19-db863429d8a7", "comment": "Malware payload (IcedID)", "value": "ba0263f6e12e9b275a24dda8a6b06bf46b7be306", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638716522, "uuid": "f18da6fc-7556-460e-a404-0a340c5a73f4", "comment": "Malware payload (IcedID)", "value": "1128ebcb9339f5bc05ba7569a7f33ba68b30391ad9c6639ff9b2d4b57cc965dd1876ab668c980ed1fb5328ad428d6c7b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638716522, "uuid": "38f13499-085d-4ecf-a976-210499841dba", "value": "T1F14306C426E307E6C331BDB3C6E30F95811676C0AAD746B7948C671A52F35A6CBB14B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638716522, "uuid": "0606ea81-33f2-4091-855d-a1dccfc71511", "value": "df144dabc777262cb4b8703b24b2e61b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638716522, "uuid": "7bf9ec17-b8f5-4284-baa7-0127d7c3bfad", "value": "1536:Y9DmQYKWizW5MRQbvfNDGNTJddBhj1LJl:YG1MR2qXhJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638716522, "uuid": "89f85f08-e476-454a-8008-ccf5933cfa6e", "value": 55896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638716522, "uuid": "db4e7325-8cae-4e63-b2d6-841c6e8ac07e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638716522, "uuid": "3f17ae90-7f2e-45aa-800c-64c6012eb56f", "value": "AABE2606A6927E2D420D59769DF47F6056C412F38960B.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a36fa15-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708248, "uuid": "c497f6be-a930-4016-8ca8-8f286bf072a6", "comment": "Malware payload", "value": "9b6f6eb1db77900fac0abcd313ad26bb", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708248, "uuid": "34746e4e-8033-4c05-9730-47f3ca6b0ca9", "comment": "Malware payload", "value": "ab62dc82a76c415d816edfc2628d5918362e099a6966cbfd60af0805a237184c", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708248, "uuid": "6af7e18c-1e53-4cc4-96f4-8b4b6c24e183", "comment": "Malware payload", "value": "1b32ba8ea3c904e6cfb4807f3937a86b8693eb53", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708248, "uuid": "a1a163b3-8c11-4d98-b0f3-8e5eeb78b1db", "comment": "Malware payload", "value": "345b5e5c67b8d57fd4f6d73bb383dc4b7e864d3bc39cd8c761a4b79a94ccf3d9b53ce0f582c2c4619aed664f740f30c0", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708248, "uuid": "71fa2892-3945-4bcd-9ab8-10b32dbbc9b5", "value": "T103C533119AD017C8E594CF2F2F9C5936047FEFCA78A4EDE382D28BE1110FE86A566470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708248, "uuid": "a1b21617-b473-4f50-be63-0ab5b98cfb13", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQW:G1wwAjzIQOMK2GNKslgus108", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708248, "uuid": "4dc7ef3c-3ee8-4f3d-9ff2-22d78b807835", "value": 2682880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708248, "uuid": "81ab38d1-90e9-4ed5-a7d6-b27f48abf7c5", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708248, "uuid": "454388c5-2000-4cb7-a40d-e57f123925f2", "value": "ab62dc82a76c415d816edfc2628d5918362e099a6966cbfd60af0805a237184c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0293fccc-55ac-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638695780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695780, "uuid": "9f0db8f0-a39d-4cbf-bcf8-7285f20cb863", "comment": "Malware payload", "value": "1733f47cdeab09c40d54f2770b8339fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695780, "uuid": "77aa6bc2-854e-438c-b63a-de699faf47ae", "comment": "Malware payload", "value": "abb109c1c450ea49543aee09fd9e1fee0fd5920f13280130f167a77ec74ce0e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695780, "uuid": "a6035d7e-4f71-4186-bb4d-1d598105697c", "comment": "Malware payload", "value": "fbf91a91ff032299257fe151e04ed6cd035396fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695780, "uuid": "9100df67-835d-45ca-a221-b390ab04f7a8", "comment": "Malware payload", "value": "eda796ef3e737c9c0bad768ba883c0f5c54e2c7162dbd0d3263518d2e3ab8b72138132738e0e3101dc9820792c1dade7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695780, "uuid": "5332e3a1-ddd5-41bb-86c1-51cf22049b02", "value": "T1B994F200C11521ECDB4EE132531BA7313E6F157839D68E117C4B08A9FFB89D7A6AB29D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695780, "uuid": "932d971c-d213-4e41-8e2b-90fdfe64e0e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695780, "uuid": "9de99094-c655-451b-a146-bab8a612e25b", "value": "3072:vee7sK2qSIRBACjtINRA9LYsN/Bk4qBewrHJJJnJJJtJJJ21veCn5I:We7GqSIjAC5wRYnN/BDyeX1veCn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638695780, "uuid": "9ae8f7b5-3ec7-4b4f-849c-2f87cb1f4efa", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638695780, "uuid": "2dc306f7-141b-43e9-b097-b9c0d47d5b6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695780, "uuid": "6d8a70a1-4338-4177-8234-3a3dedd6a4f2", "value": "1733f47cdeab09c40d54f2770b8339fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bc7cc0-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638693791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693791, "uuid": "8e2e738b-6f3d-4120-b60e-3974e09e7278", "comment": "Malware payload (CryptBot)", "value": "c18f2a3925a1374b8b45c54ed2cd90bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693791, "uuid": "cdbee72f-f39c-477e-96ab-72540bce5cf4", "comment": "Malware payload (CryptBot)", "value": "ac10ba0e6f390cdcd0471d34f78ada6b6b61cdf64ac6918fea5e5af2372fe1b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693791, "uuid": "d0614b34-c57a-497c-8232-d755fbe9eec6", "comment": "Malware payload (CryptBot)", "value": "825d78635177c77b7577a5ef64ac6e8393db965e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693791, "uuid": "6ec56c15-6810-49c4-9943-a3ed8fde84ea", "comment": "Malware payload (CryptBot)", "value": "90fd83ed814efca0681cc9690b6b517089eb794cd8c6b26366c68ac15e10a438b0acba62a4edc9a154d6d2d61898f1be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693791, "uuid": "ab3d1cc7-db73-4e8b-9a2e-1f51c86c734c", "value": "T17D84CF1172D0C033D05664768922CBB15EBAB57116A66ACFBFD84FB94F283D2973630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693791, "uuid": "b5f1be66-1bc5-4600-a983-3f7633fea893", "value": "b776dbe5b4a858696713fd07b4876aba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693791, "uuid": "5e5bd37f-fea9-492c-aa68-531da85b927d", "value": "6144:RQb52DA3WmGYNIni52XajwA9RDxT2ogUsWNnOPVnSg:RQbk4WmGKKi52XajwA9RDxcUjpOtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693791, "uuid": "cd57a35d-f98d-43e8-be6c-03079e3aba41", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693791, "uuid": "607eeb40-b367-4a0c-a334-90334881b782", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693791, "uuid": "dfcc366a-c8f0-4fa9-86f6-a8a973e45d1f", "value": "c18f2a3925a1374b8b45c54ed2cd90bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7473033-559c-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638689319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689319, "uuid": "bbbc6087-9646-478d-b749-f60450ba3eee", "comment": "Malware payload (DCRat)", "value": "489734d8e325470c717619922ac39144", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689319, "uuid": "8ce125a6-d2be-471f-8735-9a7130aede92", "comment": "Malware payload (DCRat)", "value": "accd96ee4dc62f2aee23f7f53c109b5249965d60d023f51e9924c3edc1951676", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689319, "uuid": "1315fece-144c-4e69-b11d-c10df9384d59", "comment": "Malware payload (DCRat)", "value": "6b0f4f55532c31697a75b64d70a5aa8c2b65212b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689319, "uuid": "324095f8-1372-443d-9811-d7177538ae07", "comment": "Malware payload (DCRat)", "value": "181d022a0a12b8e14ee832d77099f3e97c328b7d7060840a44970abcb533ea2f8ccb23bb2d36537383388c0934d63063", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689319, "uuid": "e4b1f366-582e-476a-a646-58c04eadd6f5", "value": "T167847C1837EC4F15F1FF97BAE4B25861E3B1B457AABADB0F4C8150A90822340DD45BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689319, "uuid": "bccb92ab-5a66-4896-ac43-500de885ba2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689319, "uuid": "765a3ae9-a608-42e9-b8fd-99708cd0696c", "value": "6144:sqqDLO77XGcsqpbSJKmqEQiDWhr4Hwb4gWHtbNfHRmlb6C3YQ3Y:pqnO7rGcNOJJiEHwcNHtBfgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638689319, "uuid": "9afc8074-4bfe-4c99-9286-c5610562d2fb", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638689319, "uuid": "fe783f58-f325-48b5-89af-e022579ff3f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689319, "uuid": "67b0f8e9-fc0f-4b15-b78b-0dbdb06c863f", "value": "489734d8e325470c717619922ac39144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5c7fd9-5625-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638747845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747845, "uuid": "aebb8779-1c53-4c02-b2b3-18c6a295fc5e", "comment": "Malware payload", "value": "eccf9e4f803d012acf6cd09e2ee1e5be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747845, "uuid": "c6160ba4-f66b-4c70-ae7c-94c604e6068a", "comment": "Malware payload", "value": "acd7f67e0dcc0ccb219ce5406f180a217cc5b8adc3385fd87c95fe6f68fb29ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747845, "uuid": "c9751e29-1876-498e-bc15-881d2191fc3f", "comment": "Malware payload", "value": "176393b5e162c93426dcb1ff2961c365491d3299", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747845, "uuid": "e705c52b-67d7-46ba-bde3-f42f4bf253b2", "comment": "Malware payload", "value": "382b506ac482b72b1c0c98b3973759c3f8b4d9b129af33c3e6122c6e14fb040a81d9619832dab43f93bdc37723badab8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747845, "uuid": "34f2ac22-47d5-45f3-a4bd-453cc32ee187", "value": "T12A74AE213280C073C09760768626CBB59EBEB47517655ACB7BD80BB99F347D2EA3530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747845, "uuid": "f07a549c-fc8a-496e-b9de-e337db65cd14", "value": "1b81e8f7d77881f7dbd36488c7ba26dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747845, "uuid": "648fa73d-8151-4997-8dcb-2a74547ef9f3", "value": "6144:cw5iiJ0zyXak8SLanN2sXnKdUpSzLxWbjgl6PHD:cw97Xa8aRKAqAMl6PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638747845, "uuid": "06c6ca01-5b7e-4ce4-8a4d-59c64c3a1515", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638747845, "uuid": "19a2e657-a0a3-412b-bf63-49dbc6fcf8a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747845, "uuid": "eee4dbf3-cb57-46e5-9e68-27cb05910e67", "value": "eccf9e4f803d012acf6cd09e2ee1e5be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f775184e-559f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638690608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690608, "uuid": "3a84bda6-cc64-4af0-8f50-c1c98b6146af", "comment": "Malware payload (Mirai)", "value": "3049043108d80d557fde8d8aba987dc7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690608, "uuid": "0316b184-f9e5-4eb1-b7b7-7e1320a7a190", "comment": "Malware payload (Mirai)", "value": "add5195b5b44d767ebf822cf046d2a49da069834e8059142e4b1221c8b84fe34", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690608, "uuid": "9f806dcb-0aa1-4ce1-aa06-d24196f94bd4", "comment": "Malware payload (Mirai)", "value": "f051e8a4b2f6d47020d8842a1b31b519fce2ed14", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690608, "uuid": "ed9dac91-0b40-49fd-be5e-eae7d4fde282", "comment": "Malware payload (Mirai)", "value": "33427b805e0a082e8ec829c058bc266abc4c9f84a9aded092ba0b46b894c73725a4da2ddd79812966121616accebdade", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690608, "uuid": "028a0f24-8855-4fb3-9e5f-4ec4a2b7fe86", "value": "T1DCE2E0F3AAAED863C9F105728BA691C3E2B6A498C15F3520641423B336E60403EB7C56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690608, "uuid": "62585324-7c38-43e8-ba3d-4bf126af05b9", "value": "768:enP+SZwYLZTlYPIuJj35EsU33H9bBZ6YIUQdEeKXb7EvtIsFEuQuB5sRP3UB:enzwY5OPzJjp+lkBzttI4Eu3Ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690608, "uuid": "9a6f2a10-9ec2-4d8e-856f-4dc0f4f49f75", "value": 32624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690608, "uuid": "f48400e9-eaae-4b96-8e9d-700d97b8ddfe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690608, "uuid": "5f685b3b-19ac-4541-b008-9d5978d2976e", "value": "911.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928e4c87-55b8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1638701176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701176, "uuid": "48ce9924-fd5c-42bd-b135-c6e0d797b977", "comment": "Malware payload (Amadey)", "value": "60c06c9b64be7bb8a25e8391b31bebf9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701176, "uuid": "c5c71050-5a71-48fa-bf03-ef9e5cdf3068", "comment": "Malware payload (Amadey)", "value": "adf3fb72f8855baa050d1e7c5a15944abeb1ae775570aee6bfab1b2d6ac26a45", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701176, "uuid": "3c6f9304-8b0c-41ba-be35-66e78547bcff", "comment": "Malware payload (Amadey)", "value": "108de69ad28a72bbc55cda2fade99275a7bcdda3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701176, "uuid": "84dd6b52-8509-4ad1-8dd3-df4e91056f29", "comment": "Malware payload (Amadey)", "value": "d0a4ccc96790b9330ff23eb724743bd2b8eb62643a02ababd4868c1d9d9e64e6a57cd80385f2e4a90985891885dcb8dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701176, "uuid": "ab0e9775-22e6-41d9-b2e0-2e25489c19d6", "value": "T135E40239186D898CD6B0177D2F2795011C867BEF86BFC5DCBA34D6E247F30860A8E954", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701176, "uuid": "52972260-2470-4a7f-8b28-7cdaa3c6e041", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701176, "uuid": "5ae501f8-1d26-442f-82ec-ddaee6b9b6c1", "value": "12288:si6NSRRNiQ9jvh1s3y+Vpc7c4ALwoJjvNa4JVkaYOunDwDDFuoNqWQJz:kSRRNi2spx4TUjvNaekaYOun0DD8jWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638701176, "uuid": "b9c36b2f-6589-4ec8-b993-7d4ea79358fb", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638701176, "uuid": "7d5e82f2-ea58-45aa-985e-8d5d9c2494f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701176, "uuid": "a44d5552-60bb-468f-bc0d-de88ca1ca47d", "value": "adf3fb72f8855baa050d1e7c5a15944abeb1ae775570a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d683f5-55a0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638690690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690690, "uuid": "34bf8cd8-30a3-446a-a6a3-3a980da1cb8f", "comment": "Malware payload (Mirai)", "value": "6fbca6c9dac43b4414a6b6895bc2c1b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690690, "uuid": "7a57838b-3e71-4899-a889-d275b68a34eb", "comment": "Malware payload (Mirai)", "value": "aeafa667514225cdf4b38452724590d7c0cc5cf627bd5ca2678b0469b1c8836d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690690, "uuid": "33ff0f59-e537-4586-91d5-954f3d1c5ebc", "comment": "Malware payload (Mirai)", "value": "e70f7fbb23d86945b043bead1e8a5232f1986390", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690690, "uuid": "7dd7ec73-2179-413a-85f3-9dc8d03036b7", "comment": "Malware payload (Mirai)", "value": "5db8c8a726ca983540867d330eb5aac8431f32eb298a3568c5d4d0b8459d1a53900477bf002cdd5b5fc1a0cbc83438aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690690, "uuid": "e638ccad-62b5-4d34-a0fd-48fbdb052dfb", "value": "T135C2E0ECEA556F69DD6BDAB03EC0D7D037031A87E6A39DE022C9FF81431726056844E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690690, "uuid": "1b2ff4a5-0030-4227-a583-a1dbcf23ff88", "value": "768:xOeAF7Y3jzmkvxXAq7hZ1ufK0cqQ50hJ74/lU4uVcqgw09M:xeUWkvxXb7hm720T4/lU4u+qgw09M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690690, "uuid": "c22a32cf-f02f-46b0-90b0-7d36a43daa53", "value": 28184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690690, "uuid": "c06eadf4-b8ae-47b6-9db7-430a650c904d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690690, "uuid": "518c5392-84ab-4820-b404-6807ac161d26", "value": "6fbca6c9dac43b4414a6b6895bc2c1b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c1a12d-55ac-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638695791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695791, "uuid": "11130889-ff78-45f1-87c3-8f8006ef19aa", "comment": "Malware payload", "value": "7a2fa72f36f78176805c7e6e3f2fcbdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695791, "uuid": "10a1b8e5-8b34-4f33-85cc-55d2390f5b06", "comment": "Malware payload", "value": "af620f48d534f6db07e31fa18182cbf78b14b9c9128657a779094cdbd81e4a25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695791, "uuid": "c6db5314-0966-40a2-a759-5bbbce3449e7", "comment": "Malware payload", "value": "be885e808db68dd49fe4babed2272ac0d6e3df09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695791, "uuid": "088f27b8-0b02-4673-8be4-4e8e292bb223", "comment": "Malware payload", "value": "272bff213b35656d12a388e3abf9ef1f5b8085afff0483e8b80d77f5df17e130da1c38cffaf0f6e23915aab489217f74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695791, "uuid": "95783312-8cae-4f99-8d8f-296ad6035187", "value": "T1E594BF11B7E0C035F5F702F45A7993A8A93E79A16B3490CF62E506EA4B346E4EC7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695791, "uuid": "ee382cbb-0eb2-430a-a075-2ea55f60b012", "value": "c6201ad79f7eefb71ccef5d0f9c9e6df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695791, "uuid": "5c13fecf-3f08-40ff-bc5b-1f68b3993bde", "value": "6144:eq1zWfDIFlK9B+dmzgb8obBILf+29mDOQJs0yh:T1zOIFY0QzgAobBILlmDJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638695791, "uuid": "160ff92f-55d1-458a-8fbd-305de365f9fc", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638695791, "uuid": "c0cecef0-e623-4cf9-a7a1-30dfaf10a0fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695791, "uuid": "f1ad4487-4231-4181-bffd-fb5ee5f2d334", "value": "7a2fa72f36f78176805c7e6e3f2fcbdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9463be24-55d2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638712346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638712346, "uuid": "c70c3619-b046-4ba1-8d56-2c64c766af92", "comment": "Malware payload (Formbook)", "value": "7e43aecaf2cb97efd8d101c655945351", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638712346, "uuid": "9ad317f0-0238-4cda-aa30-59dab153d365", "comment": "Malware payload (Formbook)", "value": "b026488f1e115e9f46cea576691a0d3b19504c84cea19be3aa1f867b7a90e166", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638712346, "uuid": "66c9ff16-b8b8-4c5f-be67-aa3ad94ce6e8", "comment": "Malware payload (Formbook)", "value": "2af099035f3cbecaade474551220ae27bc1037f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638712346, "uuid": "93a8367e-500a-4947-8e4c-35955019433a", "comment": "Malware payload (Formbook)", "value": "ee7a0ddcf7e5a84ba1ccedc93c6edeb639af8aa79f89d5c4060928968dee8f543b5d70036b67e5fe36dc58dec89ed7ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638712346, "uuid": "b0e4c2ec-a735-4277-9f2e-274db9254df6", "value": "T1F43523A23664C620CD7C0772AD87959003B57D6FA992DD3BBCDD35C2612B383282A7D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638712346, "uuid": "287ca6dc-5c1b-4143-a6e1-4d1880aa2b06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638712346, "uuid": "55c1dbd4-983e-40a6-807c-74e1f8ccdcf3", "value": "24576:B01QC0MiYpShHfkbSlRA+hJ1lfHVf7uGTKQZK/3gbXokieOoMWbOob:uKC0Ip1sA+9v7uGTKcQwbXodnoJOob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638712346, "uuid": "7fc1b490-b749-45f8-83f1-b4f7e7cdc24f", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638712346, "uuid": "b4c30cf0-4561-43f5-91c7-f8ed36de9fa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638712346, "uuid": "e7381331-393d-4a94-b769-5cd97ed87deb", "value": "Y3XS9l2cKarHio0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b96527b-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708251, "uuid": "ea73e2b3-11ea-4cd5-9535-1050539a8d73", "comment": "Malware payload", "value": "f053caa0d84fb0c5770f76ea6dbb75da", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708251, "uuid": "dd4b0fa5-1941-436d-8385-4040cb45f6a4", "comment": "Malware payload", "value": "b13d5724c7ed64944a3da31d1beb99f2e6ec939d4aab6acc55a5f7c5ee24f5c1", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708251, "uuid": "ea5e9ee8-b886-458f-bced-0fe9f12ae460", "comment": "Malware payload", "value": "0395040aae950ad5edce08436997bfcfb82c811f", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708251, "uuid": "480c64ca-d1f0-4b28-b7d1-94d127f4c0b9", "comment": "Malware payload", "value": "49e60f2150b3760d0831c709884c759a99db2757f054f4740a028a7805f369c7b80e1ef6810503f85b37d3ca115193e6", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708251, "uuid": "2e1c4d7d-d486-4f47-9af3-d7c692a88d47", "value": "T13DB533406AD007C9D598DD172F8C9936047BEFCA3874EDD352E2DAF1200EED5A9A39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708251, "uuid": "75666dd3-6b77-4f39-9f7e-cf6019ede60f", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3ep:G1wwAjzIQOMK2GNKslgup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708251, "uuid": "52cbc260-3e92-4355-9b97-084c30282411", "value": 2273280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708251, "uuid": "8fce2d6d-e03d-47f1-a5d0-5f191639a2d0", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708251, "uuid": "35f73d09-320e-47d8-97fe-aee9f756f6a3", "value": "b13d5724c7ed64944a3da31d1beb99f2e6ec939d4aab6acc55a5f7c5ee24f5c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cc2351-5562-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638664263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638664263, "uuid": "3b65cc9f-bf39-4b73-8ed5-c38af8f4f6cd", "comment": "Malware payload (RaccoonStealer)", "value": "a5431c8b5f858e14edbc94be92012d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638664263, "uuid": "373c4a90-d8ed-4c90-9aea-cf9c1569fb32", "comment": "Malware payload (RaccoonStealer)", "value": "b27943da09b070cdf931f219984746e3c275ebf7985560feabb597d1d2bb6c6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638664263, "uuid": "df087c94-d4c0-4222-8245-36b9bca391a5", "comment": "Malware payload (RaccoonStealer)", "value": "a0ca9bc4336c829bd3de85e2d92a2598a938b580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638664263, "uuid": "bdb418d7-389f-43c7-a8e1-d2b5ca07c6a6", "comment": "Malware payload (RaccoonStealer)", "value": "7d4456d690e42de172d0f82d95048cab2544ddcfee82a72b24b5fee7bca69b98a0ecf666576b4f6c3d6ccf51927869d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638664263, "uuid": "744ea399-dfad-4de4-9f0d-f2c3d9bc4c0d", "value": "T176A4020039D7C875D6AB163038B5C7A1697B3D362A31054A37A8267D7EF21C3AEE5B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638664263, "uuid": "8e0f0415-3ef3-4fe9-b876-90860d101b87", "value": "9d24ccac58ecf11e70c100743c701d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638664263, "uuid": "82e51a9b-dfb7-48ff-8b86-aef5fa73998e", "value": "12288:MB6s6YziF2CLwjS29GZ6h76Bh3YPUYdFtyXWNCtfsZl:06e42CKb9Y6IBUUkMmC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638664263, "uuid": "a82e4d69-c715-4592-9c20-d99b5f55d3fb", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638664263, "uuid": "a02dbdb4-7560-48cb-956d-d0dfb333d484", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638664263, "uuid": "1086e8ef-81d7-4e23-bdac-18a4d21609b3", "value": "a5431c8b5f858e14edbc94be92012d58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992f54a3-5565-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638665539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638665539, "uuid": "1e04bc32-1c89-4451-90f0-227ad7ffcba0", "comment": "Malware payload (RaccoonStealer)", "value": "d254e294d698face5fe9d92db33d4f83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638665539, "uuid": "25e160f8-9a53-4871-ac28-77377a96e354", "comment": "Malware payload (RaccoonStealer)", "value": "b3a48b8bfb61f791b4ec1aeeb2702dc0850a436448a66ee2686d98c59d0be471", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638665539, "uuid": "f5fabf52-7fd3-45da-9a80-fe83ef0aadd5", "comment": "Malware payload (RaccoonStealer)", "value": "31f385633d512385663fc2574a2e30ecaa1ccc23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638665539, "uuid": "9c6fb769-01d2-4f8f-af57-675f402605cc", "comment": "Malware payload (RaccoonStealer)", "value": "a2dc0de24580506cd146b42d549fbe2e386b97b442624b2b4086971716aa6860a3dceaac01ca2957af84f222e9c2d49f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638665539, "uuid": "848024ca-bb0a-444f-8ade-7e33d0c94163", "value": "T119C4E11132C0C072C19631B68629C7B15EBAB4754A665ECFBBC50B782F287E19F3672D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638665539, "uuid": "344efbda-aa8a-42a5-8368-736a42d9ebc2", "value": "1b81e8f7d77881f7dbd36488c7ba26dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638665539, "uuid": "fdcc420e-3e9c-4faf-ab18-16309256ed4a", "value": "12288:nYmZZG01r70xDTXEVMkmnOc3M3n8BqSjmzZ:nYeZG01rYxDrs8nIUjmzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638665539, "uuid": "682b7bc8-e5b7-419f-b832-26871facf84b", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638665539, "uuid": "6f3a10e8-5c94-4761-9c6c-7bf61eb9a6b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638665539, "uuid": "b31f36d7-e01c-4f05-b813-acd5dd52cea8", "value": "d254e294d698face5fe9d92db33d4f83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cf180a-55ee-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638724448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724448, "uuid": "2b4f9807-f444-4ae8-9043-2b78f6d8a36c", "comment": "Malware payload", "value": "2394c3a12dffc09aede0b0269eaf217b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724448, "uuid": "1a59c7fb-96f7-4f28-b917-47c6d79098d8", "comment": "Malware payload", "value": "b3cee8c368d6505d02ba564d72c915341fc782bfa5feda3a1648e448623d6c21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724448, "uuid": "dfeba9b6-f5ff-4146-a664-750d7b1fc206", "comment": "Malware payload", "value": "811903a5ffd1b5b69482fc902694054663d5218c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724448, "uuid": "9d2b082d-ac0f-43ec-b67d-1346e19f8c42", "comment": "Malware payload", "value": "cd2bb2c0d1c65ffc51eae154a9837887de3f1b8896ea6656e80073605d24a18527f8967c609be7ad821b4d4c6b8757b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724448, "uuid": "819d8e9a-0307-40c2-b6e7-5acae2c29da7", "value": "T12764236777C0697BDA420D324EB29FFBFBB79A9811211C93C7E00E471EF0A4A1199391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724448, "uuid": "fcda1a54-1a71-4265-9c52-8e888e97aafc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724448, "uuid": "3e4d4e20-2543-4778-b9e5-abb2e613151b", "value": "6144:rGiLxxFbKAWlCuf+rIeUg4M1OavvtkUo+xxbEjep6kRIwQIB5ETgCopSCD8:BOY8ehOYvt6SCep6IcLgCopfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638724448, "uuid": "f33a44d7-284d-4018-9c59-624f5185ad34", "value": 326702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638724448, "uuid": "39311cbb-4a1a-4627-8093-e8bf92ec1ef7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724448, "uuid": "9990b771-3161-4524-9707-a781932fd866", "value": "2394c3a12dffc09aede0b0269eaf217b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c285a5f4-55ed-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638724020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724020, "uuid": "ac168720-6763-4276-9eba-a73d2710db07", "comment": "Malware payload (RedLineStealer)", "value": "35cf8539f7d88236447bf1e02b7d6acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724020, "uuid": "62691e52-72dd-4e25-8879-32e6dd0c3524", "comment": "Malware payload (RedLineStealer)", "value": "b3fe12a1dd7844f9ac1b96f44a25dd2cb01db0db440832ee65702b9b1dfccdbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724020, "uuid": "43bfcc1f-d087-4ed9-9e1e-9dc6bb2736e4", "comment": "Malware payload (RedLineStealer)", "value": "dfba0188f9632f4570dc7ec29498cc524d4c8b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724020, "uuid": "0b8b0619-b272-45e5-a5c5-2e1943e3e5f6", "comment": "Malware payload (RedLineStealer)", "value": "49a86fb2bb7243d59cf1028066375f52a241d12432e70b851fe49a110895abdff4026921df4a02a300273deb2ebf302d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724020, "uuid": "f5447454-2363-408d-89e2-9ed71a2d9d70", "value": "T1A8841428647FC05944E3EEA62DDCA8FBD99A95E3640C743301B4A33B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724020, "uuid": "6b680ffe-6dd4-43e9-a41f-d9461cd513a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724020, "uuid": "13d3bed9-f274-4efc-93a1-3fc3cfab5dfb", "value": "12288:bFEFiag8rnySsZyVoHMURJkxZJdX4Qu+ca/:bMiXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638724020, "uuid": "24aef7ad-8ee5-4a23-9162-b35bd42b9a06", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638724020, "uuid": "56b88f4c-eb4d-4e91-bd20-16d1839d1a76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724020, "uuid": "9e7ee8af-1551-4fc1-811d-16dfa9584a8b", "value": "35cf8539f7d88236447bf1e02b7d6acf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5735ea-5618-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638742182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742182, "uuid": "089f3fce-a07e-4a01-a531-b247918a96ad", "comment": "Malware payload", "value": "64f80aa841d0fdfab42c9e0cfbc1ee58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742182, "uuid": "c8d74572-c17c-4712-8ae3-657950fd164f", "comment": "Malware payload", "value": "b6d9bbddc06e707ce39b0cf3f56f562898b7ca1bb354336597b6b16d28e0ed43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742182, "uuid": "68efe981-676d-466e-adbb-cb57d0bcfd2b", "comment": "Malware payload", "value": "91385c6d3f37cdeed59e9a75aea18bc4f7c5ddf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742182, "uuid": "38720fb4-9cf5-4257-9738-ce872f66741b", "comment": "Malware payload", "value": "033080d8627a67430e08cf2a8924ff2ee7d0ef4fb02883159ebbd63ad88b89d153f1637023279039c21e9d5535dee944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742182, "uuid": "e647f0ee-abe5-439d-b0a9-21f69229fbbd", "value": "T1147533098AAE713EE1FF877598FB3748EF6EC93686C150C69A6D0D53C5DEC182706290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742182, "uuid": "0c487a82-883f-49cf-83b0-0025bf02b72d", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742182, "uuid": "8c08cd0d-6ad8-46a9-b3d2-50b00d185e4e", "value": "24576:8Cihh9PgSBwM2xwVbDUSRF/peeuPI/P57i0ZXGnFptXMA6qLkEaHNYK3XZUL1a:oXwhuRJfweN/xOoWXUqLNat61a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638742182, "uuid": "c42f5447-48f8-4ece-9140-9e646cfadafa", "value": 1561600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638742182, "uuid": "3fcacb3f-8e44-4d3e-831b-3e650ef94dd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742182, "uuid": "8bf76a60-feed-40da-9121-33fc83f8e711", "value": "Auto_Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb818812-55ab-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638695768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695768, "uuid": "f4a9f24e-6c48-40cf-9995-7b66c17b60a0", "comment": "Malware payload (Mirai)", "value": "5d996c5acdc6498d1e2891e340302cf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695768, "uuid": "0ceb2867-ad1d-4712-8709-29853ad2d096", "comment": "Malware payload (Mirai)", "value": "b7e4da1ec17814bf073aa22b91236426f7ded13cd240c74cab703df43f7ad5a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695768, "uuid": "0499ae45-cc19-48c2-89ff-065226763969", "comment": "Malware payload (Mirai)", "value": "f77113288912fa73d7ec8d781e7853127517e081", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695768, "uuid": "b401fb15-9c7d-4406-b0a6-efbc99040d47", "comment": "Malware payload (Mirai)", "value": "3afc3e09d7aca5f1aaccf24057b9fd945051b9d25d2063e3cb388bf4a8b7968ed1a06bb1344a3a83d35aa7a09ecc3b4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695768, "uuid": "a0a8388a-db3d-4723-9eb2-95958ba56351", "value": "T15A734B21BAB52D27C4D0A53E22F34725B2F6574E34E8C61E3D720F8EBF64A4062566F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695768, "uuid": "9edfe54a-1f4f-48f3-a1a3-d6d7137d5a3e", "value": "1536:Ap5iirTiIgi8jILCkslK9g7SwJYna55XBET5dNXtt2E:cNeIFqw9DwJnXBENdp2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638695768, "uuid": "335b4cbd-4ad9-412a-aa24-792d2ac11003", "value": 78256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638695768, "uuid": "86530b8b-c30f-4a12-8637-83db3ada7ee3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695768, "uuid": "809d98bc-9784-4c18-b2fe-d4497337d5ad", "value": "5d996c5acdc6498d1e2891e340302cf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff3e4b8-55e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638722083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722083, "uuid": "a329a695-627a-474d-81a7-254a716162da", "comment": "Malware payload (Gafgyt)", "value": "0f4a1d9189cf7071d56a1c0d26c30c24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722083, "uuid": "87515cde-c3d7-4c62-a877-4ea9b6d5885c", "comment": "Malware payload (Gafgyt)", "value": "b8a3d3f429eea83ca286f4297a563bfab3314464705035605d2f63a8c51c38d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722083, "uuid": "fa6e3505-8196-4a5b-815b-f6922878aca3", "comment": "Malware payload (Gafgyt)", "value": "3b986d193c5643c572e9959fb7ffac2aac80d06e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722083, "uuid": "ffd3b635-6ea3-421e-8c7c-b7536852f138", "comment": "Malware payload (Gafgyt)", "value": "7efb8b629a57113808b6e1b135938dee69126180fa199fe20ca2337b14709a71b1360ddaa70e4bd3ad9ce39b65894dd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722083, "uuid": "25e9d0ae-204e-4a3a-8345-161b0e5dc895", "value": "T115932B41F9418727C2D327BAF7CF879D3B36569467D733026A356EB02BC27892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722083, "uuid": "e885ff64-805e-474c-bb56-c88353eeb8f0", "value": "1536:fTT7FN4P6n3JdUdfAgmWcq1i+FajxHOCdtPQglvUtiJGmREqQ4b/X7XSee:34y5d0r1cjdtPQhtiGmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722083, "uuid": "18b0e566-c339-43d2-a8cc-070aec196563", "value": 93271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722083, "uuid": "107453fe-ce68-447c-912e-14f75c96c39d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722083, "uuid": "64531226-87ab-4be3-913b-6da271995be8", "value": "0f4a1d9189cf7071d56a1c0d26c30c24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b0f000-5625-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638747859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747859, "uuid": "7a9807c1-629c-4988-b27e-d1fd44698c84", "comment": "Malware payload", "value": "627b33314f5aebc3cb15f7722043c3ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747859, "uuid": "e6593646-e176-4393-ac09-9711530ee4fe", "comment": "Malware payload", "value": "bc51a09d784d2a46f5189c20fe05d5c479a9c08146f326fb75d6c124c5f0851c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747859, "uuid": "9adbf442-a0e8-4efc-b27c-53cd70738544", "comment": "Malware payload", "value": "8d010e64a3b601457b2d6d49d278f27e84344e87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747859, "uuid": "23203b6a-f59b-4b34-a215-d239919f4836", "comment": "Malware payload", "value": "69590c0695fedb52d65978752d8ef62c0ae38571bf699bd51171edb2a4bbcea96c37cbbc1f19e2933b44d3e90148e114", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747859, "uuid": "1ea4aea5-ae9d-45b6-ae14-0b76dd4b67d1", "value": "T1EAE5334297E84269F9E137F126FA57D35474F8F16A78D39B821C12CB2C924D4AA3432F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747859, "uuid": "a22b0472-cdc1-48d0-ab85-4ed126c514be", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747859, "uuid": "fe0df5ad-6814-4bc8-a435-8925c65f847b", "value": "49152:Okn45Dh/sIXymCldbwuMKplnUK8GYvSSdKLBHEwl6xTkkrtkvUYMTt+fGoyv:Ok4dsIqldFIrjSUYBHv6KYK2BN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638747859, "uuid": "63144ac5-711e-4bf7-be14-30d5ab9e61a2", "value": 3034624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638747859, "uuid": "7c9a09cf-7dce-42be-94a4-1c9a6a339730", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747859, "uuid": "d93d746d-6900-4380-b6fe-3139550bf8a3", "value": "627b33314f5aebc3cb15f7722043c3ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb86cc3-5596-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638686456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638686456, "uuid": "95822638-7b99-44a9-a4ed-41fa3a3f56fa", "comment": "Malware payload (DCRat)", "value": "c102c1a1fb826ca65193e26a0c3dce8e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638686456, "uuid": "558ea7b2-1436-4541-9a86-bdd178ce8e5d", "comment": "Malware payload (DCRat)", "value": "bca9202c0a7797a53a044821c5b5a372e770afe6bb8c830689159a0014aaabfe", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638686456, "uuid": "391a0b4c-fd53-4cb9-bd7e-57eb261c7279", "comment": "Malware payload (DCRat)", "value": "9d4dd3f5e5623b48262783b7e6fcf4e5ab311a95", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638686456, "uuid": "3bd1353e-52de-46e0-963b-8b3f991f9cf0", "comment": "Malware payload (DCRat)", "value": "6156c56b16720f080ba600328dfde750b85251bcda56756667b415cc48c644cbf42a53f702fd8395ed437b163f137306", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638686456, "uuid": "d750c315-73bc-49da-8d38-71dfb4720114", "value": "T1AE54AD2233D0C032D59725768525CBB58EBB74302A266ACBBFD45ABC9F247D1973630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638686456, "uuid": "a895ef91-9872-49f4-a8b0-8341d4707419", "value": "b776dbe5b4a858696713fd07b4876aba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638686456, "uuid": "53ed58f2-c347-4d0b-857b-75a893baf3ec", "value": "3072:BXOyifz6+kxp/ALYxGiZ8t6GJi/PdgcEkSjrC3MB0tugkjwurd/dL/MWQMPN56X0:JCfvk/AsZqa6xfa3Mut3IyMSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638686456, "uuid": "1e9d67f4-ea28-4ab8-bfef-0ec4f2400502", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638686456, "uuid": "26f407de-ac4f-4599-b606-5a505ba57991", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638686456, "uuid": "c9d1ce9e-db09-4cc7-88e3-131d2e7c1b59", "value": "c102c1a1fb826ca65193e26a0c3dce8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978b2fe0-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638722659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722659, "uuid": "5dc1b32e-5ad7-47a1-b926-a90bd4db807f", "comment": "Malware payload (Gafgyt)", "value": "edd53ea3d2f49cec6290eb520b71cc19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722659, "uuid": "fa5ae65b-92f6-4829-ada5-006865360524", "comment": "Malware payload (Gafgyt)", "value": "bd5162d1a7c6b6d14c8ccb38ebca32ddf009a31fb6809353e1c9e7e3cdd0aeab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722659, "uuid": "ec46e25a-aef2-425c-a8c3-a3a261344fdb", "comment": "Malware payload (Gafgyt)", "value": "9e0ef032bf87c15fbd9c11f5266d4a3dfff157b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722659, "uuid": "48424972-12da-4e3a-80e5-82c3365972f5", "comment": "Malware payload (Gafgyt)", "value": "240b70faa2135e1b9540a5a962fdbe1d2bec8bd03927728dcdb70022a6c379449dc4ed282f2b25099042f01fcfb63334", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722659, "uuid": "eaf26f1d-16c0-44e7-9772-c3ee7c079783", "value": "T1F2E33A09E6408B57C1E2277AF6CF424A3333AB94A7DB33055538ABF43FC27995E22915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722659, "uuid": "da0e48d8-0a33-4130-868b-c75acdf99534", "value": "3072:LrbFJCact1nLNCn4IP9S6ufnc///M/9nOmpwfvRQfZn:LrbXCact1npCB9SLfn4nM/9nOmpwfvaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722659, "uuid": "3d10ac05-3b37-4785-829a-5e4b3962219a", "value": 152704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722659, "uuid": "fc0ff199-45d0-42b9-b929-2bdf34bdf9b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722659, "uuid": "adb3ec4d-af0c-4e32-b4cd-7c1bdef67298", "value": "edd53ea3d2f49cec6290eb520b71cc19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c181289-55e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638722022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722022, "uuid": "0271cdf1-50dc-4fff-9d1a-97e2b4a5ddbf", "comment": "Malware payload (Gafgyt)", "value": "10ed77471fc175640b791c5ef9f650d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722022, "uuid": "87442097-6660-4d1c-9f76-79c89d87cf67", "comment": "Malware payload (Gafgyt)", "value": "be2cf2fd292b80386d5b396d80e91039e169fa4cd2aea6ed4141d1886949b72e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722022, "uuid": "c504e00a-9147-4da1-bdbe-19778202b45f", "comment": "Malware payload (Gafgyt)", "value": "7d06de8abd4fbb5bd5b67b90c84a4b2091077449", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722022, "uuid": "f40bb658-747d-4ea1-af0d-7d7e67ea8c99", "comment": "Malware payload (Gafgyt)", "value": "444246b771e0f9d7d48d2698c12af04b31cd100b5009009a49cafd3e209a637445c00b5d7be842bef5d052f21cf7c224", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722022, "uuid": "9f8fca2c-87ae-422a-99bc-a2ce3392e21a", "value": "T1E5A3F941F9418727C2D327BAE78F479D3B355A9497E733026A347EB42FC27892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722022, "uuid": "11f1a859-f1c2-492d-a389-969294a85b1f", "value": "1536:w1LFN4PiD6kYr68/sSkxD82dY0rOTmvLnPPr7TAPAmGiwmVWmCVrQAFW9OXkYe:s4OJYQTfYILnPM/GiwZmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722022, "uuid": "83789163-ab11-4634-a72a-a56d474388cd", "value": 99993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722022, "uuid": "0ab42ad1-df3b-4290-b1ce-8a674c0c90ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722022, "uuid": "f831a8bf-d586-42ae-b370-d80151d8808b", "value": "10ed77471fc175640b791c5ef9f650d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a2b73f-559a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638688427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688427, "uuid": "207df284-1d0c-48c2-9ef9-a861da88e357", "comment": "Malware payload (Formbook)", "value": "06759bb5005aaeb8f07e90a0af8f3e23", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688427, "uuid": "ea803a3e-7de7-483f-8fbc-fd844e278c42", "comment": "Malware payload (Formbook)", "value": "bf3705dec2db289da40109be95cc98195ecbf5eda5b38962add54331954eeea8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688427, "uuid": "3849ba0e-c596-477a-b9a5-dfe4ef5d0259", "comment": "Malware payload (Formbook)", "value": "e880c2ee79c4f8c26e7f65357162af11ceaf64ca", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688427, "uuid": "ffacbfd7-c939-4086-9aa7-022c2873edad", "comment": "Malware payload (Formbook)", "value": "fe86db1a7d822049e85bd418e7a5cd7cdc6e0b07156a358bd271df5107a9127db603982225308e9c2ed794b9336c851b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688427, "uuid": "3d482f9b-c4de-45ab-b02e-36f56e2fa7d1", "value": "T1FB6533972B6BC837D73F7291EE048341E00BC94914CA7D792BFA83AD3895949C5683F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688427, "uuid": "8590edaf-2bc1-4213-80c8-5099aac95844", "value": "24576:veOYpvPkEGxwfVKm7NE9KfgVtVxlCvkon60CgHu8DrkQ5XGnGfD6p9ZP3hotdTYe:WPVcwVKmqVTRH8zJpfD6p9N3hcdTYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638688427, "uuid": "a23e9654-b040-442c-8c23-79c57a32ebb4", "value": 1432131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638688427, "uuid": "af94bc0c-2e74-4ca6-9ed8-84d9f69317a0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688427, "uuid": "0a270360-65bf-4c96-a743-f019543ad4d1", "value": "PO 2109771 Inquiry.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ce7395-55a0-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638690655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690655, "uuid": "de3c2370-b2c5-47b7-be6a-19f86c24f836", "comment": "Malware payload (Mirai)", "value": "dd393f9b11043c1198585507d5729fbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690655, "uuid": "3f859f7d-8207-463e-82ae-e3a4b22604d1", "comment": "Malware payload (Mirai)", "value": "c1a84b2036e8b9da48823fdc830b8bc1f85bb9b6357a7a00f8e2b49ea72ad8f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690655, "uuid": "f89a4676-8287-4117-b815-8afdcb7823ec", "comment": "Malware payload (Mirai)", "value": "059142c79bdebf56ca7fde981be98eb967cfd3a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690655, "uuid": "c26985a6-1f46-48b7-a6ff-fe12d1b2acac", "comment": "Malware payload (Mirai)", "value": "fe3c1c1ab446f31a04216bd4d93e26c5428c3c5d8aa8845ae80b8ae0a290f770f4e038ba5faed268c3fb15f001193369", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690655, "uuid": "eb3eb170-d0af-475b-aa72-5cca5a4b5fc6", "value": "T1A1E2CFECCFEC79C9C5AC9972B1AA17E41823A1D4B18D0B8C67418C89A7F9C1E79DD074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690655, "uuid": "b74d244a-6284-472f-ba7c-55f605d82593", "value": "768:oYS/CfPKk0zrXyYk+1CTNdabBhShoDuJFClpLcCWU:oL/CfPKdHLETLa1CGu/ClFck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690655, "uuid": "adcd7be4-8049-422e-b5a5-7e9f2664dbed", "value": 31768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690655, "uuid": "18032ff4-2eaa-4208-bdb4-21afafb1a3f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690655, "uuid": "ddbed219-a743-4422-9093-0bcff45fba5c", "value": "dd393f9b11043c1198585507d5729fbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a09d44-55eb-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638723055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723055, "uuid": "da0b7a4c-0b99-4b59-88d9-b11fcf7d15d2", "comment": "Malware payload", "value": "1d4fc971dc218cc10c05783dbed21213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723055, "uuid": "a1acdeb8-e002-4a1d-a610-a21e31228fb8", "comment": "Malware payload", "value": "c20709b7e4f6fbbe14c43f0a043e2b32add7acb1c4997267f1036e860fb571d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723055, "uuid": "2d51c371-8452-482e-99c3-f3abd81433b6", "comment": "Malware payload", "value": "a55f0a6d3658fe92afb74b2a58e44d9ec9df7069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723055, "uuid": "8c524c3c-2c56-4620-a461-a56597fafa8b", "comment": "Malware payload", "value": "f874a2a82d2d72b7a1b1235a39e1fc761037702d88039b0ff0ab46c3931e5ea3f28637db96ec62eb56182a9d0f46140d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723055, "uuid": "752631e8-ee06-4612-b47b-be04df9c324c", "value": "T12424AE2126D1C033D19364B28269CBB15EBEB575126A6ACF9FD94EB44F347C2E32530E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723055, "uuid": "f2355a19-fb21-43dc-bb24-d388737bd3f5", "value": "3072:Pjs/s21RTgN1IbXsP3uSbhm+LAJidxkjgO5OGniuem/w7IJicJqgJK0:gE20NwsBNmedasOtniC/wLOJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638723055, "uuid": "6d4c5e63-0bf4-467a-8ce6-b25bdf74f548", "value": 214058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638723055, "uuid": "1d5c625b-017b-4bc4-a62f-ab8376b1b835", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723055, "uuid": "e280904a-5498-4531-9d97-954d4bc24d54", "value": "1d4fc971dc218cc10c05783dbed21213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36919d4-555f-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638663033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663033, "uuid": "d940fbd9-b6b9-45f6-8e9c-661ddbb6b227", "comment": "Malware payload (DCRat)", "value": "a4863b8da0f8b001d7c28b956139e23f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663033, "uuid": "69c2053d-f227-4668-be74-0c22b0533c39", "comment": "Malware payload (DCRat)", "value": "c2452b97cff633876bc788ac4f72eb39f459a6c58f2a44f8443de1049b66d181", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663033, "uuid": "0e98a68f-c255-47ac-897f-bc51f9da2f82", "comment": "Malware payload (DCRat)", "value": "7d1d9bca4bf89e00e465f98f759f6d5b958fe4e4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663033, "uuid": "22ac4dbd-6a21-4eb1-b6db-69cc423a28ec", "comment": "Malware payload (DCRat)", "value": "3cc5e0b41ca14c80640409c5a4ff6945f644a12336b49c04cdfe598de67ac439214600a00de99747a8e568d23dacaf55", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663033, "uuid": "6b674680-bd7f-4a22-9031-ffb1cb7b90d3", "value": "T157556B123A44CE02E1691A3BD9EF805447ACED417A72DB1A7E6F339D65523A70E0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663033, "uuid": "e13e6723-a046-4500-b2c3-2896e174731d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663033, "uuid": "47b0fe49-722e-47a2-b819-f01d0d926943", "value": "24576:AcqbBXNCnFGAT9nE+5VmgFWhp2Wd7hKN0OFjX6OYJQI3SJKPWGDai2t+4:A7bx4oA97czhWFu+5s+GDo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638663033, "uuid": "75f896ef-3a71-4931-b134-050342b61e7f", "value": 1378304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638663033, "uuid": "5aff5f7f-bf92-4c15-b842-cb145f2c7d9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663033, "uuid": "fbd3fa52-5c1c-4282-8274-5daf6b07e50f", "value": "a4863b8da0f8b001d7c28b956139e23f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546d47a7-5624-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638747457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747457, "uuid": "62bfe9a9-5e7a-4a88-a6ac-b669b5b06ace", "comment": "Malware payload", "value": "ff970f5a3c95f93e632239cd466fdf66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747457, "uuid": "507fccec-4f14-496b-ba01-da55e8a17543", "comment": "Malware payload", "value": "c29fd5dc571fc98e925f49c3f36549d4b805022a884af9be750849ce85d8392f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747457, "uuid": "97c3d1e9-e3c5-425f-ab28-76b2b996dde0", "comment": "Malware payload", "value": "578b3a3fe820158bd2296f8a4c9d904e946eef75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638747457, "uuid": "150d71ba-65e3-427d-955a-db350ab99c86", "comment": "Malware payload", "value": "20161686e93dd2412ce2499b3375b2df62b9e437c924be06676053078faa4c5b66ddeb1151a7becac7eac27890e7b0c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747457, "uuid": "6abf5d5b-d5af-4688-86e6-6b21c333c362", "value": "T1A765336AEE4AE718F0A75FB5AF05614B26C3D990485D3217FEB7CE983124C3262D1C78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747457, "uuid": "dac67e0b-b68e-4d1a-ba47-498f6639ee2b", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747457, "uuid": "4e065a23-0519-448f-9eca-27800561b323", "value": "24576:N69LmfJTs40x7FQZFjs66rAafMgImLvdnJc0sexb6KVyON0NV6hkEaHNYK3muJYK:N6MhOHQZq6wLxdNB6eyON0HqNaIk3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638747457, "uuid": "f53531c4-c6ba-47c2-bdd1-47f2dc700635", "value": 1465560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638747457, "uuid": "467597dc-67b4-422b-a554-756421923abc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638747457, "uuid": "fc98f1ab-25ef-4252-b2f0-a4bd7fd62790", "value": "btc_miner_by_kryptex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8645c7d-558e-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638683174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683174, "uuid": "0f72287f-fd46-458a-83ba-d09e18398c0c", "comment": "Malware payload (RedLineStealer)", "value": "2ca4e0dff15609405826cd1a22603f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683174, "uuid": "52e7c36e-f776-4339-b285-83290d47003b", "comment": "Malware payload (RedLineStealer)", "value": "c2e81d3ed6e8c5b3d95bf1e17ee1014a57491aade546586364c5d6ecf5f73ecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683174, "uuid": "7ddd70a4-29b9-41b1-be61-5c568aa224ad", "comment": "Malware payload (RedLineStealer)", "value": "5e0399e0141e55fd04e01b7e6dbb991fd75ecce9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683174, "uuid": "7ee69b96-9f89-4c0d-9268-1674000e11bb", "comment": "Malware payload (RedLineStealer)", "value": "883105a9467f4a009919f4e9f14088e4ead8732a734a737389a072d11f9b5ad511c18af2c0ae10448513143bcf6d46ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683174, "uuid": "5e7476c9-b169-4e30-85f9-61e9dfcf936e", "value": "T1CC54AD1133A0C032D45725768625CBB58EBAB4312A266ACFBFD45EBC9F247D1A73530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683174, "uuid": "11f9a444-ee76-46b3-b172-2fd1f6681713", "value": "c5abd64536bf33cf9d17453c6dc09550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683174, "uuid": "145628b9-62bf-42f9-93ae-97134087b666", "value": "3072:A8Tih8F8fejTNpVsYWJZYIDx9pJi8dKgMXUaFv1gYjFqlbT/xlC8BQMJu56:HOhJfKVMsIVN67v1dMlbTxOMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638683174, "uuid": "4035f1ad-ad5e-4926-bf32-a8c4de29541a", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638683174, "uuid": "63ca4d8e-da32-4097-afba-4bc5a1635b4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683174, "uuid": "645daba6-ae07-482a-9ef9-f6bfc4138aa9", "value": "2ca4e0dff15609405826cd1a22603f14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28b4550-560a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638736448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638736448, "uuid": "188e6065-689d-4885-85fc-2d44f6deb749", "comment": "Malware payload", "value": "1f2951435ee209e761a9df276023c48f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638736448, "uuid": "237a2c4d-9526-4e9d-a662-8fe018f427ef", "comment": "Malware payload", "value": "c3e83b560db63700a60c5d4d8cd562fbc1a0f8bd4b6098a27b3f1ca8338c3d09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638736448, "uuid": "c25c9413-52c5-4218-a33c-889620b028e2", "comment": "Malware payload", "value": "98d306e3248a3cf6fa61d0cd711fbc74f3b85702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638736448, "uuid": "d35fd52c-1990-4a43-8575-0b8cff61642b", "comment": "Malware payload", "value": "fc1c0a6b1cfae0720cec371c72d7ae4e54a6002666c4192b98199db48966ebacf8fde17131e5952e7fec2052d269097a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638736448, "uuid": "59c7e604-fb99-4773-a31a-25eb6b781acb", "value": "T141C5D03FB2DA6D7EC47A0A3945729298583B6E70641A8CDA07FC250DCF27460BE3B715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638736448, "uuid": "1b6a026f-fe53-410f-98ee-09dbff1f044e", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638736448, "uuid": "0acff688-67ba-4937-9d41-3bb9025c2383", "value": "49152:qqe3f6a0zD7+H98AHaCfu6O/HCL+WuTmuKwEP:DSiBD7E9vBuT/HCK5NKXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638736448, "uuid": "09d0200d-f6a6-4f2a-970c-40cf2745f457", "value": 2708856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638736448, "uuid": "e7caf7a9-d826-45cf-870a-00ba32edaadb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638736448, "uuid": "9ac68e5b-cff7-42dd-998a-1ba78b0dcd6b", "value": "GMODsdk - Linkvertise Downloader_8HY-pd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91214f24-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638722648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722648, "uuid": "bc2b74da-0587-48f4-80f0-5ef4182485a0", "comment": "Malware payload (Mirai)", "value": "ff9c59fa5ac19e8d9535dff4c7aec07c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722648, "uuid": "5863c530-b27b-435a-a907-ce5f36c8e4e2", "comment": "Malware payload (Mirai)", "value": "c481c40c73dc4d5cc53938fec5311461d4601dc34ca34171d1ba24bda564ea97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722648, "uuid": "bbb7d16d-48b0-4c8f-8d82-a9966b483a73", "comment": "Malware payload (Mirai)", "value": "fa82f081e376e9b6bf140fe4c875aa50f66d6836", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722648, "uuid": "705fa302-49a2-4b08-a5e6-ff66c6b32a4e", "comment": "Malware payload (Mirai)", "value": "7418074b1eb842a564412a994469ae76f7f6562d33384ad6626bc1118971eac511fc2a160b9d8ce7c980b1f2d19fb0f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722648, "uuid": "311518a1-4a20-45d2-8183-4d5e4dbeb814", "value": "T16E731B86BC409E14C6C50777FE2F118E33025799F2EE7352CE145F747B8A92B0E2A65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722648, "uuid": "37dcd7e5-a24b-481d-b1ce-ad97da9a4133", "value": "1536:0tnRrVlD5tc4CKayOsRIx01vJjUOrdttN9EizVIBiUMWXEmUH:Er/ltcfK6cvhQOr9anXEmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722648, "uuid": "bd86b9d4-0f33-4834-97d5-a19dc7517fe8", "value": 79152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722648, "uuid": "01601220-b53f-4f7b-94a2-dbf360d3a737", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722648, "uuid": "c7bf49b2-6f12-48b5-bc10-2860dbdf5e10", "value": "ff9c59fa5ac19e8d9535dff4c7aec07c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5df19c-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708255, "uuid": "efd0a998-953a-4016-bab8-49154f443ff3", "comment": "Malware payload", "value": "32b470df01ffb6206712b2cc4e1fb451", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708255, "uuid": "525c3faf-ea61-4456-91ca-3ea01433bfc3", "comment": "Malware payload", "value": "c49ce685a5be0da584d194bd47d3b5aef94ce12e2d6018e966c2292eab25c61e", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708255, "uuid": "cfe1117b-2cc5-4475-b351-98fc81553bce", "comment": "Malware payload", "value": "edff0a0dc6a08fad4c4d995f8cf87bce6ed1692b", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708255, "uuid": "a6b0bca1-0269-469b-ab8c-6f5d58754cd1", "comment": "Malware payload", "value": "58962246dd17bd716361a34834c3a60a2ed6004947908ed6d92302dfe8fc63b4e5c3ab549d0d4c223efe05711660c905", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708255, "uuid": "391de405-c6c4-4d49-91a1-20fb63914e7e", "value": "T140D5331099D106C8F5A8CE2F1BDDA536147FEFC678A8ADE782D28BF1040FB859973464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708255, "uuid": "3743a249-4c7f-4d0b-80e1-823d0c60eb70", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqt:G1wwAjzIQOMK2GNKslgus10Yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708255, "uuid": "bee62681-a32b-4d08-8904-8692c320a27b", "value": 2916352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708255, "uuid": "c14a1a82-25ef-4b67-a614-7928d1f4f2d3", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708255, "uuid": "69642e25-d60b-4898-b242-1256af265ad7", "value": "c49ce685a5be0da584d194bd47d3b5aef94ce12e2d6018e966c2292eab25c61e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54189dc3-55db-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638716103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638716103, "uuid": "2d53965d-a74f-462b-ba9e-29f47ffeb420", "comment": "Malware payload (RedLineStealer)", "value": "f79d68c8b8baac77eea56ffdecc010c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638716103, "uuid": "069d8ab3-2743-4b66-86fa-eb7827fc98a6", "comment": "Malware payload (RedLineStealer)", "value": "c4b2fb2998f0c6cd914723a5855116dcbe582d8875e25e424d99064e243ff971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638716103, "uuid": "4dbb075d-11bc-40cd-bbbd-6c9d59a5c1c5", "comment": "Malware payload (RedLineStealer)", "value": "3b5996718d1fcb3f937d4a508cab257d21493059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638716103, "uuid": "e9313fa1-511d-4f4d-843d-d150a0da4b13", "comment": "Malware payload (RedLineStealer)", "value": "c43f621f5dffaafe4571e8c1cff68a5b8e39e27f4c7dd31664e39d9782119782e08e22cd7c11ac237fe4ff3a4414b04a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638716103, "uuid": "a58c4f18-424b-4840-80a9-d8aa66f7af2b", "value": "T1077533A60F8EEE89DBC513B0BE0CE76BA080B6626F54716DE79B15C0121C46DE7F0875", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638716103, "uuid": "419cebd8-cd16-4239-8b86-8fe7e07efb0b", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638716103, "uuid": "bf86a8af-96ce-4a6f-a455-57de8508f567", "value": "24576:wA2DFC/YZ/mM/5+mmcyYo3TaZPb1y53Eh+nRLax9Q4VZ56FWpfx3tXkEaHNYK3Il:wz+tYo3eZD453M+4Q4VZ5a6RNaIXd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638716103, "uuid": "d8a38cb1-c913-4e77-9a98-089ab43884c2", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638716103, "uuid": "57ed68bd-d909-4b80-ab7e-21eb5364cd4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638716103, "uuid": "f661d51c-1e27-4e18-9708-6965ab30577a", "value": "Cringers.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4b5adb-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708257, "uuid": "30528a94-da6d-4675-8210-3d130bdd0a49", "comment": "Malware payload", "value": "8a2c7aede953d6fb268b99e86fff11a7", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708257, "uuid": "64222817-fd82-4623-aba4-49c5297a6445", "comment": "Malware payload", "value": "c5c9bc965660f7475898e314b8231b22d84f08fc4440b932ccee67fbb80a6275", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708257, "uuid": "0d74b781-8f18-4747-8cd9-c6a621d5755e", "comment": "Malware payload", "value": "1ec062b706d66ead696eb5213eb2946ba7cfaa00", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708257, "uuid": "0bd142a2-ba1e-4f71-a9b9-373967cc836a", "comment": "Malware payload", "value": "0d69098739fd367d4385f9384451d4a60cac63a1f23aca64aaaf3765b3ed97bbc0a47eeff7039f0dc41b7447d547f727", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708257, "uuid": "6d4f3275-cf1a-4d70-8042-dd4e29cec4f1", "value": "T132B533106AD117C9D554CE2B2F8C9936047BDFCA7874EDD782E38AE1100EED66A938B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708257, "uuid": "9633a884-8ca7-4fff-8bb5-dce42a9b41da", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1r:G1wwAjzIQOMK2GNKslgus1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708257, "uuid": "685b3caa-7f5b-4315-8102-c5c33face2ed", "value": 2461696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708257, "uuid": "684664f7-906f-4bb5-b378-b3074a01d604", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708257, "uuid": "e1164c74-5e96-47ed-bfd3-001dfb0c7551", "value": "c5c9bc965660f7475898e314b8231b22d84f08fc4440b932ccee67fbb80a6275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9331a072-5570-11ec-96a4-42010a9c0029", "comment": "Malware payload (ServHelper)", "timestamp": 1638670253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638670253, "uuid": "89e99509-cc74-4d96-abd1-d388d1fcdeaf", "comment": "Malware payload (ServHelper)", "value": "f303ce24dc4412a1853b86112cad0a7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638670253, "uuid": "821bdf21-3e3c-4406-ab18-2024fb6bf5b3", "comment": "Malware payload (ServHelper)", "value": "c6e1d668609e9c3d688d02bdab949ca4ed660f42b09bae1fc1c1ba9a04e1b98c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638670253, "uuid": "c23c814c-867b-4fd4-8093-dcd3c0394089", "comment": "Malware payload (ServHelper)", "value": "d3cf3a3f23950b7b37a3c1ca1c8d8790effc3380", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638670253, "uuid": "a43098d7-e6f2-4d8f-915e-052b8bbbf21d", "comment": "Malware payload (ServHelper)", "value": "e225846b5df78b46241442c951d8c41e166d89f677f40bc65c6f86748c425d99569ae037acfac2110aff7a83981a3f46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638670253, "uuid": "f565db9f-1ffb-43f5-9c9c-7021e16f3144", "value": "T18BC4D1206BB0C035F5F722F85AB59769BD3E79A2673490CF22D516E946389E0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638670253, "uuid": "549462b9-72bd-451d-9da2-0ed3f8b83585", "value": "bbdc5cea7d9bbd6ae9c6a36e9d9fb769", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638670253, "uuid": "6dbf6f29-5d4e-43d6-b0aa-f9a592e6f2d7", "value": "12288:q7dW9hnHk7cKup09iyCtu1tWip9d4IkJv5G:Sc9hHOcq9oRi/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638670253, "uuid": "a81a903f-38e8-4496-a965-a46172a7bb4b", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638670253, "uuid": "6ba3e2d1-1f12-46a6-aafd-f31a9f16cc2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638670253, "uuid": "e14cbb29-bff8-45d2-8905-b29da81da225", "value": "f303ce24dc4412a1853b86112cad0a7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8f2d1b-55e8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638721946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721946, "uuid": "c86ba588-41f5-43c2-8293-081ce8ed0ad7", "comment": "Malware payload (Mirai)", "value": "66ac7264d14cc5ed8579bee0cbed5eca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721946, "uuid": "8d98cec1-ba77-4afb-b3bc-d98133518663", "comment": "Malware payload (Mirai)", "value": "c75d0198821ad75b24d4ad3853e39d3d2f0b7fd04c88b1205ceaef6bb1f53857", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721946, "uuid": "aacd5980-2763-4d30-b863-32a18cc395ea", "comment": "Malware payload (Mirai)", "value": "b410f7ea3b80e765acf666e4afb93e4aab156c3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721946, "uuid": "1b9c9017-9f72-47e1-b078-173070184b7f", "comment": "Malware payload (Mirai)", "value": "f1ea41e43c188eda42567463e82c9d9699f60f1efccb53f253b9cc9e8eeebb2d557ff87bb43982963ba3dbf4b87f2b77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721946, "uuid": "b177db6b-2f57-4997-a990-ca1b8d709680", "value": "T12BB33A0798615F77C045ADB529BB5530072BBA120F4F1F9AB57CAAB4074F8CEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721946, "uuid": "3e5adc2b-141c-469a-91a9-692f18d0e78d", "value": "3072:moNToIWzKoFIon14X5hLwfecr68LkY0Px9gQNfR:TNUz2Ej4X5hLwfecrfLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721946, "uuid": "faeb0ba2-f9a2-4f5b-bd86-1844e5ae9f53", "value": 108419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721946, "uuid": "ab47e62b-11ac-4926-92df-05e3ab10d102", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721946, "uuid": "f631f160-cb54-4a7b-99d9-02470751856a", "value": "66ac7264d14cc5ed8579bee0cbed5eca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed9b1ae-560c-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638737140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737140, "uuid": "0308644a-3c7c-4119-9214-2b8c2148824d", "comment": "Malware payload", "value": "28c5db213daebfe622dba8a7cbc7d629", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737140, "uuid": "ef8d405c-95c7-425f-8b74-22281ea93185", "comment": "Malware payload", "value": "c766ad489082d66ce247ecdfa27b1fac219b84e169c9f4dd8c091199f32c6f38", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737140, "uuid": "ada50202-a5db-4174-8af8-2d692d0418d7", "comment": "Malware payload", "value": "77c29db6ae229aacbf28dfcd0974b7c52a4bc47d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737140, "uuid": "81992f11-bfe5-4337-9d80-43ca9b3ebca7", "comment": "Malware payload", "value": "305cc1ee03000bf0827b13e0d36ce2fd221626220a8982037bd37083159de97e7738753ddbfa1c1cc8d82acd167fc7d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737140, "uuid": "9064eb8f-e066-47fd-9ee9-f36914d3ece3", "value": "T10E05AE02F761D522D1D510B0E12C7B9F6C3D6AA4572586CB73C40898FEE82E215FAFA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737140, "uuid": "96804a5e-3953-4feb-a856-7f3177132b35", "value": "e3a25e130a8dadd2a8e79a1137cb2f28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737140, "uuid": "6c48a914-c141-49d0-99e3-f04216ba7c40", "value": "24576:kzuV6fiYdG+f2RnbyBW+qrFKwQJpUZ2ZH3s4b:RYARnb9+qcwQjwy3Db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638737140, "uuid": "17460db3-28f0-42e7-8f5b-f6f4f719d00e", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638737140, "uuid": "023cdbdd-3068-49eb-b455-6edc7915c5b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737140, "uuid": "8c3edbad-52d8-4ce1-993e-247a40cb9d8a", "value": "GMod-SDK-x86.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04da39f3-55a2-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638691489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691489, "uuid": "a0cde1f8-f64a-44c3-a1f8-06db31813601", "comment": "Malware payload", "value": "6cf85443781de53f2741136333aff544", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691489, "uuid": "e18b58b3-7238-4bc6-94ec-30f46a49bcfc", "comment": "Malware payload", "value": "c7ad92921fd6bf90a5feae0b28995fcb6bd4506113c66cabb486449f25cf41b8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691489, "uuid": "5e07bb26-511d-49a3-b28f-b59a244e4a22", "comment": "Malware payload", "value": "7edee89e0e37ec9957fdf34b0c7d203336fb0317", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691489, "uuid": "1fd651b9-b965-40be-9913-14bf52588877", "comment": "Malware payload", "value": "d55ff07bb8b2937fe92ceb9f7908c1203e86879235b3d232de3d08d6293e1d91db5a1d1694cc2161747d4feaeedbcf81", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691489, "uuid": "1fb59297-6467-4c09-980d-4a0f9639ef1f", "value": "T107B39E2076C68473E26211718DB99FE64A3EFC325B6034DBFBD905B90E687D18A3531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691489, "uuid": "2c10273e-fd73-49db-bd4d-2fa8f1f03db1", "value": "ceef9a7aa92d2d5d4f6b7b508c3983f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691489, "uuid": "8013bd15-28ea-4640-90bc-dd270bd21e53", "value": "3072:ofN8LTOCs98sXvpexDziaOlLYLCgr2hnhu:k8/ORQx6VuLCDhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638691489, "uuid": "d3548d7c-88b6-4981-8d28-ba2e697c0591", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638691489, "uuid": "252cf9d8-0f33-40b8-9c86-c4797b2636bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691489, "uuid": "76c9455d-f14c-44af-89de-7861c053627f", "value": "DHL PACKAGE DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67316500-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638722578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722578, "uuid": "5290bfbe-6fbb-4e04-98c6-8d3893723075", "comment": "Malware payload (Mirai)", "value": "09c1353cc4eeb91eb01f7db6a5104e5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722578, "uuid": "91da5b12-41df-48e6-a452-a8aefcc4c8af", "comment": "Malware payload (Mirai)", "value": "c7bb07aa85d39e30001cb631ca2a8132d24557040338ff1d66aeba4de1c3e379", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722578, "uuid": "a671ac08-968a-4d75-8a20-198c2fd5d752", "comment": "Malware payload (Mirai)", "value": "9204da939afbdfcb12262fe318df9cf12195a952", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722578, "uuid": "8d88781a-70fd-4f95-aaf2-0370f3be6d55", "comment": "Malware payload (Mirai)", "value": "94748cb5f1aab23e99fb703f87701ce15e0e6e45148e759e9a5b29647af54c623cd593a59a2ef1915556fc0b8160fc4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722578, "uuid": "75d01cc9-52da-420d-84fc-196c34a24af2", "value": "T11AC30805FC404B27C7E23BBAF79E438D773666586BD733116A295EB02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722578, "uuid": "7d039f50-8d66-4155-9514-8239b97013bb", "value": "3072:0JDZ+6lJQTnoo3AK5nnyXxfWx5hLFWuXUSP4eoC9DQlD6ObAF5R:7nyBux5hLFWuVhoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722578, "uuid": "dba966f0-6ee7-4534-8246-17c2a6bb8499", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722578, "uuid": "b629d340-7bb0-4d11-b718-bd448ca454f5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722578, "uuid": "3cc76107-4991-4e10-9d2d-74520438e3a0", "value": "09c1353cc4eeb91eb01f7db6a5104e5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e77b20-5627-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638748639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748639, "uuid": "1558890b-d5ac-491c-916f-7816660afb77", "comment": "Malware payload", "value": "6023a9fae0226fb52b9844d74eb9411b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748639, "uuid": "ae2e960c-f0b5-4b1a-b52a-73213cfe3d0a", "comment": "Malware payload", "value": "c7be8c46221ad3abb42023dacbfd9c2e6c5a229284b1c6d37ba916c207d667fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748639, "uuid": "5a019990-e666-4414-8ff9-fad4f5434e08", "comment": "Malware payload", "value": "5d92a17e91b1cc5aed372419b72c639042da2e76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748639, "uuid": "30861dbc-c197-44e8-829f-b72534bee504", "comment": "Malware payload", "value": "f6f07c2a796e4d91883923771416559ef1e11f016c33ad9a2c5ecaa018676fbc727f174318b35ded2551d28979a89a75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748639, "uuid": "400040e2-1a7b-41c7-a4a4-c1f624653220", "value": "T1D084AE10B7E0C035F1F313F889B593A8B93E7AA1A76494CF22D516EA56756E1EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748639, "uuid": "39b48c50-8c38-470d-9553-e6b7a36bd773", "value": "5da563873972430c247e0379344310f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748639, "uuid": "72f31f9d-9e32-423f-a5f9-eec84c1c6582", "value": "6144:ttsC5Ey/Dal2/V+zFsUTr+EAO5e+LaZPBp0kIeqduQ6JX:ttsCOyrzMedEAO5e+La/2kIeMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748639, "uuid": "a103d80a-044e-4647-8aae-b66887ace0be", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748639, "uuid": "16f1cff1-814e-438e-9441-d3c1519b6b38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748639, "uuid": "25e462c7-a374-42c6-a5e9-8e6abfcde524", "value": "6023a9fae0226fb52b9844d74eb9411b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7c075c-55e3-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1638719738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638719738, "uuid": "06ad14e4-9c5a-44d8-8a97-e1513a787f86", "comment": "Malware payload (AsyncRAT)", "value": "71f29714971d1280374b8e6ef4c88501", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638719738, "uuid": "5c026d96-e63e-4d0a-836f-5b63bdb7ff5c", "comment": "Malware payload (AsyncRAT)", "value": "c87a4c8568da02a87714d941c3b59d1b17e6a833db01b88d4015f7d73884af31", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638719738, "uuid": "c0df9f03-5a12-433b-b1fc-c9b4fe85ebfb", "comment": "Malware payload (AsyncRAT)", "value": "cad5419e152f49e79bdebff6d4bacd77febc1840", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638719738, "uuid": "235ccf22-d122-4ad1-8c4c-9e7605d42d4d", "comment": "Malware payload (AsyncRAT)", "value": "25b5fc0d4ea7ea970603bdaf7d8f758b40b9d48302f221f4daff8280798f32aeb27d0fc462d0af733555dbcc36cd0203", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638719738, "uuid": "17349cab-44ef-442d-975d-7bb966e499bb", "value": "T17601F1B0D25EE9BB00CBB76649CB6C40D770974753A0A2B0F010F455CC690BC9AEB9C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638719738, "uuid": "62508c92-8850-4db1-8fd0-7845bdb5c3c8", "value": "12:dJKHI8SbtfIPj+1agd3pm9iV5RRJF8g23A0/UW/9y5HnONEZuUvR9GgIZk:z78SbpIPH2EUR4g2R/5/c8yfZMgIZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638719738, "uuid": "a0191066-b74e-4802-be1b-537cbaf464f3", "value": 850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638719738, "uuid": "2a72fd9c-6bd9-47ca-a787-4c74d7675667", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638719738, "uuid": "187371d2-4f37-46eb-88b1-7231f8cc8e72", "value": "ENYXDAA75833.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b978f29f-5622-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638746768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638746768, "uuid": "3cde606f-89f5-4cb3-bf53-2bb22ceef77e", "comment": "Malware payload", "value": "9c2d8d410d7e63b73a5d9b486596068a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638746768, "uuid": "2b8575d6-121b-44f6-8c22-328ba3df0535", "comment": "Malware payload", "value": "c8d7412885e4a009a4faf5937c43fa0ded78f72c533530197d3bc77154dde086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638746768, "uuid": "d7ab9cf9-2ebc-49b6-a997-495b951d70e6", "comment": "Malware payload", "value": "325e5bbce0e56fdac720ddbc58d6167b5528b4eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638746768, "uuid": "688eb4a8-0369-4c42-b8de-fe5dbad14b29", "comment": "Malware payload", "value": "0070bb8f93a68d32596c51d4b93c4653da1b6a6afbeaf59300b3323d98c8bfb33a0174e0c819120dfa36502af6ebd0dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638746768, "uuid": "6d02e412-d9a7-47aa-806c-0e45c7d97b43", "value": "T1377533D55BC51E5ACACBFB36D9373CDFE0AA8D04E0793652B789189244334D2FA2C624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638746768, "uuid": "e281ccfd-13c8-4034-b312-acd6ca7fa823", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638746768, "uuid": "88c56dc8-8ce2-4478-ace9-8d802a00369d", "value": "49152:GbFuM7lncvNRGVOS9auE4yhrbQKc1RkLItiNaY+M1J:U2vNREuutykRHe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638746768, "uuid": "dc86cf36-2c75-457c-9237-6116a55d286d", "value": 1655296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638746768, "uuid": "f4122b38-1f72-43c6-abac-8893f53aa45c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638746768, "uuid": "fa8cccbc-dbfa-4e32-81e1-cca29aede41b", "value": "GenshinImpactCheatV5.2_ByCOREXIM42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a233cf03-560b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638736850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638736850, "uuid": "98db2b6a-ffbb-4e4a-a67d-f6fa6e38cbef", "comment": "Malware payload", "value": "40502b1e4df3529295088665ff0dbd00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638736850, "uuid": "83240981-bc81-4d28-bb21-1460a1647bb8", "comment": "Malware payload", "value": "cb2193b9f38eea9678584714365263b79033b0ef9f2738bc77b930ced5b9e067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638736850, "uuid": "d9e4913a-a25b-42a9-8e32-072bd066a248", "comment": "Malware payload", "value": "2b150b5cffe95657c8c48ddc93e15330539f7cab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638736850, "uuid": "80b58230-7afd-403d-aca6-484733ea2ef7", "comment": "Malware payload", "value": "8164034e0ecadbb397cde6cfe78069073722c665cdce92f16ab817c3017d256e5a2d0215ee3c5f7d069460c7ec50396c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638736850, "uuid": "6d2a72ff-7db4-4ba2-b765-8e838c6dc41b", "value": "T11715BF41B3F645A9C4A7A079D46AB707FA75348A032187CB33D44914BF9A7F00AFEB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638736850, "uuid": "7427db41-0f02-455d-963e-f49c995a27d0", "value": "34fcffefcb99dda6d5b6aa8651d30389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638736850, "uuid": "eb62ffa6-070f-4df6-af2d-7326126f3817", "value": "24576:pYNERoybJQUTM/JuHYanKVx7gQJpjIZ2Zunkdf:pYNERBNpT8JsncxsQjjM7no", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638736850, "uuid": "fc7af0d9-4838-4bf0-90ed-edb44ca1742e", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638736850, "uuid": "8f677a83-8f4b-4a46-b55a-e58fb8a84f32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638736850, "uuid": "3239b5e4-f36c-48cc-96aa-8a0b2e5a9a5b", "value": "GMod-SDK-x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615ef649-5610-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638738889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638738889, "uuid": "a8125381-a0a0-45f4-beb3-efedc7c57029", "comment": "Malware payload (Mirai)", "value": "b851a018fa5096100d9465e00a01e882", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638738889, "uuid": "a1f763a0-79cd-4179-baff-bb387a06cc18", "comment": "Malware payload (Mirai)", "value": "ccf6d26cd67bb7211e3ce7f1d4153873e6455ee41b55492ed3840772a059339b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638738889, "uuid": "100b1f6c-9ba0-4297-a0e4-051b6b6ad44c", "comment": "Malware payload (Mirai)", "value": "d95b6ed2ea420299ae05931b1f34e441e65faf74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638738889, "uuid": "7b30ffb0-62c3-4ac9-acd5-f8fcae71b993", "comment": "Malware payload (Mirai)", "value": "473590aff4f08e7667e25f0db077b2ff0c799b719f550761c71f10c1c6b7e06ae80e8dad9628a5a43213026649027a21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638738889, "uuid": "7ed1ac61-3320-4c1a-b9d2-753571e8f182", "value": "T110E2E19EA5F42DE6DF8C5C3E138C0A79BFC7545713289B85232644C4A61E4A9F8DC47C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638738889, "uuid": "ab221ce4-c4ab-4f53-9a2e-1dcbb4862bae", "value": "384:X3fpCLrsjHIX69URc+hmnulY1qHprFKt6zhS45vDajssVwfMe+ea39RWGVCz0Nvf:nfpWcehzJFYKgULAssKfMPea3LWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638738889, "uuid": "b968577d-4f39-4e5e-8322-53367910fca8", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638738889, "uuid": "4d90a346-444e-4aff-b65c-069974f6697e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638738889, "uuid": "41fbf002-e870-4278-9fa4-a805dd1f9beb", "value": "b851a018fa5096100d9465e00a01e882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b54f218-558d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638682722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638682722, "uuid": "d6710804-3ced-4f59-b437-0187734b1839", "comment": "Malware payload (Heodo)", "value": "dcc9cd03e8fdd21d888adf56ca91c725", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638682722, "uuid": "544663cb-8523-4494-a6ac-0ffa39ab44bb", "comment": "Malware payload (Heodo)", "value": "cd6b85734e5a409140391350723c5b0c00ad3916bc2054faeb74be108386ef4c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638682722, "uuid": "904b58dd-7801-4c2b-bb45-7e196b71d263", "comment": "Malware payload (Heodo)", "value": "bd2e5a1c480a934d398f678a3725677a72fd8257", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638682722, "uuid": "d41c90a2-50f2-4f65-bfe3-66eef39e12b7", "comment": "Malware payload (Heodo)", "value": "c3cada6ad95e0a0c20917395393917e96d7074b3f7fd4b91bf086089236f665640cab1483e120d7eea656aed3a9996ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638682722, "uuid": "8f820604-f1b3-483d-93dc-a6869c43a8c9", "value": "T1B1648D11B683D072D5BE04307978CA96096D79318FB4CAEBB7D41A3E4E702C19B36E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638682722, "uuid": "54c862de-0353-404f-b452-756d2aa4d9f6", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638682722, "uuid": "cf27c6e0-bcad-48ff-b315-e4535f10286e", "value": "6144:+AriSO7B4gYcl/qjc5dQD8JCedcsqAOBCWOEl:+AriSOG9c0jc5mDQxqf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638682722, "uuid": "6594e52b-b68f-4fe0-a1f3-f579ed0f6b35", "value": 332436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638682722, "uuid": "da6ded78-36af-41ff-9e52-f216eef0e601", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638682722, "uuid": "8466910d-b528-45e6-8f7e-91ae63765bf4", "value": "emotet_exe_e5_cd6b85734e5a409140391350723c5b0c00ad3916bc2054faeb74be108386ef4c_2021-12-05__053837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba7d5c2-559b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638688789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688789, "uuid": "1c40d6aa-d68c-45c8-a76a-758d6ddd44d6", "comment": "Malware payload (Dridex)", "value": "e2b9c45d656fe41c2e7a572153aac7c3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688789, "uuid": "fb9341bb-5d2f-4895-9445-725ea00daa3f", "comment": "Malware payload (Dridex)", "value": "cfed7707ec0b03c4258047a7db7f5d0a1a181285efcff3ce9dbddbc98005bf51", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688789, "uuid": "d0df1231-d613-4006-be9b-e63a2e4a1356", "comment": "Malware payload (Dridex)", "value": "a62f735cec096eb3d71333cd6404e3b104ddfa82", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638688789, "uuid": "1f063bba-5a39-4b30-b932-2cadca31734e", "comment": "Malware payload (Dridex)", "value": "3c4175df46aa511a1f52e751ca5c61c8b11696be1cf0e3961d7cd7755219a2bbc2df5738cc3680207e0abee09255fccd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688789, "uuid": "01f3f373-3f91-40c7-983f-27a3ce2d3886", "value": "T120D31222ABB1E836CB13AC7E910F1B532287EA278FC36913F185519C9600F5353E09D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688789, "uuid": "78e55718-88c6-47d8-962b-d3609cde0f8f", "value": "3072:HZIic/GrcqOjPg1M16TguaNTLGmtLfJ3hN8DqH9999999HqT99999999WnsAGanp:HZfcerc//+kLGmxfJ3hNci3OUdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638688789, "uuid": "4b2071b2-a424-4759-92dc-2a562b84bb10", "value": 134111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638688789, "uuid": "e9eded24-9b2b-4a67-914a-55cde808001a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638688789, "uuid": "4fc95d24-13fd-43ca-890d-2eb9a4612d9b", "value": "order-076106826415.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed2ab94-561e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638744978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638744978, "uuid": "b560df1e-c1cc-4d11-b29b-036fd5830bbc", "comment": "Malware payload", "value": "cb45c822805604bfdc51e584aea85dd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638744978, "uuid": "87a24770-5874-4b70-bfbe-dc53c64a83ec", "comment": "Malware payload", "value": "d212d1c7a3ed6723bebf3b3214a0b738bbc5cb2fd3c7379190c819285a67f47d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638744978, "uuid": "77627b75-7826-49a9-825a-90247dd3f980", "comment": "Malware payload", "value": "d9d775faa18cbf6a0f6d53fbd9b2accd31cadbf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638744978, "uuid": "29ff17e5-99be-44e5-95c5-43b149007afe", "comment": "Malware payload", "value": "c62967f1b9b2601d31cd3e94d166924540296fd0f7f4456b71a7d4c35f5b10e20e0fab771d55fe40bfa24791cafc17ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638744978, "uuid": "2727f54f-e9fd-4bef-91f8-25ef2e2c80ac", "value": "T1C2853322C384EE2DC34A30BEDEF8252E47FBE15BCAD45F47B54E08B016AE5466910F59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638744978, "uuid": "83cf00dc-0776-4218-a8ff-07972b4b1db1", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638744978, "uuid": "0c96a1dc-2bcd-402b-ad43-df06047207d3", "value": "49152:lPZRdddoCA9CxfDB09Fl5BDvA1NaH4r3WpI:lVdeCjl4bvAffWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638744978, "uuid": "57d81e59-bda8-4e3c-b233-3515be1f3c22", "value": 1762000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638744978, "uuid": "c62a433c-1ada-41ea-a313-f0454b426410", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638744978, "uuid": "ad3bdcc5-8b39-415c-8519-6ae051329903", "value": "hwidspoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1a160f-559c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638689007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689007, "uuid": "5d813f8c-431c-4007-8b04-efe9d527b1f3", "comment": "Malware payload (RaccoonStealer)", "value": "d6c1945bccf38070b4bdf13a53c0471f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689007, "uuid": "aee6cd43-7029-405f-a0c0-8d5ba17d46e7", "comment": "Malware payload (RaccoonStealer)", "value": "d3e12edcfc74eb3d0c54fb626db2d61a82553186504d6fe249bbba792935d425", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689007, "uuid": "3aec1b1e-d803-4c63-9cae-5269f7f10be9", "comment": "Malware payload (RaccoonStealer)", "value": "6614064f629b76a3c15f3035839767d48ae7e21d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689007, "uuid": "2658c47d-518b-47b0-a795-d278ab7113e3", "comment": "Malware payload (RaccoonStealer)", "value": "4a9f0c73cbfde65715993b0d01e4fd4762863f71d290a04e9a01108490c7f54bfc32919ff85b1b8222e2d9e2ea94f6c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689007, "uuid": "35536acc-5400-4f8b-8350-d61f7c02bbd6", "value": "T1ECC4E11467A0C039F1B752F88D7AD364752E7DA1AB7980CF62C536EA66346E4EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689007, "uuid": "1ba48e3b-f72d-4e46-af2a-78297acd6920", "value": "6762d92a3e24838e5da051dd2a6d017d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689007, "uuid": "8404d117-36a9-4726-9a94-6527ff397715", "value": "12288:TwU2q5osatHiaoDBOiyo+snAgcQ5kTeotOszB:TN7yHvoDBO9o8Lgobz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638689007, "uuid": "b6d37f8d-6c41-4543-8855-e2b4087a6e0d", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638689007, "uuid": "e3d5ff8b-1c82-44b8-b7b4-77f2821c27a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689007, "uuid": "1d72d6cf-6e66-4b4e-9b8b-ecc8818c5532", "value": "d6c1945bccf38070b4bdf13a53c0471f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10368aba-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708259, "uuid": "859a683d-6863-4460-b208-805f29936d75", "comment": "Malware payload", "value": "a44ca1236d0b00bf13d393abddf59d3e", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708259, "uuid": "36e43252-e334-4641-bcbd-55627410a7cd", "comment": "Malware payload", "value": "d5b8f624fc4a1a4ee008d5ac019433101f99c4e6ca45734e388e13366c9c12fa", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708259, "uuid": "1b1bbef2-9b0b-4372-8fb6-3944a5066c9c", "comment": "Malware payload", "value": "e503d1cdf37c84aaff34d4459cef1199b514a34b", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708259, "uuid": "c71b9b76-0bd0-4c03-a17b-abaee721ac19", "comment": "Malware payload", "value": "a2b357e071cff02c8f68207f054af4fdbf821af99c2502293eb7f5a3d706b276808720cd91876c0b81407d24c8841f9c", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708259, "uuid": "6e2f1d79-2121-4d1b-b96e-85baf22c171f", "value": "T127F5330C63EDB8FDA89A46383B6384E1C5E552F1988224F2D77815580C3F17E5BDFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708259, "uuid": "da0df2aa-f981-4fdf-8576-e9d3906d537a", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM5:0XSxVJG2fLAqFOfT9sMYNM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708259, "uuid": "ca28caa2-72f2-402f-af75-14e2f6b2bbae", "value": 3538944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708259, "uuid": "e8682240-1a67-41df-b587-938dbea31fb9", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708259, "uuid": "89fcc21d-6fb2-418b-87fd-55f1716465a6", "value": "d5b8f624fc4a1a4ee008d5ac019433101f99c4e6ca45734e388e13366c9c12fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2093f65a-5626-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638748229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748229, "uuid": "a63db761-66b1-4c00-a844-fb60719f00dc", "comment": "Malware payload", "value": "3e33c7192098ab041ca4ea90829363b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748229, "uuid": "2c5af13b-c35d-42aa-a170-681db4330712", "comment": "Malware payload", "value": "d6a72727c864d6cf5e22d7bd83357bfd45687e2679e73f43cf4c9638cfe99bc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748229, "uuid": "4d7e9e75-018c-4960-ab96-e6a0266dc6ab", "comment": "Malware payload", "value": "49a194eea9dcd35e4033c5ad04275d83c7008314", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748229, "uuid": "f1f903c7-2963-4778-8577-42050b2d81ad", "comment": "Malware payload", "value": "51d4c16c2aed524a0cf69ee8a89cf9dc8dc0b4c750d2872d20faf2e2642bd059e0cfa4d69a5145e3f4103cb543351ab8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748229, "uuid": "f259b5af-e646-4f28-9764-c92f6901a9af", "value": "T101E533319DC211BBECB3A37125FAA28397787CD0262D13FCA14AA5E5993CBC1097A715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748229, "uuid": "af32b106-eb71-45f2-83a5-2313309d2417", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748229, "uuid": "84bbf555-a9fb-48f1-b03d-b958ace7d9a1", "value": "49152:LAxGr3VXuKwi8+MjVp2fBDUYZrLxujNwZRdUMKS0ENKG7R1p8GYTK:LAxkXuT+u2fRUYZHgjkeSZcGl1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748229, "uuid": "d2c9e6c5-6389-49d1-a988-6bbd7e297b5e", "value": 3050496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748229, "uuid": "3326b582-5604-4c06-a86a-2c4bc6360a22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748229, "uuid": "7bc1c43a-d206-47a2-ac96-30896c095439", "value": "3e33c7192098ab041ca4ea90829363b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c580bcec-55d8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638715005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638715005, "uuid": "62cf4bbf-a188-4792-8847-488b04cc6ae1", "comment": "Malware payload (RedLineStealer)", "value": "ec3084840807e4b9bee68ec57cb4113c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638715005, "uuid": "28148efc-7c90-402f-9191-08340ec93208", "comment": "Malware payload (RedLineStealer)", "value": "d6be31c82e908431d580147ac48c2fa9fe61039d4c493b441e714fc2a7ca6fb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638715005, "uuid": "48b0351e-38f3-4b29-89c4-ba874c96a496", "comment": "Malware payload (RedLineStealer)", "value": "18c0f1009b945ce2ebdacbb73e485e0e0451e8b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638715005, "uuid": "475aa0f8-e940-4d83-9ab9-052a67406892", "comment": "Malware payload (RedLineStealer)", "value": "5cd15f7fb3fcb12cf528c1d088f249f47c535f134d8730df0ef205332cb204de91ce936357a1b8ba4d5073ba0a442742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638715005, "uuid": "57079a4b-816d-4ebc-a6a2-fe602161b72e", "value": "T168647D106BA0C435F1B756F889BAD3A8A93F79E1EB2C90CF62D516EA46346D4DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638715005, "uuid": "739ca73e-b484-4f00-b838-2d374cff5df4", "value": "e8c238b864f7b42d074feea3c8efffa3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638715005, "uuid": "7cb07b16-78c5-4007-8526-602b4e4c691f", "value": "6144:GqdhHlTxA5jRqHT7GQ+SXuZet0ygwJA+mtsUG6p:FSVRqHT7N+SXuZet0ygwJWsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638715005, "uuid": "a456cd74-b33b-45cd-95a0-e8fd4574acce", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638715005, "uuid": "cebdf300-2813-4178-a47e-8b295fe9e5cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638715005, "uuid": "0d3fd2bd-0fb2-4c6a-8611-387572816ad9", "value": "ec3084840807e4b9bee68ec57cb4113c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f8a4f1-5584-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638678977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678977, "uuid": "8677f9aa-989a-4f22-aeb4-2cc1495ba1ed", "comment": "Malware payload (Gafgyt)", "value": "efa21965d00e44927b50b62bfc0daede", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678977, "uuid": "cedfb464-a479-478d-90cb-e69dfef0d352", "comment": "Malware payload (Gafgyt)", "value": "d6eec08d9e3c64adcb9a4c1622dfe0e915a5a53d965c2b3c57cb09c97d67c325", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678977, "uuid": "eba7fcf5-a25b-4433-9750-eb089fe9236f", "comment": "Malware payload (Gafgyt)", "value": "d71ca6d80c46b3baeb5654e1fc475c7bcbc1f942", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678977, "uuid": "7ec50bed-b4e9-4f05-bc5f-02d23611a607", "comment": "Malware payload (Gafgyt)", "value": "fb21dc4ac8654a253058e40b417bf41d32b62d8bca023d8d4189d9511bc65f3aee718e0399f58783672cad9c29e8259a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678977, "uuid": "a64cf5fc-86f9-4138-95bf-dc46b6fa5ea2", "value": "T1ED934A4785719EB3C042AEB926FB9974031368624B0F1F64612E9BF8074B9CDFC8E765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678977, "uuid": "8b80dc86-8b25-42b8-b172-9f656ca79aa4", "value": "1536:tz0vObP72IQeMbO1ojtXSISUUjI2q95NfmoUs2ttYVc+:twObP6I7UfSRM2CmHs2jYVc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638678977, "uuid": "004b9693-8f6d-4a40-92d7-e87317c38627", "value": 97453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638678977, "uuid": "bb4a0f8c-3234-4293-b23b-460ee2c29b34", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678977, "uuid": "994e4dde-ff8f-41ec-aec8-a8ffdf6c64f0", "value": "efa21965d00e44927b50b62bfc0daede", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e7ba63-5566-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638666065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666065, "uuid": "6a410c81-003e-4707-8174-c96bfedf5c92", "comment": "Malware payload", "value": "b621a0e7f246cf329be4488cef5cfdb0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666065, "uuid": "a37ef411-2a9c-4ba4-a6dc-81a54c92189f", "comment": "Malware payload", "value": "d6f9044dd96119f51322fe49e600d11d67249f83ad5f62c0b7c3a7b342354aec", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666065, "uuid": "1407d50f-e26a-4b6d-8559-9ea3e44297c0", "comment": "Malware payload", "value": "2b6d67cdefda769bd2a6b6eaa13645e07f57cb3d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666065, "uuid": "74c10068-f079-41cc-944f-9e5c242d08f4", "comment": "Malware payload", "value": "d6ae0585fab4d42f2406d7cf6df4790aaa705283a87973698d56c2f36ba4e4169a58f47d4a8db2948ff3c3550e6a2175", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666065, "uuid": "dd812121-ffcc-47a5-b85f-f28215e5f90e", "value": "T153E433FB86852F132256256E7FF0D256CE94B25520E227A7A047F0D40B111BB456CBFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666065, "uuid": "62a704ad-8459-4dd1-8e52-ee265178c629", "value": "12288:KAya7neCFYjNtOyn/crAkKBI+Rlk8M9+ej75Y8UoKtPtt4km++ijQsP4i80uA+YI:ca7nFFYBUlrAkmt275goKtFt4km3iujx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638666065, "uuid": "59fd74aa-d069-4e80-a5b9-bf65699fba68", "value": 662870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638666065, "uuid": "6c43e549-337a-45cf-8b80-10c7751b6b8b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666065, "uuid": "fc35f322-2aa5-49f7-b75d-e9402454cee3", "value": "\u4efb\u52a1 \u57ab\u4ed8 \u6d3e\u5355\u6740\u5ba2\u4e0e\u7ef4\u62a4\u8bdd\u672f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b0b3c6-5590-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638683835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683835, "uuid": "9cf38c81-5d78-4f5d-9150-05be5221efd3", "comment": "Malware payload (RedLineStealer)", "value": "72fd6124a1dbe632a397560ace2d813b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683835, "uuid": "e5010a4d-eb65-48f3-b2aa-65d6b2a69284", "comment": "Malware payload (RedLineStealer)", "value": "d7446941b5aa39ddc27d10fe643a54f80aafb2abaf07e0ab54cefdb72403fed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683835, "uuid": "45da52c5-d637-4769-85ab-cc3d86f3c0a5", "comment": "Malware payload (RedLineStealer)", "value": "86b28e7d6e45f01184afb1b3656a9b985c4ed1d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683835, "uuid": "29d7559b-8eea-4f65-95cf-2968db0e1d21", "comment": "Malware payload (RedLineStealer)", "value": "4ab8f91fdd0541e67ecbc522f7c1425dfd7ae89cf8b15d503f8da2a1092d6c8eb0dfa023c8ed03b9fc69c70d004e5888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683835, "uuid": "9b829f8e-e6d6-4cac-8b8d-d190056543ae", "value": "T132449D1232E0C033D58725768525CBB58EBA74312A266ACBBFD44EBD9F247D1A73530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683835, "uuid": "f1e91acf-1e87-4967-bfce-9a060315361c", "value": "b776dbe5b4a858696713fd07b4876aba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683835, "uuid": "7be30f15-dd9f-445e-97d3-4aa57a550945", "value": "3072:9DOyifz6+kxF/ALYxGiZ8t6GJi/PdgcEkSjrC3MBjUbHFbKCH8xwfi9QMTN56XP2:56fvkbAsZqa6xfa3MKbHM08xV6MOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638683835, "uuid": "1683cb4b-c3e1-4a2c-8c29-3c2a54f47e1d", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638683835, "uuid": "7d437b86-32b5-47ec-9157-45ca12b06c0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683835, "uuid": "922a0749-9644-43f9-8a08-3a214f9a0ada", "value": "72fd6124a1dbe632a397560ace2d813b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80f9b7f-55e7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638721452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721452, "uuid": "09f5d5c5-fa39-41d2-9d41-c7e1895d328e", "comment": "Malware payload (Mirai)", "value": "eb3c038d8e965bcc3838bc2bd36df6f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721452, "uuid": "0f351774-fd80-495b-89ca-fc6d4420a49d", "comment": "Malware payload (Mirai)", "value": "d7d4b13111c40825b4bbf27af8df5138dfa243daac4e80d8b3df168238c5ab62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721452, "uuid": "87cef582-90fe-4a3c-8286-9cc2b185ccd9", "comment": "Malware payload (Mirai)", "value": "75fac37e1262aa0d95208913d8e1f8b31992919c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721452, "uuid": "0a62a584-d6e5-43ae-a5ee-441e3c562c02", "comment": "Malware payload (Mirai)", "value": "5380ba15f029f6532970d67a60af11211d392fb37bcb9e7dc9b197a262f3629cab62d03649495aa9d4985511600fc3f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721452, "uuid": "a54beab9-19af-4975-b978-e52827ad5742", "value": "T1C3538E76D9B85CA0D54889B072188DB89B03A40462E37FF1C642CF295407BFCF959BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721452, "uuid": "0cdbef3a-b7cf-4812-b69b-37d3ca81d961", "value": "1536:5/72zYaFGPF2tDDblU+2ML8j+asgTj/8EC0F:5T2sLPFsRU+BvgTj/8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721452, "uuid": "74cad1c9-d890-4aa0-b8f8-7f4ffef8b9b2", "value": 62456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721452, "uuid": "d0f61103-071c-4837-a262-29bdf795d5e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721452, "uuid": "e994b4c1-0450-4717-9552-f89ae581376c", "value": "eb3c038d8e965bcc3838bc2bd36df6f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8115165c-55b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638701576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701576, "uuid": "bc658485-92c4-4a97-9fd9-25b2364861b1", "comment": "Malware payload (CryptBot)", "value": "a05f0bd0884eea0764eba85cb8313534", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701576, "uuid": "5554d51d-65d0-445c-ad02-82502201d1e4", "comment": "Malware payload (CryptBot)", "value": "d912f1611688d78496c3d637b84853b3d3537cc67b18f63c6f0660dc5f7e6ad9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701576, "uuid": "1c73374f-9c17-4b2e-942b-0abb2fb75af1", "comment": "Malware payload (CryptBot)", "value": "f7e529d708523ad176c6ec9cf674b92230355542", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701576, "uuid": "91159062-269d-4d5a-937c-b209c182b0f5", "comment": "Malware payload (CryptBot)", "value": "4d08c3702ceb7e2a21e8426dbb3e7f7db62b67685541a91799365c5bc4fb960bab9de029896fee438fed119ca75752b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701576, "uuid": "1cf197e0-5210-4345-b313-6422ea28ea2e", "value": "T14C84DF1172D0C033C44365728926CBB15EBAB4715BA669CFBBD85FBD4F243C2A72630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701576, "uuid": "3afc30e2-433d-4d23-b39c-19836937e340", "value": "57414c9b174f8e0ff83324cb2c99bb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701576, "uuid": "c668914c-998b-4177-a1d0-35cd0ce890a7", "value": "6144:zVb529A3WmGYNIniMw3L+aHohkLOTqoe+g/xwXI1Sefryl:zVbk6WmGKKiMUL+aHOjZe+g/Psaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638701576, "uuid": "30244333-1b4f-4616-a0a2-678db11f70c7", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638701576, "uuid": "b626fa8d-0920-450b-b857-92828ab8ab6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701576, "uuid": "31bac852-ac98-4039-ac42-bc93931d7a86", "value": "a05f0bd0884eea0764eba85cb8313534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d06d92-5560-11ec-96a4-42010a9c0029", "comment": "Malware payload (BlackMatter)", "timestamp": 1638663411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663411, "uuid": "651ff8d4-d601-4fd7-83e1-46db907835cb", "comment": "Malware payload (BlackMatter)", "value": "451e17fd4720b996b6b7515b90f12c79", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663411, "uuid": "f2d027f9-4a94-4038-9e08-ab0958601439", "comment": "Malware payload (BlackMatter)", "value": "d9a0283f6e1e1bf2690fbe4c60b8bafbe971ca96f5bb754917427b1f709759ce", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663411, "uuid": "d83ca78d-f0a6-489a-87d0-62e50531b208", "comment": "Malware payload (BlackMatter)", "value": "88dd181ba9133b094fdbcaadb1154ff4ce5df8f0", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663411, "uuid": "5ed05322-5140-4289-adc0-0540d0ac1e10", "comment": "Malware payload (BlackMatter)", "value": "c74ef1ae516a5ec8d8016a51acf222f4945fde98501a5edd2180c46ada6022c01607f363a2e634a82018e8a4b4841036", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663411, "uuid": "1de2d943-c30e-4a4f-a55d-53948ae8557b", "value": "T1D6D433C67878F0A03E5D963ED62765A3929F50A0768C41F0CFDE7A14CD31A9B90783E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663411, "uuid": "8aa83219-f41f-4fab-9e4c-01598be84cc3", "value": "12288:cL7o1d3EMhX+N1PSOjwlY8+PWEo6maXwy3R6oS21dJJgRp1/:+o1dUo+NDq0PhiORBS2/gRpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638663411, "uuid": "4ec19fd5-e1ad-4ae8-bcf3-3193d4ff16a8", "value": 599497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638663411, "uuid": "fb39855f-7cf9-4e92-88ce-d3e871cdef8d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663411, "uuid": "537dbf54-d679-4178-a238-2ff2c9c7e8d4", "value": "BlackMatter-win_PS1-reflective.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1fc7a4e-55e7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638721469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721469, "uuid": "fb3b03da-0007-41ab-bbf0-4ca929863058", "comment": "Malware payload (Gafgyt)", "value": "6aeb31d76bd4a1ea1bfb8d10a6e38a7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721469, "uuid": "6027ab54-e2a9-48e2-b26e-5b487891e700", "comment": "Malware payload (Gafgyt)", "value": "da344f46991206c4f6b3448cd742abf63183062c8f831ef7fa4460cb3e2bf67b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721469, "uuid": "1eb4d674-0903-45ac-8e5c-197f619542b9", "comment": "Malware payload (Gafgyt)", "value": "23091a0215f7bc6ab608f7dcb583269e53a0cf6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721469, "uuid": "9793a90b-a3cf-4fc8-bc6a-c567a3f0c568", "comment": "Malware payload (Gafgyt)", "value": "387313711a3c4b3386abd649b9fcfeda7a0c24e5651def4a96013a111d491ceabee288fca6daeb8b98aee646e1042922", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721469, "uuid": "17b39084-879e-4370-a8e9-c42b84efcfa5", "value": "T159833B03B71D0B53C49B69F029FB3BF18769B9E123A26580B11ABFD44773AB02412F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721469, "uuid": "8e9cf989-bc96-4cf2-97cf-b95ed32f70a7", "value": "1536:EQpFOADppqlDZHWwc31dW3ISvRd4IuAAkQEmQ9VqXjtWf2Xe:ESVDu1Hc31dW3FPuPkQEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721469, "uuid": "2e03c5cb-ac9c-4451-a9c6-c45d92907119", "value": 88787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721469, "uuid": "336f8000-79b7-43af-ba26-c230314cfe55", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721469, "uuid": "710b808f-4d17-4e3c-a328-d265b7011aec", "value": "6aeb31d76bd4a1ea1bfb8d10a6e38a7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e49e1e-559f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638690607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690607, "uuid": "93ac590a-be47-4fff-956a-bb933f65a008", "comment": "Malware payload (Mirai)", "value": "da6472a59a840e9220724fa7a3ae42f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690607, "uuid": "836dc377-21ba-48db-ab68-8d6e995a1a15", "comment": "Malware payload (Mirai)", "value": "daa106d2873904b6186576e7f7d096193bd8bef7d4f4ae1f0f88bfdb05ad3d62", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690607, "uuid": "8488cd00-852c-4056-af25-451d79412f51", "comment": "Malware payload (Mirai)", "value": "aa53b22f94c4c6a31253338c68b08c46f03b3afa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638690607, "uuid": "498f69c8-b7a3-439c-8041-628b81678581", "comment": "Malware payload (Mirai)", "value": "307ced4f98b78e70bbb4a170eb218598c2f0234e8b8ce37c2f77ebf2bd18a4a1a8585f9b4f473b52ae137e10bed4d041", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690607, "uuid": "645a1297-7ec5-4b25-b547-07a42928f67b", "value": "T10543F23095EBB0B36EF16D7A953C090BE2B07A35D6B5B311508782D4AAFF413827394A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690607, "uuid": "9da94a3b-20fd-4622-8356-c6477c747c2e", "value": "768:ZHb25mVrNQa65b9piIzMQJ/6VsYHntlqGVFGqLQVZq3UI74E5irTmGTf7AuGIhtp:hbxVi7jMQJ/6ntlqIFP8V21Ci+DAuGwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638690607, "uuid": "f2fa618c-6dba-4ff6-a26a-3342e7a860da", "value": 58660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638690607, "uuid": "8f918d5b-67b8-41b4-824c-1d158e1e3c1f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638690607, "uuid": "0182fad2-2991-46f7-beb1-c10a64997961", "value": "911.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764af4f7-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638693827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693827, "uuid": "bca50904-2c44-46ad-8f02-7376ce3cbdba", "comment": "Malware payload (Smoke Loader)", "value": "9e900e1e67f18c994f83754cdb675977", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693827, "uuid": "ded5c46c-ee2c-4cb5-a853-a82ebf3fd4ee", "comment": "Malware payload (Smoke Loader)", "value": "dac0453a1239f16a52f2b6697b3a13bac8cf4d9bb6f4a0e622e354e4b25275e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693827, "uuid": "aad60b25-a8ef-435f-a445-10a07734a644", "comment": "Malware payload (Smoke Loader)", "value": "9fa8847ba8a5eb721ca69bc11d874648ed0e2647", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693827, "uuid": "8183228e-2f23-43b2-828a-4f67c2f6f4de", "comment": "Malware payload (Smoke Loader)", "value": "6b60110c937168bfbf41407f32385a3ba81ece0675924b3d6b02b1390a8393da0f0b0795e0667c8fa391caf53d40cafa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693827, "uuid": "e4e59dbd-bfa6-4a08-a0f3-1245c02a1e8c", "value": "T147C533A5DEA41E10F3024CFBFEE542494126BCD147873AA3D20CF268EA1597B9F42F65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693827, "uuid": "d6438de6-e7f3-4363-a059-f934b8b3be56", "value": "2a2a662be9dffc461398e7c94d0b55b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693827, "uuid": "e4fd9a87-65ca-4c6c-b634-930ed5d64a88", "value": "49152:XCidskAwCz8vXl5L6G5Uh4u+uSCl5EF/xN:XCjHwss0YG4u9Gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693827, "uuid": "a3af930a-5c3a-4e2a-89d1-825885f5c56d", "value": 2515456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693827, "uuid": "9070bd53-1aef-4463-9dfd-ddbfdab77cfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693827, "uuid": "524b33ec-0f35-4e1a-8e9e-70793bf3bed4", "value": "9e900e1e67f18c994f83754cdb675977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826d6bf2-5570-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638670225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638670225, "uuid": "277ae896-7eec-47ac-84a7-d1922c056fd6", "comment": "Malware payload (GuLoader)", "value": "957313f36053565ceaedcac055b1fd20", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638670225, "uuid": "035fdb05-ca08-4d6b-8952-b2e4f06f1c62", "comment": "Malware payload (GuLoader)", "value": "dbdbf3ae75ae2a711fb2548afd168d5664f897c0d42c0fd2041a2d854cb81712", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638670225, "uuid": "3e101371-a4f9-4f4e-aea3-bb6c212e323d", "comment": "Malware payload (GuLoader)", "value": "1ef757ae3c0b16b9765a20e15968fd943619dd92", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638670225, "uuid": "94f9a5f9-2a92-4fb1-b666-9cd53424674c", "comment": "Malware payload (GuLoader)", "value": "7d4b68d06965242153ce837f1af7d85c9b8dc59307ca7e2d6ca98fc94cedcbad82e2fc392920f4f24918e55b6b4852c0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638670225, "uuid": "ea412532-2e4e-4a3f-8831-f586a506b504", "value": "T12992DD7EF55B0A489E96D67C061ABBA5064CF41C73C440D23ABCDB383A5D91B8B22D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638670225, "uuid": "4030ae5a-370c-4329-b74b-e9a8297c34c3", "value": "384:eTSjwzKuaUyp6wb9c374VA4W6KudzCpuNwwlc5:eTSkU63424W6K6EWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638670225, "uuid": "bdca3b0d-9881-43db-9beb-25a8b518c234", "value": 20799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638670225, "uuid": "9b6ff133-454f-4323-b3b9-89839e4705cf", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638670225, "uuid": "76c32998-d0cd-4324-9d67-5036ef2f9db0", "value": "957313f36053565ceaedcac055b1fd20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b63f1a-559c-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638689185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689185, "uuid": "ad64432c-547c-4216-ad55-a22f79be7165", "comment": "Malware payload (SnakeKeylogger)", "value": "4e5581d1565991c580786be9ea17ca9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689185, "uuid": "d0edea94-6ebb-4bdb-8a7d-c9cfa7d0e06f", "comment": "Malware payload (SnakeKeylogger)", "value": "dcc41c9cd44244db1d417b41c3ce05e9081c24086b446f1b53df2e425ce8978f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689185, "uuid": "7e7a9f47-adb6-4ebd-b9da-7995b95b9cd6", "comment": "Malware payload (SnakeKeylogger)", "value": "0755d99a3f188719df948d02f79d57f0cae542fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689185, "uuid": "c8e83abb-7796-4775-8beb-88fb0ed38883", "comment": "Malware payload (SnakeKeylogger)", "value": "996c9361e4b01d9be5c4c67fab5037d7fb9156b2da80b4de0c6105d86da1d630e1487ba6fe4fff321cca5b633cf9f032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689185, "uuid": "5069a00c-1dc1-4ad7-9e97-939860e01298", "value": "T112D4391126E4D6A4F4BBFB72ADB1604543F5BCE2E631C24DFE5170DE88B1A428A61733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689185, "uuid": "47676338-4ebd-4882-9025-a98762e2961d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689185, "uuid": "ef9865ff-2a2f-406c-87a1-872976a26703", "value": "12288:WfvSmNYVwt9QMTxwGobBVlUM3TF58ve66e:evShMTxwbBVlUGM6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638689185, "uuid": "b809a5f4-21ab-4cae-ad86-d23505fbf327", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638689185, "uuid": "899c4a3d-d2ca-4fb4-8fab-2d15039dc6e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689185, "uuid": "70a34ba6-d10b-408d-a944-d921e32ac05d", "value": "4e5581d1565991c580786be9ea17ca9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25cfc6a-55e8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638721952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721952, "uuid": "4ca47c95-c2df-4e59-99bb-5468a1435200", "comment": "Malware payload (Mirai)", "value": "50a61e9def52f64ad7a7372487b3590a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721952, "uuid": "a3917416-351e-4e84-b949-52a9ee961a04", "comment": "Malware payload (Mirai)", "value": "dcc83ea0e8ff3ad5caf2502713604ffbf8bbdb4f22975874f4676642186a9356", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721952, "uuid": "ec9e0829-de11-44da-802e-5862d3407cf6", "comment": "Malware payload (Mirai)", "value": "e11628a959bcc2271c260c5241ee682aed173342", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721952, "uuid": "907005f7-3fef-4e5b-873a-6083690a7ba2", "comment": "Malware payload (Mirai)", "value": "b8fcbdbc5c9eedce02491804215458df3abc792b0e42476a4fe4945d3016d804aa2385d6a686c53f7adc2dd1a7c56f98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721952, "uuid": "efb77e5a-bc55-49b8-af09-da26c1383812", "value": "T11243E682BC40A629C7C04777EEAF509E3314A7D9D0EA3742DD150BA4BA8ED1F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721952, "uuid": "ba43f006-a5c2-4d61-a0f7-17fa2e79a5a5", "value": "1536:nt3PFZFfkWXJABbmb+ExdySfU27AHWPo:nttZFfrdbM2MHWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721952, "uuid": "1c7b80e7-ca0f-4cf8-bf40-75c005f93103", "value": 59656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721952, "uuid": "4d0f39ca-76f2-45b4-ad0a-4fe18cbedca7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721952, "uuid": "b201c152-33e1-4094-94a2-e3adb6c28ae8", "value": "50a61e9def52f64ad7a7372487b3590a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e018dd06-5566-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638666087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666087, "uuid": "60365a7b-1261-48a0-b0a4-a368cac965ba", "comment": "Malware payload", "value": "5153b67fac9bef353698ce4b903cc070", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666087, "uuid": "e760490d-9da8-471d-9400-4f083355af7b", "comment": "Malware payload", "value": "dd43195b30e9d17f0bc8cc62b5d8a080f154c51d5c74dffa6f07f4d1ad90f846", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666087, "uuid": "c4ba973b-2d80-4cd2-8b11-7421375e7f46", "comment": "Malware payload", "value": "a817c79ee16eae660ed315153c3bb9f77bdec059", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638666087, "uuid": "7afe39e5-57e8-407c-ad95-ed8ef9424ece", "comment": "Malware payload", "value": "15a92be7acea7a61d264f465c1565f18ca26d73a48591ea090540322a2757f1e2066f9b6d9f04306252369970a49a39c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666087, "uuid": "7643902d-4d03-4fc4-9534-6374c705e64c", "value": "T166E423DBAD9855D1CF1946A84DD6713585146122E26EE2FABF71C306CC8EB328C1A3CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666087, "uuid": "c3708511-ef1f-4c8a-b1ba-7349fe9ec19f", "value": "12288:Wg01F8eUXGVD9WRW3crmxBHlxqJg6nsq/LHB8sZw+63WtMjn/Pl:Wgy8GVD9WRW3crmrlxJ6nF/l8siXWeLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638666087, "uuid": "d67846b1-4790-4e54-90a1-6c283181e8e8", "value": 690666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638666087, "uuid": "db15d361-3409-413e-91b7-fdfec1527ec6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638666087, "uuid": "0760ff87-731d-48a7-8cf8-ec2f1adf87b4", "value": "\u59d0\u59b9\u82b1\u8d85\u5927\u80f8\u9152\u5427\u88ab\u8001\u677f\u82b1\u4e24\u4e07\u5e26\u5230\u9152\u5e97.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293a79da-55fc-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638730205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638730205, "uuid": "98037e4e-b1c5-4c00-a295-d8a8a20e84d8", "comment": "Malware payload (Mirai)", "value": "5e58fc8ba578c41a8c563e885e6efb0f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638730205, "uuid": "b09b0145-89dd-42ca-a7fe-0bcbfdafc062", "comment": "Malware payload (Mirai)", "value": "de0e4338b169b5aa1852305a6810384fd85f7d62567bf918f7be79c7e2012565", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638730205, "uuid": "6c422080-e3d9-4d72-a550-5aa7b9f8e17d", "comment": "Malware payload (Mirai)", "value": "625f25720957da07dc3cea31c491f6be3c3d1d91", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638730205, "uuid": "fc3b2ee4-0578-4903-98bf-2666f7347969", "comment": "Malware payload (Mirai)", "value": "466f6c530ad43060e9aee25af97880c60eb4043b6801abf5da88526fce43b6e837c53e249f25fae9ac9ad49b164c61b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638730205, "uuid": "b68a1295-2383-42db-aae7-7176b534da98", "value": "T14943F1418943EDB1E1702976C1E4828E7EAD67B1E9FD6B2A3F094AC30AD01C8E1F7475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638730205, "uuid": "ea02d751-9989-4da0-bf97-2a3072de6ef9", "value": "768:V4QKsE9rbNXS5mHueIAblH/X3X+YXWFkD/7saB4x6aJQ8q3UIeagpqKQFlEluYtq:KxNXKIueIAblHv3uu4WzeagMctq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638730205, "uuid": "a63e939e-071d-4e10-961a-b1b116bdb029", "value": 56080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638730205, "uuid": "da034b8b-6fb8-47df-b70c-6ba795c8b37d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638730205, "uuid": "d7a4df72-c5b3-4886-b437-5ff03cd3409e", "value": "z0r0.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3641dd75-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638693719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693719, "uuid": "8c9f0f1a-3c30-43c6-a96c-09676712f3a4", "comment": "Malware payload", "value": "7c71fc6f5f0d363bc69f05b1a5dabb1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693719, "uuid": "b01844e2-0db4-4abf-80ba-c7e2750bcaab", "comment": "Malware payload", "value": "def1513f311912ff63f0c478e2b3533223008c89730bf360189a76c7088c9126", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693719, "uuid": "bfda09a0-4c23-4d30-8e96-3abe88a0b9d9", "comment": "Malware payload", "value": "37ba611c4a7471898768dada4d7bf75f14eab20f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693719, "uuid": "315e9c88-3564-4a4a-984a-9f852c8b30cc", "comment": "Malware payload", "value": "55f9b7217ff51053211f1fc54b288d5300bd863de85a13d4c1c704ab20139d676681c66461311de59b22961955875e68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693719, "uuid": "346ee538-badf-4ab0-be3e-0e4c20ed14c4", "value": "T19CD507A87136CE33B1BEB37CD61182A172E64CDE76725668785DAC20B8CE76C3D4C449", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693719, "uuid": "614d210d-969d-47d5-a584-8a57803a927c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693719, "uuid": "9280c667-45a6-4a40-b0dd-342c8e939fc3", "value": "12288:fp/ZLG5qpS6surRh0PVjNxDAVhUWqWbHvwSp2Y9t5sA/oDK5yeX:JZb30PVjNpoTnpFvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693719, "uuid": "e57863c4-4284-4d1a-9806-0de02834bfdd", "value": 2892800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693719, "uuid": "4943a117-65dc-4820-89fe-bd26b5aba6de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693719, "uuid": "905e4388-f90e-4d7f-9767-120c435e465b", "value": "7c71fc6f5f0d363bc69f05b1a5dabb1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3ab6b0-560c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638737407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737407, "uuid": "e1c3fe85-c050-4493-9241-4b89e1885a04", "comment": "Malware payload (Mirai)", "value": "864d9c65c9b5ee570e0bc23009c180bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737407, "uuid": "f88054b4-73ca-4a9a-b80a-d6846baba157", "comment": "Malware payload (Mirai)", "value": "df2f7b15fc5bd800418ea0e0ae7fb371b4f645b0c963cb5cc00e25a8ea19db72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737407, "uuid": "3993dd16-8717-4f32-85ab-453dc8de4e16", "comment": "Malware payload (Mirai)", "value": "3631d091c91bef7dfe3cadf635ce8d2763972965", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638737407, "uuid": "e2677457-b131-4c88-a926-3d14d42c0b6f", "comment": "Malware payload (Mirai)", "value": "a67b5a4c779054e8f3f93431e8a186a04ad92b853dd5cfbd3759fb3a0e7e6de9060d7f35b08e257a89a7243c7ecb454d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737407, "uuid": "a7230d54-7561-4909-ae65-4579ab15ebb1", "value": "T195D2F1B5AFBA860EF489633C9D5EDCD9259CBCA12BB9424A06411F2230385E1E3DCCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737407, "uuid": "87dffc97-322c-4ba8-bbcb-6fcbdbd6bbb1", "value": "768:fN8fWlfoQmQAXV7EAQciiRcLprDKaUxmgqR:1MNXFl7NN4P6sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638737407, "uuid": "3ce80077-2e43-4686-acb8-1af40125a725", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638737407, "uuid": "214d0a0e-3c68-4826-93e8-f18c9fd6c775", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638737407, "uuid": "4338f1e7-2437-4eae-bce0-6e9fd7e4dccd", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72027692-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638722596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722596, "uuid": "97b5ae6b-697e-4e4e-9d9a-99122d58e87b", "comment": "Malware payload (Mirai)", "value": "456280b6ce61601aa453f9bb3f5c32bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722596, "uuid": "8c3cfbe8-bad0-4d45-8139-60451bc8a6e5", "comment": "Malware payload (Mirai)", "value": "df41016eb3705c391c29e4b7dbbaba4965d6ff3c26a537498560d48e89b02b75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722596, "uuid": "44e87231-1fec-4c99-9178-d553e920fcf7", "comment": "Malware payload (Mirai)", "value": "a2a6d8c65f8bbbf8ae6fb89f57c2eeb20e74ec66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722596, "uuid": "3cdbb749-ae0b-47a1-822f-9827da178f17", "comment": "Malware payload (Mirai)", "value": "1707526c7141315af3c5046124ea4a9b0b9663fb8eb0a70e893929b47bf168f5a0c0be74d9f0c0a0e59b90e72734119a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722596, "uuid": "57932540-b772-4faa-b8b6-306e211e5f82", "value": "T167630782BC40E626C7C04677FE6F508E331567C9E1EA73429D192BA07ACFC1B0D6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722596, "uuid": "1d2b9c14-e39f-4209-88da-a63b9529ab54", "value": "1536:hvCzp9PJyQEDnDK+VyDuAZLJuSfU27gc7gtxJ7C:hvePJyo7J3M2z7gtxJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722596, "uuid": "294c1ae4-ef2b-485d-8fef-12178d1def01", "value": 68520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722596, "uuid": "2095337c-00b3-4db9-b533-a1a30bcd76be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722596, "uuid": "1fb43988-e4be-47fd-a950-81e9c7f4de02", "value": "456280b6ce61601aa453f9bb3f5c32bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfcd8c8-55d7-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638714295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714295, "uuid": "d1d5adf8-fcb3-4407-9304-ecc84f58a346", "comment": "Malware payload (CryptBot)", "value": "91ae96fc080755610fba8cfe60e11a27", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714295, "uuid": "a5f97775-26a1-4b99-81c3-7fbc17aff14e", "comment": "Malware payload (CryptBot)", "value": "dfaa01aade481f0f908b50dcd87028ebf19042e48ae483f822b0c3f5ba3c92a8", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714295, "uuid": "218dd462-9a78-4892-a93d-07efe95306b6", "comment": "Malware payload (CryptBot)", "value": "7cf2d02c50e923e2e5aa8f3aae1b1da1a9a65846", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714295, "uuid": "ca1f0d55-23a1-41ab-9a6d-2f6263eaa75b", "comment": "Malware payload (CryptBot)", "value": "066c772f8479b6f625eefd57485c849959c52f7c8c718f7fde34ed788579c71f204cadf30c27fd8fd6a2218c917fc543", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714295, "uuid": "3366410b-e8ff-449d-b083-4cfc8f7ff8eb", "value": "T11384CF1172D0C033D08265328D25CBB65EBAB47016A66ACFBFD85FB95F247D2A73530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714295, "uuid": "22368ab6-c0ae-45a6-84a3-767081c578f2", "value": "a65482a1f9e06ba3a44a5530ea74c096", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714295, "uuid": "0cc7197d-4888-4058-a1b9-6954ff79119f", "value": "6144:f1hBNPOdeWKiTpni5IGgEEWwTNeUXYZDY+pEDGG3BY:f1hfPieWKilimJEjw0SYq+mDHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638714295, "uuid": "d691db37-6e50-4ebc-b4a1-ba8685440cea", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638714295, "uuid": "a61cb1ba-7ced-4634-b62b-a1c7a07e77a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714295, "uuid": "9c6e9264-3baf-47a7-b2d0-bdd1d1d0ff4e", "value": "SecuriteInfo.com.Trojan.DownLoader44.10657.642.21017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4f8bd5-55d7-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638714290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714290, "uuid": "975980a4-d316-4dbc-994f-dd1d87fc1dc2", "comment": "Malware payload (CryptBot)", "value": "f2f5b4e40981ad6f8fa6c8cb9ee44403", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714290, "uuid": "7e322ba3-354f-490e-b053-492a48b52a8d", "comment": "Malware payload (CryptBot)", "value": "e0c124e496535864bd9098df513abae532e7f13ae1164144314a4bd581d524ab", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714290, "uuid": "d893f2a4-ef5e-4836-962b-5cd0357c12a4", "comment": "Malware payload (CryptBot)", "value": "c7ed6f84c08d4a64b7f6855b2b97cce7bf3f4909", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638714290, "uuid": "331b796c-7b23-4483-8c98-6ff4de16ea77", "comment": "Malware payload (CryptBot)", "value": "35a7bdbc28b001077aa70e8ba5135d2fdd70342dca902300ba85434959944b6244db6c3838023b6751644abdac7f2e9d", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714290, "uuid": "fd28abb5-a94f-4ce6-9c94-129e3410b0e4", "value": "T12C84CF1176D1C033C09320768C29C7B54EBAB47517662ACFBBE85FB91F647D2A63630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714290, "uuid": "f1f5658a-7eb9-44aa-b75e-f0f387347faa", "value": "a65482a1f9e06ba3a44a5530ea74c096", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714290, "uuid": "93fdbe8a-ff80-4144-8ab1-dffe4e784da0", "value": "6144:+whBNfOdeWKiTpniPznsiys71Y1yAsx5/fhpZe5307b1:+whffieWKilirnys7dff1f1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638714290, "uuid": "c1036e65-3460-4d9a-a387-b6a884df718c", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638714290, "uuid": "5561299b-48b2-4cd7-a55c-c238233ad38a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638714290, "uuid": "439c4b8e-ff65-42c0-aec8-b5b899c00c80", "value": "SecuriteInfo.com.Trojan.DownLoader44.10657.3658.21249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a61e2a6-5591-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638684358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684358, "uuid": "09d9b6e6-f551-4dd0-8341-ef2d4e365293", "comment": "Malware payload (RaccoonStealer)", "value": "807675ef43da7eabb62795d7c02f7078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684358, "uuid": "5974dde3-f2b4-4508-947f-9114cd4074cb", "comment": "Malware payload (RaccoonStealer)", "value": "e0dc9892401f354cc3ca63c1e6e66b2fd93a804b3ea09bd348d8f55859847022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684358, "uuid": "ec4eecc9-7cc0-4cdb-987f-6c43fff7879f", "comment": "Malware payload (RaccoonStealer)", "value": "e644406057ee1688e309be8cb0a143e5c6e9f5f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684358, "uuid": "ec6fae07-2611-4649-9f89-485ca9186701", "comment": "Malware payload (RaccoonStealer)", "value": "5e373ae8ad6408ea1446e55f2801c487cc36d197a4dd5d5087552327fb6cb784ee3c9d0a1a54f62a53fa54f4f549a9e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684358, "uuid": "758ff41a-d557-4692-b12e-0553e159ed93", "value": "T19DC4F12133C0D133D05724719216C7B15EBA7832576A29CBBBC91A781F24EF1AB3A71E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684358, "uuid": "001f82f0-440d-4272-82cf-8afba36e08c8", "value": "ace494ecc2c2c2c7ecf836ae6aa78574", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684358, "uuid": "cecbd098-579a-4feb-9d60-e626f292e065", "value": "12288:pEW6av37wrLJRQkHqgPpyIJN9Gq/uxPv1R/g8rt:pEdajwxRBtTIXxH1R/g8rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638684358, "uuid": "c0c75869-f282-49b6-83d9-cb24d7c9078c", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638684358, "uuid": "1655e169-9344-4d4d-a29f-a7a7c9d2a3dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684358, "uuid": "5a61e6e0-03e6-46c1-bbc8-35f5b0e581ed", "value": "e0dc9892401f354cc3ca63c1e6e66b2fd93a804b3ea09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30cb943-55e8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638721927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721927, "uuid": "9108c742-2725-401b-a0c0-f3a328f4d0e4", "comment": "Malware payload (Mirai)", "value": "1b2c7ff60c4d48fe321357e86376e819", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721927, "uuid": "592058c8-06d8-44ee-8047-4a2e0aab491e", "comment": "Malware payload (Mirai)", "value": "e0e97d61e3123576670c294bcad2118b9cd25f7c65e9a20126e3b86cf168d883", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721927, "uuid": "4687f3d3-9fab-4ede-8942-64f8602d85d1", "comment": "Malware payload (Mirai)", "value": "bd5852ad3d93e799a16409647d9660569b1a5abc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721927, "uuid": "cb191917-a233-41c1-ae8e-53fc2e910108", "comment": "Malware payload (Mirai)", "value": "82a05ff7e2da363731891bef9b15c042d5e2d85a6a5bd66577eb8dfe3e1ecfd2717def2b7a162bc8626012240ef5fc58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721927, "uuid": "daac156d-25e0-46af-a169-9f2abdb3c85f", "value": "T12A734914A87A2E27C0D8927E11FB8B66F2F5330E2470866D7D360F8EFF50694A546277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721927, "uuid": "bd7575ce-bbcc-4e0d-ab47-040c95a72124", "value": "768:Kt7CUwM0wM+noP9/ce9JHar57ojBzB3SsFQVnB3YiFvpvyaw+BXxesTtOiV2KxyL:aCaJnQ9/ce90watOPEH+Ny7C7F9Y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721927, "uuid": "5ad7827d-9cab-40e2-a53a-f9aa16401bc6", "value": 74760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721927, "uuid": "123176f1-3c43-4891-a13b-6ae817c61ce5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721927, "uuid": "6f879284-3fce-4d6b-913f-ac0754adee8b", "value": "1b2c7ff60c4d48fe321357e86376e819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45b555e-55a3-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638692267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692267, "uuid": "003515b0-1783-443b-b27e-87084745d0ed", "comment": "Malware payload (RedLineStealer)", "value": "c6626f7bef89248607e29afb17fcce9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692267, "uuid": "8186f399-a75b-416d-a0ad-7938b1034b60", "comment": "Malware payload (RedLineStealer)", "value": "e169389f93b1c80752ff3a8e38cab5751d48269a2a13318ffec1e8e19e91d56c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692267, "uuid": "8986af12-fc40-4918-8b01-1e08e7e69f8e", "comment": "Malware payload (RedLineStealer)", "value": "d1da0dd98222b62d510a57af994c060bb2d1ecd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638692267, "uuid": "d1a4c47e-36cd-468f-be94-395b605ab2fb", "comment": "Malware payload (RedLineStealer)", "value": "2d0d4fe3e07ee53bdd2760e1fd8fbb98d3671d71fe327e9f88fd605f906dde24e197ee4311d1bc9b20a8ac9eb43f796d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692267, "uuid": "ef94f088-cc4f-4320-b96f-625963ef7ba1", "value": "T1BB84CF1272C0C032C19765768926CBB15ABAB4745A726ACF7FD90BBC5F247C1A73230E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692267, "uuid": "49fc4592-6358-49cc-bd0d-46fb8a3f1915", "value": "1b81e8f7d77881f7dbd36488c7ba26dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692267, "uuid": "fe023fb7-911f-4067-856d-ea53eebc452b", "value": "6144:IXVYu5+cV0HzK8QE3/zVrqj+od0Dssnt6+896hJgLxCY7gEqur7:IXVYu5tiG8QE3Fq6o25s/Q/gLxCxE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638692267, "uuid": "7f77dd9e-b5ca-46a0-a3b7-6e6cc3269c12", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638692267, "uuid": "226c1ac3-0845-432c-b38b-0a29c5b1be3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638692267, "uuid": "ba8c8ba2-d72e-4a0c-a0b7-8767c77f5158", "value": "c6626f7bef89248607e29afb17fcce9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9cda0a-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638722557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722557, "uuid": "bcb8f817-d1b1-49a5-bd91-b698c4290b32", "comment": "Malware payload (Mirai)", "value": "3a55eeebc14c0e3baa0c7a087a319392", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722557, "uuid": "a58490ce-1943-4235-ab9e-2e5c767e2276", "comment": "Malware payload (Mirai)", "value": "e2b89e84667aa5cf403d62a2502b36bdb1e85a9807d214d44708c13065d9f430", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722557, "uuid": "a43d01f4-7116-44e5-ada8-6addba7612f9", "comment": "Malware payload (Mirai)", "value": "fd04456a72c9aba809eb8ec40d8ddaccd723046a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722557, "uuid": "da68b779-2495-4607-8590-a24fe6f9e020", "comment": "Malware payload (Mirai)", "value": "86b53e814e46eacf0f09ee2b5dcf1730d0ecd33653883dc0d6450f49a14cdc4ad5fe48f82906c5614ab2ecdeb57d6d26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722557, "uuid": "1804c054-75ab-493a-a410-1acb5e2fddf0", "value": "T1E993621AAFA05EF7E8AFDC3389991B5920DD141B20587B75BD30D814F24E68F09E38B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722557, "uuid": "3b3ce81d-1649-4626-a4c5-fcc74efa0214", "value": "1536:OJG1SjRndlNr3ccI6736anufqV0RQmHY9TZ9BRi/:KG1SjRndP3PIkqYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722557, "uuid": "e7c1cfc2-65c1-4f10-8ff9-8419497cd26b", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722557, "uuid": "f0d4142e-a439-4cc7-a229-998aa5e57033", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722557, "uuid": "c51c73b2-08bb-4f39-9bc3-e8940fc31476", "value": "3a55eeebc14c0e3baa0c7a087a319392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ee433b-5621-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638746170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638746170, "uuid": "9037cccb-3c16-44d7-89e4-b6460fad8194", "comment": "Malware payload (RedLineStealer)", "value": "c353b5c96ce1ec83dd84af5726560818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638746170, "uuid": "9234381b-e157-4a0d-ba3a-ada83817165a", "comment": "Malware payload (RedLineStealer)", "value": "e4826271c99b813c7c8688acc3850e55cb8e01651f7c5b301174c902a6e23eb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638746170, "uuid": "76163538-9c95-4322-8b52-8241a3ab40db", "comment": "Malware payload (RedLineStealer)", "value": "445a4aadbd266d551ec3d4dfc52c3734721c1dd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638746170, "uuid": "75486d57-018e-437c-8d7e-b67016d69779", "comment": "Malware payload (RedLineStealer)", "value": "c4397341d640cc47f777882c20be9c328ec48b4f2b43a711fd6e33936758e5710575b76f6cda5858b6289a8754c0cdf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638746170, "uuid": "9d3fb053-3648-4922-9dc0-3f635a1fb193", "value": "T15094BF4131BB8AB6E57324340634E6F3196A79391F7FA8DBB3D8163E89713E04173865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638746170, "uuid": "21533a9c-bad7-4a5f-86d6-50e1796d11ce", "value": "7e6d410cb0ee9d4d9be8ad4e6fd75b64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638746170, "uuid": "9e12216f-b029-49f4-8c15-387044df9180", "value": "6144:LObPSfbSHesL0VS8NKgnDtefVdiDxcAOQfciwGuYqVVn65t/1Dqnh:LePSfbSHesL+SLdAcaf/tzqnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638746170, "uuid": "20670fb9-a586-4648-9795-a4d16bfe1c83", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638746170, "uuid": "b438a5a2-4ccd-4003-b7aa-a90f6f10315c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638746170, "uuid": "03c70821-4dc7-4f8b-b9ee-dc0965b83726", "value": "VEGAS 19 UPLOAD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ce3392-5627-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638748664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748664, "uuid": "34b30f61-9ccc-4e85-ab21-722f1221aa28", "comment": "Malware payload", "value": "ee613018522aad5eeea373ddbebf21f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748664, "uuid": "a87b8607-b441-4bbb-8e2a-4b3921a2d9c0", "comment": "Malware payload", "value": "e49a09c8b47f21970536a21d7a04e462ec244356901646381ac1e380b91a564a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748664, "uuid": "192c2856-406a-46f0-aed0-9ac8012e6784", "comment": "Malware payload", "value": "bdd60abead97d8dbf3f55f467c3555401f94208a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748664, "uuid": "d4567be9-5f85-4432-b16e-aeef9d55c02e", "comment": "Malware payload", "value": "ef9545a1ab7bdfab652913c54a24029e31ac269c68cc1a2f5016346569ce2a015d2b5bf45159c5d87107da1da1c37a1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748664, "uuid": "ebd6237a-e086-4787-a159-b7a3b47381f1", "value": "T15D563343F4226DB2D6015D7692191A30A67A7F224F2C8BDFB3E45A16D6742E073312FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748664, "uuid": "ef94a55b-954e-4cc3-b8d6-16181cf287c1", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748664, "uuid": "d8d2029d-2c91-46e0-829f-7becba40e273", "value": "98304:JXhAmwO8eJ3psRK4b/CHzcDTxSL0Y2X5mMTvYefq52Bim9ga/VfIllxTUu8e7m:1hbP88psRK4b6II2X4MT9fZ9gQWxYK7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748664, "uuid": "8c4d22c2-d477-476e-b035-21bfd6d17bf6", "value": 6416239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748664, "uuid": "a552f02b-8b97-48d3-87fe-3ea4d126d8cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748664, "uuid": "e5a00500-dfb0-4736-8435-363ccd1522dc", "value": "ee613018522aad5eeea373ddbebf21f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cea1aa6-559d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638689543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689543, "uuid": "efdfbe42-127e-48ae-93e1-d99d4809a600", "comment": "Malware payload", "value": "7ff9f96f25cd36c986868dcf7f6153e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689543, "uuid": "1c6ee5ae-ab28-4e85-9bdb-68f95d381a9c", "comment": "Malware payload", "value": "e4c07db54643460f941ce8af377422cf0a0598ec2caabf5848e80765fd514943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689543, "uuid": "81742e76-d7f9-4ea4-801d-8075aea2f81b", "comment": "Malware payload", "value": "1bf35aafa32d607a8f7e52760edfde891399df1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638689543, "uuid": "1c1c0528-3f7b-4a08-be76-a1bc514dc4c9", "comment": "Malware payload", "value": "9137aa19f2d4ecd379999f008d7f61d2b434e9bc0adacae71df0a0221f840d6fb9f122afa60ba94192f4a60e5d0f67cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689543, "uuid": "9ad4171a-838c-4101-882f-0041bfd20a53", "value": "T19E048D49A58380E6DB7DC4B0CB231B57EDB47C213B952BEF5F20B9560F32690D43A21A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689543, "uuid": "1e296527-0e3c-47cf-8aeb-9dac36553274", "value": "4237acd5d4d4c9a98a443ba83a0bc7f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689543, "uuid": "edc7406f-b677-4c22-b113-5ebce096cbea", "value": "3072:xQKZCAzijbcEhY3QibJI35adlwTivzMVCXOnNxGQiHn3joVS9Oa:xQ/A2jbcFQibWTIzMCXOnTAo89Oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638689543, "uuid": "59f63c49-3b41-45a5-89c6-9fa30a5fb8b4", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638689543, "uuid": "7cb74999-f86b-4815-b70e-ed9efc379523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638689543, "uuid": "ee5f171a-b8ec-447d-a65f-81ff42daf005", "value": "7ff9f96f25cd36c986868dcf7f6153e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10adf8e6-55ac-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638695804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695804, "uuid": "c657dd4f-ddc8-4341-bf69-ed1b847547f3", "comment": "Malware payload (DCRat)", "value": "ac4bbc19d3c9a298f27fc1b2eafcbe1f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695804, "uuid": "91cec432-1d8d-423a-bff2-0a6af2ebd672", "comment": "Malware payload (DCRat)", "value": "e5026fe17d0075afe3c6e5f465d8adfeea8af4b288cda7630c027dad000098bf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695804, "uuid": "856bc3a4-1468-4a19-babb-616c57d9a59a", "comment": "Malware payload (DCRat)", "value": "74055ffbe202b640ed57222ce69b3fd3ef072d1f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638695804, "uuid": "b111c119-6fe6-46a8-a8ac-f55379ada174", "comment": "Malware payload (DCRat)", "value": "e188d93e5f9f3fd483f2493faf286b392d13fa8f4d994a1f3264bc93d45073e8dcfd504e9e67b4056308c42937ef4991", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695804, "uuid": "07e78757-fac5-4ecd-a2ad-cd750327fea4", "value": "T199456C123A44DE02D129173BC6EF405583BCAD457A62DB2A7E6F73AD25513AB0E0D8CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695804, "uuid": "8c522821-9c53-462e-94bc-d01f714e685b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695804, "uuid": "6e8b7731-1bee-4dd9-b046-2a2192bc5e88", "value": "24576:mfD0xM0PfkpQULK/ZVAQNaqEtwHKWOb/fCrSr+4:F604jLKQmXHbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638695804, "uuid": "e852b460-4bee-4301-b0f2-99f1c88c2d30", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638695804, "uuid": "c6d93fa5-7657-4cbb-b99a-52a8d5d7a30a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638695804, "uuid": "09111176-887b-414d-aaf4-c7a0368b4fbd", "value": "ac4bbc19d3c9a298f27fc1b2eafcbe1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83d5849-5584-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638678932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678932, "uuid": "8bbb5bcc-61bd-4b2f-8d6f-d316c173738a", "comment": "Malware payload", "value": "3efc23105dd99f3c021b0c8c31b80829", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678932, "uuid": "74e06a5e-a055-4f1e-9195-5a683f0e9cda", "comment": "Malware payload", "value": "e509ab5a8df302faa793c57372be4bc7f5033fccb92797928c084307267e3cf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678932, "uuid": "9aec5eb9-70c4-4451-9f0c-b0de2f53e570", "comment": "Malware payload", "value": "45a4412ed2cf114d1fa8b137da6604f4a717c10e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638678932, "uuid": "e803aa87-ffc1-4dc3-a652-4c4e03e7c181", "comment": "Malware payload", "value": "810f399a41dc829d6f9002bd0691f7c04bc0e56ed07afaa81110c9c1fb1fa038008b4008e423f2f5c3b2b12fc3861103", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678932, "uuid": "efa28667-fc94-444e-8dae-0ea03d44b2d7", "value": "T151E34A05D7408B57C1E2277AEBCB424933339B54A7D733099A38ABF43FC27A95E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678932, "uuid": "d57851a6-9dd3-47ea-ba5e-a9cb14a79389", "value": "3072:8tB+B7aEuNwWPaEAseCnrW7n1erM/9RDF+mLwfCDQSAW:WB+B7juCWPaUDnrW7nsrM/9RsmLwfCE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638678932, "uuid": "caf73efd-13ed-4f34-a9f4-17ce75172123", "value": 150337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638678932, "uuid": "c79969c5-dbad-47d6-b725-20cfb33215c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638678932, "uuid": "80ca9243-c485-4712-b4d2-2ce9cef0027d", "value": "3efc23105dd99f3c021b0c8c31b80829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc67d085-55e8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638721969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721969, "uuid": "715129a2-2694-4a71-b1c7-c736b3212a48", "comment": "Malware payload (Mirai)", "value": "e429016e6bf8973235a991f3273dd5b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721969, "uuid": "ca33c027-5b76-4994-a2ad-447fbf635fda", "comment": "Malware payload (Mirai)", "value": "e6357bd7b48377f3db98a7ec219ab5b79f407f2e677365564bb297f72f3a4c4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721969, "uuid": "5e9d7b58-8b3d-466c-ac80-4bec3b7247d6", "comment": "Malware payload (Mirai)", "value": "a3ed92e2b199dd4b3cd03462a6f91535ee980b50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721969, "uuid": "69dbad9c-8c46-40ee-97fd-86844d69c2de", "comment": "Malware payload (Mirai)", "value": "92b475c875779d9d878a09d295ff222e683cebdb65b13249c63f0c9694ad940345be60d7dd053ab0847c6203513170fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721969, "uuid": "0d9a2f49-b126-43c4-8c50-a4dcf072413e", "value": "T104B33A57671C0B43C58B5AF52C7737F187ADEA7112E221C5E40EBF801B72A701A26FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721969, "uuid": "584579c6-6a5d-4a9d-a384-3261cdc7daa8", "value": "3072:FHXfEEPOH0UHNzONBbsQy5h7zPku62QnI0PDG4gQNcR:F3LRUHNzOwQy5h7zc2QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721969, "uuid": "6b77e451-8212-4f10-a9ac-28d71b3d2955", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721969, "uuid": "62d76f6d-a50c-460e-8fc9-ebb008b7dfba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721969, "uuid": "542d12d5-1ba0-42cf-9e90-431da411a1a0", "value": "e429016e6bf8973235a991f3273dd5b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9c6fd0-55b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638701622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701622, "uuid": "8955b902-a95f-4122-83ab-5c574f41b0ac", "comment": "Malware payload (CryptBot)", "value": "7746ec6e55dc1957a3de5189bde4cdd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701622, "uuid": "839231b4-cf70-483f-9b5d-492c0bc85330", "comment": "Malware payload (CryptBot)", "value": "e72d6b4f1c18ed7ffe19bf0e029e0da687881e667a74b41f677ebc2dacc34d05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701622, "uuid": "3d0ac464-ff29-48f6-91b0-b94d4aa4eca0", "comment": "Malware payload (CryptBot)", "value": "f6aeba8f808a16d05cb763389e2f8b40301cc45f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701622, "uuid": "5ef1a523-fcd9-4260-b8a5-8605eb67dad6", "comment": "Malware payload (CryptBot)", "value": "32709c9bb2d58c1dd56269a926db6a2750e5c16b4bc04462aa3114bbc5be0f4cf90fb476045c1728a2d71ade74375d1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701622, "uuid": "c0f5c7f0-2f0d-4e65-a31a-5a2b4d6b7719", "value": "T16B84CF1136D0C033C09664768925C7F15EBAB57106BA6ACFBBD86FB95F243D2A33530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701622, "uuid": "73b10d53-d44f-4828-a04a-621a21c48d52", "value": "57414c9b174f8e0ff83324cb2c99bb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701622, "uuid": "81e06e9c-a511-43e8-83ae-8bd29ed97ec4", "value": "6144:AEb52tA3WmGYNIniv2Z3pIrkErGc+xZrCoFObResoIrk:AEbkqWmGKKiO3CxxoFO0Xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638701622, "uuid": "27e8ae8c-3eb6-445c-8276-dfead5dbabd8", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638701622, "uuid": "deb455d4-f841-475f-b5a4-0bdfc03124db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701622, "uuid": "f32dd2c8-e004-47b9-8491-26f50fe301a6", "value": "7746ec6e55dc1957a3de5189bde4cdd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69cf84d-55b2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638698767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638698767, "uuid": "3572ae87-46bb-4b81-8b61-a9d93b20b267", "comment": "Malware payload (Mirai)", "value": "06fa8c877c285fbdf08bff367674452d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638698767, "uuid": "cf8b88f0-dd1d-4871-b0be-67952d17f96e", "comment": "Malware payload (Mirai)", "value": "e796321a98ace2bcc2e5bde4a27ddfd96a414a420b82c1dfa2eee00212c9e5ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638698767, "uuid": "582d69ae-9cd3-4feb-ade7-046f99321026", "comment": "Malware payload (Mirai)", "value": "33f9e46256652da57230ed34940e7129fb8884f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638698767, "uuid": "f2feedb5-107a-4009-9c80-a6a6eb447102", "comment": "Malware payload (Mirai)", "value": "57e7daf98a3cb1f75e1e2778a19b0d59f126c8c58d46a147294006bbc28f9ad78ea067f7f7f57872ce9fa216d4bfee0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638698767, "uuid": "b2152a66-3969-4ae2-bfc6-58c1853ece46", "value": "T1C1534A21BA792E17C0D1A57E12F74714B2F56B4E29B8C62E3C320F4EFF50A44A2562F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638698767, "uuid": "2e9a9f41-9bef-42e3-8b81-a1e0bc9a5345", "value": "768:hSoWJpNbT8YKWHRmPN0VRktrcvhYc0agPJzw01qi5b1DdNVoqaWO+eCPpXeL1Xvh:hSVbbT8YKWxmPN0VR+kgB801lfa0eHiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638698767, "uuid": "cb371948-fb89-4db9-aa6b-ad63aae8dc14", "value": 62496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638698767, "uuid": "e6c83b2d-6f2b-4f16-a43a-19bd9b86f0bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638698767, "uuid": "786803f3-b693-417b-9ce8-eaeeacf94568", "value": "06fa8c877c285fbdf08bff367674452d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce30450a-5619-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638742937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742937, "uuid": "8a24df7c-a022-4aef-9373-0af19f01d35f", "comment": "Malware payload", "value": "5efb083253b10845936cfb40752d094a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742937, "uuid": "6a2973ea-2dcd-4270-97d8-80bc71b82e99", "comment": "Malware payload", "value": "e81fccbe3ac5dfbdcf4fb0e49657980726a3dbcf3ace3547a6bb7f50b13bfa94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742937, "uuid": "3c01f988-9fff-4450-8f01-64a2ac56b531", "comment": "Malware payload", "value": "26d8daf4ab66c0dbf5b1a58607533de42705b0dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638742937, "uuid": "31ca47eb-0898-4ea7-83ae-c8413f370d8e", "comment": "Malware payload", "value": "be4f377d6c2e76fb07c7c146b837c0a9016bd1b3b1218c951ca6603a10e5cb11750678d4cbaeb88732fd6959090f4b06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742937, "uuid": "0ddca7c3-fafc-4e3d-adc2-ebdd905f002c", "value": "T12A7533EECACD6F5ED08FF4774282F27E059998647738B061600B6258522F064BECD3B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742937, "uuid": "436568e3-1294-4c67-a5e8-600bb4402f65", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742937, "uuid": "89f6b9c4-ab28-436a-b8d1-8739fc80ba99", "value": "24576:XC9wZNFketOC/pGOk/6ehqfkrN7pOPuo+36/fiOl0M8eBlfZVHL8Ha+Yf1kEaHNC:n8W/kOkbAgZpk+H+8e5Vrqa+iNaV+M1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638742937, "uuid": "59b488d5-8419-427f-87e1-a82b7f09a4a3", "value": 1654272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638742937, "uuid": "70983de7-16bc-4008-a690-596e17b3fc72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638742937, "uuid": "3bff51d7-a9f0-4781-95d2-7035a5d1837a", "value": "AXIE INFINITE AFK FARM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21a8fde-5590-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638684129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684129, "uuid": "53a15738-29b9-4808-8cbd-1218458efd93", "comment": "Malware payload", "value": "be315459f7244dbfbf2e8c7a0aac63e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684129, "uuid": "5c034402-bb6a-4e4b-913d-53a57ecc8604", "comment": "Malware payload", "value": "e82dd1f4afdd3ab5298ddaee0051d5a7047417dfd65c6e53fcdad53b78f8b699", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684129, "uuid": "2ee98f58-4769-466d-a5b1-f3aec8f9d139", "comment": "Malware payload", "value": "79934f444b2496c629be4f91bd18578f1f05d862", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638684129, "uuid": "ad1678e9-8d47-4d92-86dd-0053c92cb704", "comment": "Malware payload", "value": "0a8e935e40f3e1db75ba2ecbdf4111c01ab8490716b2e18f3dd41b789585eb7c951036b4d9e9dfec1b7a2ae497b01acd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684129, "uuid": "82cb23be-70d5-41af-86cd-0c20105b4c6d", "value": "T1CB157D8AF6C751F3C8934EB0025BE73F4231AA268017CD96F78DDE15F823E96570A259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684129, "uuid": "dbe51ff9-a6fa-47e4-aae2-614c55840a39", "value": "12288:/UZssk3AvXrCOHdhA/vsBg4svy+8zC3ltGf2uWG+n2fFf+j9DIhs/:/ussgAvXzHdhW0Bg4Ru3DGfRXucf+R+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638684129, "uuid": "dcc5dd8b-fa21-4063-b966-ba345a8fac90", "value": 949066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638684129, "uuid": "5f6c0a60-9b0d-4968-b623-bcb6556b54aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638684129, "uuid": "1f2d58a6-77f6-47f8-9e2b-fc1d41ef72ce", "value": "be315459f7244dbfbf2e8c7a0aac63e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acb2f70-5560-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638663233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663233, "uuid": "ea2eae14-8ef3-4178-9d67-8552e5c88576", "comment": "Malware payload", "value": "e91913162a3b627cd00e340a68fba865", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663233, "uuid": "7a4c06b5-0e59-4e39-980a-e2f0a917b935", "comment": "Malware payload", "value": "e970d4d2f3e760a9c5ebfc192163c4b98031cab2929a5171868fcfb03cb1bd03", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663233, "uuid": "e8bca630-6b3d-4b45-9415-1784dedefc2c", "comment": "Malware payload", "value": "35d8ee4d0a48f475be99ad47ab276d6cc4239e72", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638663233, "uuid": "964e1ade-3de3-407e-9226-6c0afbbb8513", "comment": "Malware payload", "value": "afea4fac27a1eddeab2300db8cd9103dced25962dba01d53fb9ff0716cc7fbb150ca4d8281c73d49bae2e730e881973b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663233, "uuid": "c7fe57eb-aaf8-4660-ba5d-91eb21c44ac3", "value": "T138255B00E600E12BF9E310F685BB95F985786B30236559CB52C86EF9EB246D4BD31B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663233, "uuid": "30d4f929-583f-45d3-9c62-73c286d05381", "value": "24576:ygM4dPmrYDJTfzaf+4RY4GbOXwRDh/+cNeTI:ySTT7j4CvmcNeTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638663233, "uuid": "48e6cdb0-303e-41aa-a716-f00517a55b6d", "value": 1029477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638663233, "uuid": "7b9774a3-5787-4410-9ddb-4ca5be5ecbac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638663233, "uuid": "657b27a5-d97d-408c-bb29-e6161f35b9d9", "value": "emotet_exe_e4_e970d4d2f3e760a9c5ebfc192163c4b98031cab2929a5171868fcfb03cb1bd03_2021-12-05__001345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117cbb22-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708261, "uuid": "43bd456f-15c9-4804-803c-1a62c101f266", "comment": "Malware payload", "value": "4fe3e5caabb215f1eef379e901b5c423", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708261, "uuid": "4e7cf2d8-12e8-4cba-8e8c-89f483d5ab24", "comment": "Malware payload", "value": "ea734fe2f66bf8fde52ffee1b7ad271505a86c1ecabc98507510d229ccbb4acb", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708261, "uuid": "6db66472-ef57-40bd-adf0-c4692259cf26", "comment": "Malware payload", "value": "182e73ae43692a595aee736fb19fb1d6036a0637", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708261, "uuid": "264f8de6-061f-4e1c-b9cf-4d5637ffb5e6", "comment": "Malware payload", "value": "fac2ae7951ad2d4d9e9af6b88dd8f0db2774ab6016cc85e4fda716194e5c7fe41aeba16fd4c67799a259b48f83842386", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708261, "uuid": "34d849ca-1a3a-4409-8a13-a27522b587c7", "value": "T1D2C533106AD007C9E554CE2F2FDC9936047BEFCE7964EDD782E38AE1100FE95A962874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708261, "uuid": "a7e46f21-6f35-421c-8da4-14d9dc684d9b", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGS:G1wwAjzIQOMK2GNKslgus10S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708261, "uuid": "6b93097f-b6b1-49f4-9b74-f6dc733ae4e8", "value": 2539520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708261, "uuid": "546c959b-db17-4512-abb9-49fe21c60470", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708261, "uuid": "839bf099-7976-409d-9bfe-62b343321a5e", "value": "ea734fe2f66bf8fde52ffee1b7ad271505a86c1ecabc98507510d229ccbb4acb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96ae81a-5598-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638687604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687604, "uuid": "52675efc-88bd-4cbc-8773-5535a940bf07", "comment": "Malware payload (Mirai)", "value": "a55fb18f82f0bacc7f14cd19f0d80f3a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687604, "uuid": "54dafce1-1b48-478f-9990-4ae9b95a594d", "comment": "Malware payload (Mirai)", "value": "ebc60a969ea435aeea85e9e9184bd2932d2667267a4ee3ac7b32881f2816eef3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687604, "uuid": "3b4912fe-b905-49f7-9109-a7c98c6ad949", "comment": "Malware payload (Mirai)", "value": "98494bd6d01730891780122d750ee40b35937e29", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687604, "uuid": "9419e268-979e-461d-b185-3ff734511856", "comment": "Malware payload (Mirai)", "value": "0bcf5cc6777228c67036760aa37266fbb88f2292790ee19369524bf75e4901bd87841bd692848a25410649454360d72f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687604, "uuid": "4fa77a4a-94e2-4d1f-b46d-3565dafe0a3d", "value": "T1D9632A96BCC19B22C6E512BAFA5E419D331613E8E2EF72039C252F1177C782B0DA7751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687604, "uuid": "6003bd43-cd59-4e0d-82d3-3e7de8a8c6a8", "value": "1536:1vm8p4w4CpfQM97amdKpz+vs8lq1kSezDcp8Vg9BcOwTZ8vq:1vmEsP1gvcXcPIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638687604, "uuid": "0d08ec0b-173d-46d0-b152-1bb7c3005a31", "value": 72320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638687604, "uuid": "aca5e3ad-5e29-4a47-80fd-60dbd5553863", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687604, "uuid": "74dd2eb4-fe80-44ce-9642-cd361b6292e2", "value": "911.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce25f67-557e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Kutaki)", "timestamp": 1638676094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638676094, "uuid": "a4617a58-8c95-44d9-87e3-e8fc48e0b1c3", "comment": "Malware payload (Kutaki)", "value": "a11c8cf414a15f2eb0cefae6b3f31a8f", "object_relation": "md5", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638676094, "uuid": "b556a89b-0d0e-4b7e-b38f-afacf78d4f32", "comment": "Malware payload (Kutaki)", "value": "ec03481d3d9ea7124698ca24630f4495d086feaa8a0b0750ac7f5854eebceecc", "object_relation": "sha256", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638676094, "uuid": "35e0c302-2acb-4dd5-b010-dd23e88af72e", "comment": "Malware payload (Kutaki)", "value": "40b20212f099477d8e1502c2a373f63fb2165e8e", "object_relation": "sha1", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638676094, "uuid": "f5094e27-1b53-4b2b-9f32-b1fc362344df", "comment": "Malware payload (Kutaki)", "value": "7443fa7132753feddbd1690719bbf8685ad72083ead6957b1739176f420fef579f53a70cbbc3682fba8fe1737736b873", "object_relation": "sha3-384", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638676094, "uuid": "3f8e936b-c9aa-481d-a8ad-09995f72a504", "value": "T1D464236C1E8A5F4A6DD92CB89E23F162038947F71316B1985D8F72F7C055203F66BA0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638676094, "uuid": "e172fb01-3d32-45c8-8550-c192551a2640", "value": "6144:cpYxLpyJx1q4GrA9dmHF/VCS03hwXlMDksuvQMSmy+lqAHTonqXy9DYRf:264mA9dml/Gh+3IMSm84knnZYRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638676094, "uuid": "06bae08e-a77a-4a9f-9d74-d747fcf5541d", "value": 315459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638676094, "uuid": "44468238-d6cb-4dd7-9708-8c6a442a6b3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638676094, "uuid": "1f57f736-2b4e-4423-9a29-fb1f70bf94ed", "value": "a11c8cf414a15f2eb0cefae6b3f31a8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136de972-55c9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638708264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708264, "uuid": "d3b8a6e7-c4b5-419b-b561-2bd70b2856cc", "comment": "Malware payload", "value": "717ca5531ce260f46c4534f7c6d9b3bb", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708264, "uuid": "852f10aa-6c68-404d-9f7d-b7f590c3d335", "comment": "Malware payload", "value": "ed2a670e05f7065925d99a731bb380d2739436762d957f822edd1593bc7593e0", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708264, "uuid": "92d2bdc0-4e8c-4d4e-af66-3373327d00c2", "comment": "Malware payload", "value": "99c0454f9fb5785cfb0ae547e07176e7dff0cac9", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638708264, "uuid": "0132da83-8eb9-4705-8e48-f4f7f06594eb", "comment": "Malware payload", "value": "8971e5ed71fb45e3dc96ffbc018ab6166cb50d1e9bfdd115cce8e9b3b5f507b903c5d783e6e6bffa79b9c975d81737da", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708264, "uuid": "3b06ca8e-6d81-4f31-8892-842df991ff0c", "value": "T1AAD5331099D106C9E1A4CE2F1B9CA536147FEFC678A8EDE782D28BF1040FA859973974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708264, "uuid": "e96bbca8-7cdd-4ffe-afc6-8f9a038928ec", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqE9K:G1wwAjzIQOMK2GNKslgus10YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638708264, "uuid": "b06d33e5-a0b4-4efa-88ef-9af85b699ad4", "value": 2936832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638708264, "uuid": "86cab7e9-94b7-43fb-ad60-4120237d2d50", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638708264, "uuid": "197d0f76-f059-466b-a50c-2800cc52e4c1", "value": "ed2a670e05f7065925d99a731bb380d2739436762d957f822edd1593bc7593e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9491c87e-5597-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638687006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687006, "uuid": "f9c3e43d-39a6-468c-8f28-036297972103", "comment": "Malware payload (Mirai)", "value": "34cb544276ed342900a0f7a819f552d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687006, "uuid": "e4652281-2abb-45e0-8deb-662d6c5247ca", "comment": "Malware payload (Mirai)", "value": "ed8df581dfeee71f0022d017a33ccb22f5e13be637f6f56bf1473a21b0259003", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687006, "uuid": "f024340b-cf40-417f-b292-1b89506bda3c", "comment": "Malware payload (Mirai)", "value": "c52908d18db7e1e8f8ca55a59c7afebe06099924", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638687006, "uuid": "4463afca-447c-4694-9b57-9e69f6fdb97a", "comment": "Malware payload (Mirai)", "value": "c2b935ef906c3b35cb0aa0be219f326687a9396d2cbcca5afc09081dc539e7a3d3fbfca3ef6dc20f704b7c0e3c97edd5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687006, "uuid": "d89b887f-2446-4741-88e8-9aeab2e82dc5", "value": "T1B1D2D0506D8CDF96D6B08536EA2BCDCA27CB95B8C2DA79211FA18711A0C050F3A7A353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687006, "uuid": "34002c28-47df-4056-8916-bf893848333b", "value": "768:hLf24gxDB5o5Ww6Gmt5R7uD7osa1IQNR82s3Uoze:hLTgxDB4Ww7mt5tuwlIsR8bze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638687006, "uuid": "83b91454-a754-42f5-a68a-a2b646f326af", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638687006, "uuid": "e67027e5-0e1a-4ae2-9069-bdfde822f64b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638687006, "uuid": "d5cd9581-37d2-4f48-9ec7-4d73d9ff406f", "value": "Tsunami.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e128ba-55bf-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638704325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638704325, "uuid": "09b8bdb6-7384-4cb2-9b34-b8a7547bff63", "comment": "Malware payload (RedLineStealer)", "value": "828a045a9598b3a8f8b5095907cad573", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638704325, "uuid": "d81cb80f-b06c-4cfe-b1e7-1fbca5a7a096", "comment": "Malware payload (RedLineStealer)", "value": "ed9ec6594cdb7b034643ec06adcbf86c7124ac81805e0f48f655f389492ee9a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638704325, "uuid": "f714b81b-9c34-40a6-85df-4b766e1d93b7", "comment": "Malware payload (RedLineStealer)", "value": "fcaa44aa56b5a032f2032f68576cd8ebcfe2378e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638704325, "uuid": "95e1bb80-4383-48a1-a0cd-fc7b9cb54f4a", "comment": "Malware payload (RedLineStealer)", "value": "3988f3ccebb602404deb19cf92c8921e6e3baa30da81880f2cead1369ea21f79cff3e10b606f23f3ba94980dba2c4927", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638704325, "uuid": "1c75a6c5-21dd-46bc-a0a2-d5c2502ffcbd", "value": "T1C9E4012132C0C0B3D05625718625C7B59EBAB4365B6A7ACFBBD41F794F2C7C1963530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638704325, "uuid": "83c17aba-ddb7-4c2c-a902-d8dee85acb94", "value": "57414c9b174f8e0ff83324cb2c99bb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638704325, "uuid": "b5ab2266-cc41-49fb-9d66-56a2a4773d27", "value": "12288:4ZTMSG22mWgy7RbXmul1+JGadXvTMKguBiYL2Ysdd5S3TpnTOTZ81uCc:4BMSpjWgy1Xm2+kadXv3LiYWdd5WTYFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638704325, "uuid": "bd906f10-9207-44db-85a6-808f53a6544f", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638704325, "uuid": "211d2259-d1a2-4bfe-8fda-97397b94e4c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638704325, "uuid": "846132e5-5a7c-4ed2-9b6a-7de7fb6a55f7", "value": "828a045a9598b3a8f8b5095907cad573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c885ecc-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638693757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693757, "uuid": "e0f97949-15bd-4c4a-b149-e103d1bd5714", "comment": "Malware payload (Mirai)", "value": "71f8c9fb8fad78fffc38e92e626fd6d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693757, "uuid": "e74fe0ba-6176-4fa1-b76e-1b47a397c9d5", "comment": "Malware payload (Mirai)", "value": "edf2e75ea2b92ed2d026489a3af1487ec530a11a53402acaad05d9fdfaca4fc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693757, "uuid": "a0cabfb0-8956-4faf-b532-45a454f328b8", "comment": "Malware payload (Mirai)", "value": "b5a1a114eef07d20e48942f197a138bc4e4348e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693757, "uuid": "80f41619-1b49-41e3-b9dd-5df14fa552a1", "comment": "Malware payload (Mirai)", "value": "3b426f77fc59415bcc051389c97d5a088f09528660599f57338ae9f58d318b179ec6dfb9df1ee05f80302a07f24ae89a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693757, "uuid": "3356ae62-b750-40b0-8837-53b5ef69c0e3", "value": "T1C492D0A18F0215F2C1F029B1F3F5C981822A9B3CD59DB8622B1D49F458C4BF651BCA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693757, "uuid": "f8dabc40-7079-4679-9a76-156e935e96ab", "value": "384:1fbh/37FeG3Qtl5Iks/tKR0y4Kzt5VDFIimdGU5EEM:1zhP7sG3Qtl5zmRy4gt55+i3UNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693757, "uuid": "c7cd7134-2f89-4c4c-bec4-5748a9150b3d", "value": 20452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693757, "uuid": "750b7d96-1972-4815-adb3-9ab9ebad07b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693757, "uuid": "57f5aeee-b228-43c2-9ea5-36f23e0227ee", "value": "71f8c9fb8fad78fffc38e92e626fd6d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c11a6a1-55eb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638723042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723042, "uuid": "68ef34cf-c100-4e59-a072-8ab9719c238a", "comment": "Malware payload (Mirai)", "value": "31ce6348616385c98936ee1c4579f356", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723042, "uuid": "3087027f-8344-4e57-b8cd-e4940a7570b9", "comment": "Malware payload (Mirai)", "value": "ee7ce7c3ff12de6d2c9dc126b6600c24e505f5ffa829b3ea8effff4d94002fee", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723042, "uuid": "4c7d5f01-45f8-4660-82e2-260c016a71b7", "comment": "Malware payload (Mirai)", "value": "fbb7b903750737f88e0fc03c63e60b0e96049956", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723042, "uuid": "cc1493e2-af83-4565-a55d-a9edcf837776", "comment": "Malware payload (Mirai)", "value": "bafef10d271926f3687bdc4cd2ad5025c289316d471160a23d43e2b7a2b15dbd8649835be233a55565399aea4d17603b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723042, "uuid": "548748ed-0c0c-4d86-9627-566a1918afa0", "value": "T118632A47A98585ECC1C8F17803BF7636C496B4BC2379B5CA37D9BF2A3905EA01E5D809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723042, "uuid": "11f68f8e-3ca3-4781-b829-ad2a48db84bb", "value": "1536:4T0IBDQnk/IR0xqmdKr2UOLa1zofUyZb18uQKv:MF0nkwR0CrdOeif/ZbnQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638723042, "uuid": "881aa2c5-673e-4e9d-9b2b-8a52876402a5", "value": 66880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638723042, "uuid": "c0cde84e-ebc4-46c4-a686-32ab3862afeb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723042, "uuid": "b558ef0e-37d5-44fc-b331-0c18a2a5e2b8", "value": "31ce6348616385c98936ee1c4579f356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b1fb4b-55b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638701616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701616, "uuid": "7149a691-b8a8-4dfe-bd79-72bd0dd05102", "comment": "Malware payload (CryptBot)", "value": "571f12f948ea19e6ed5eec7f3b973344", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701616, "uuid": "c440bcce-04b5-4a94-b68e-b401fbdd74b6", "comment": "Malware payload (CryptBot)", "value": "efedecf2ac9040b4ba31a44a3c8ae15925e567d7304d8717bd40ece3b7d6a0cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701616, "uuid": "816e8b60-936e-4eb6-bb8e-f7898bf60188", "comment": "Malware payload (CryptBot)", "value": "3241f91728f2cae3f372ece53c71307329d93de5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638701616, "uuid": "879d3dc1-a65b-46bf-94c1-5b91e094bf94", "comment": "Malware payload (CryptBot)", "value": "93347b99b38cd62aa7de368a841b2398bf54ff5ee4a0699c2f479b7a0fb075d876192e97636d296e0d64800cc0be2665", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701616, "uuid": "1dff8e86-0fa6-4eca-bd9d-6de8d5360ce0", "value": "T16884CF1176D0C033C08260728825CBB55EBAB57157A66ACFBFE85FBD5F243D1A72630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701616, "uuid": "d17af35e-a3c9-4029-8df5-97d74ef2fd37", "value": "57414c9b174f8e0ff83324cb2c99bb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701616, "uuid": "a831ff66-3f38-4b40-ab9e-da75ad23c231", "value": "6144:nkb529A3WmGYNIni3lQ5Kuk3syvujZ2m+0l5AeYCYe8dSCCjUyMOv65:nkbk6WmGKKi3lQ5JykjZ2mHDVY5S3uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638701616, "uuid": "a35f78b5-5259-4702-a5d4-272cae5132ab", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638701616, "uuid": "2b87a08b-7af1-4e56-a702-0a23483182d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638701616, "uuid": "64963311-b8ee-487f-92fd-3e97d1bd0b1c", "value": "571f12f948ea19e6ed5eec7f3b973344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0d753a-55eb-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638723021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723021, "uuid": "2bbecba3-067d-4359-b9e9-970ec3bd4bfe", "comment": "Malware payload (Mirai)", "value": "c5be5316dd3c9947df511746aaa0fe49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723021, "uuid": "c82c6e50-a764-4a45-a952-39d0291de217", "comment": "Malware payload (Mirai)", "value": "f1579194e949bbe5bcb0d66a2158d35568e076304758865a06511ee40f66c289", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723021, "uuid": "414e080a-5ddb-456a-8492-7ca5e09349d1", "comment": "Malware payload (Mirai)", "value": "b4770255e5b6bee6bbe1c0cf273804e53d4e5194", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638723021, "uuid": "26a94d28-65f5-4bd2-9d2f-dc5feb49bcc2", "comment": "Malware payload (Mirai)", "value": "21ca86738261f1adbf6f9a3e8b1b52098c9cf9daf26cf5cd65ab879f0c519ff37db814030fbe4efcd676cd374e1af33e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723021, "uuid": "bda0ad4a-1916-475a-be31-342b660631c5", "value": "T1B1C32A97F800DE66F40AEA3605D70B35B630FB714E531A7263573AA69E362E07827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723021, "uuid": "4270dcd6-7c79-4381-b6d3-5e3099fa42be", "value": "3072:gQ4sgzt9BCw4MwTz/IOy+ApJ3gPKe+3mvI0PDGnSQNER:gQ4fhDCw4Mwfy+sJ3eI3mvI0PDGnSQNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638723021, "uuid": "e44779c6-385e-4b33-8c46-79866a89b535", "value": 118302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638723021, "uuid": "ed907762-940f-453b-851a-84102c0df15d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638723021, "uuid": "073d2416-c234-4cba-9838-2fe2ffd44d29", "value": "c5be5316dd3c9947df511746aaa0fe49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34d664a-55e7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638721444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721444, "uuid": "2213d1ff-0220-4f94-bddc-cd95af3e9479", "comment": "Malware payload (Mirai)", "value": "a4d5311a4a78dee4aab672d3c752ebc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721444, "uuid": "2f0d1aea-6734-4f81-a51f-0827e45f8503", "comment": "Malware payload (Mirai)", "value": "f26cfa47b75d6f9d8997563aeac47f8687cff4e165af3a59536605d440120aa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721444, "uuid": "882847cb-7fb0-4c52-be6c-eb59f2f36103", "comment": "Malware payload (Mirai)", "value": "11084b2511f6837a97a3d0c20e63170f61f2fa6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721444, "uuid": "b7387083-1e99-4c93-8e8e-9da74b1e800b", "comment": "Malware payload (Mirai)", "value": "2e2d1b06db592454cbeb204f3474fdbe8948616605bad4b12c1283404625b4acc08b0bd6c5e95dad94416a80b9f04900", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721444, "uuid": "76a75949-081b-45d7-b35b-a497ceb56195", "value": "T1CE6307757845F2ECD5E94078F4436EE52A2209283EDCC1E36087543BFF74B88662EE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721444, "uuid": "dc214859-363f-4826-a45e-1e82a51fdba5", "value": "1536:MAL3TfsCRclZfHpYzxUp8VBIVCCfy0K9DVA1:7Rclpp2UwuQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721444, "uuid": "1e75ca3c-2f8c-4b5a-9044-87bb9cccdf04", "value": 66944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721444, "uuid": "8501091f-a3dc-4ce8-bc76-948fcdff49a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721444, "uuid": "9064f1d2-067e-4339-b7cd-02e87c211579", "value": "a4d5311a4a78dee4aab672d3c752ebc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016eefad-55e9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638721978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721978, "uuid": "7d5089fc-74b6-495e-897a-1c65bcf1cf0c", "comment": "Malware payload (Mirai)", "value": "5aae244b7802a8fd116ad8d274156e9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721978, "uuid": "c7bc409a-4738-4660-b227-9c6e5b8bdd63", "comment": "Malware payload (Mirai)", "value": "f29dabf633891d14f8a885ceaa0d97954117872237be79060ab8d82114827179", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721978, "uuid": "5ff40a17-ffe4-4442-9478-217d6e8a6d1d", "comment": "Malware payload (Mirai)", "value": "05699e12e9d86012a63627dafc3cf82602b58e7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638721978, "uuid": "62d0728b-fa15-45f1-a3a0-997e34409e22", "comment": "Malware payload (Mirai)", "value": "4869a8d6ae822ecfbfd0a4689f3c43af4f99ab78b788c1dd0c2bf8758e1d740e910d9a9a1b5bce0f66756b501aa6e8c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721978, "uuid": "ebf04aab-696f-4497-8b3d-d2cc5dd614bc", "value": "T192532989B801AFBCF9DBDAFA41174A0DF821B25154930F27BA2BFE837C710A5D916C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721978, "uuid": "425df0de-fe77-49bb-afa5-3f0fb8ad956d", "value": "768:Gj/5EBxGuebqfC5vpsLTzYFgit6aAaaAOfIMulMW8ZxE6tYC550g8KYXo:GjOBxPu+AGtiwI+IlOWIE6tN5518do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638721978, "uuid": "5853b369-795b-4221-8db8-964a41009b6e", "value": 66044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638721978, "uuid": "2432c3b0-f1a1-40a8-abe9-877890c4a746", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638721978, "uuid": "9ddf7847-823e-45d7-9f6c-93e46172b284", "value": "5aae244b7802a8fd116ad8d274156e9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535a118e-55a7-11ec-96a4-42010a9c0029", "comment": "Malware payload (Adware.Generic)", "timestamp": 1638693768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693768, "uuid": "15050eb6-8e49-48e9-8f76-cb687d4bb401", "comment": "Malware payload (Adware.Generic)", "value": "26e711cc796169f606f84cd3b6510379", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693768, "uuid": "71bf5b9a-a413-40ac-9b50-87059251ce37", "comment": "Malware payload (Adware.Generic)", "value": "f350adb34681f8f113c892cda219400090166562ca9c92da59bd8ef39de180b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693768, "uuid": "3aefdc50-d275-4da7-ad01-bb1835f57d47", "comment": "Malware payload (Adware.Generic)", "value": "ee264d96c7a462a5752c0118f8459d1219189959", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638693768, "uuid": "aad306e9-be45-43be-888e-1922088afa34", "comment": "Malware payload (Adware.Generic)", "value": "361605dec312419de420b54a3b388a43bc3af65695d0d21bdb415229847f36c51942a4e771feebbef3ec1c92df2f692a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693768, "uuid": "c9f6ded0-0423-4f94-ac8e-d54629d6b3ae", "value": "T1B4262342BDC594B3D6710D314529BE61653DBE300F14CEDB93D8AE5EAE310D0A732BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693768, "uuid": "7a312c94-a064-4f02-a2c3-695d24b28966", "value": "47b0da2d13e0214f54c3bd05550e8319", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693768, "uuid": "06d31278-9226-4819-97a0-9d07c3f45d97", "value": "98304:MZexMEyNMJ4rvhl8ul67J+7KqGH6PLdr5/:W9ElSXQ7J+7RGaPLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638693768, "uuid": "0a15fb12-106a-47f0-a188-6226fb9653ba", "value": 4695040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638693768, "uuid": "08d5bfbc-103a-4da4-8bcc-09d00d3a6d2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638693768, "uuid": "0685e433-165d-4b14-94ed-79754b778c07", "value": "26e711cc796169f606f84cd3b6510379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550a1e7c-55a2-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1638691624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691624, "uuid": "7fb11be7-1ff6-4208-b1f4-3b700e527c1d", "comment": "Malware payload (AsyncRAT)", "value": "5e72c2002850d419df3689591463e6a1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691624, "uuid": "64294d5b-6f4a-4584-bb80-23f0f4902876", "comment": "Malware payload (AsyncRAT)", "value": "f5f4eeec5e522d81ab08d646519831b742245eac4514b81798de2c9d8857e39d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691624, "uuid": "e6f9d5f9-2d46-4a5f-b647-3951681ecacc", "comment": "Malware payload (AsyncRAT)", "value": "723f7a6e10541899308010f0c02248d80b78c9cd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638691624, "uuid": "ec8c95b2-9cfe-416a-b4ba-1274e08c331d", "comment": "Malware payload (AsyncRAT)", "value": "338f2b28e4b5805fe5e24bb016cc04fb9e3c4fde86f13cd96b34691d3279290b1be23b840820b7e86a67e87ec1d581c0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691624, "uuid": "af33e77f-688b-4505-b64c-2e00d0c19a3e", "value": "T1EB217B3EC28B44E30B44A1A122D09F6084B4B7A6C0EEAD9031B2CFDF65FD1EC09B810D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691624, "uuid": "3b02399f-11b9-43c7-9ee6-bf68ab02cbb5", "value": "24:lTTTTTTTTTjd1jgclThw1G2heiz9VZzgR/5ngBBSw1GbusaO:lTTTTTTTTTjd1jgcxhw1G2heiz9VZg5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638691624, "uuid": "9e677b13-6467-49a4-ae21-c04264cd4d3b", "value": 1325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638691624, "uuid": "d949b463-c5c5-4b3e-bdcb-93a54bcc0db4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638691624, "uuid": "12da87fc-2248-44ae-933a-9277ca640807", "value": "QQBGV828134.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0b298a-5626-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638748252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748252, "uuid": "2e071e3f-2b34-435a-a10f-9da7a0bba9e2", "comment": "Malware payload", "value": "92d7c318254f62b6656d267f9fc19eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748252, "uuid": "4fb76b64-0ce4-4773-b1e5-f85bb69b0a84", "comment": "Malware payload", "value": "f6e66176892baaf25ab56e5d0f77efc2936d101d0adc8243b97e1a5dec244b02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748252, "uuid": "27f97fff-b35a-4598-a185-713a944f3ce8", "comment": "Malware payload", "value": "6197b7faa362a221d0a2af30e05bb9a17a4c8248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748252, "uuid": "095acd76-2cf7-44b1-910e-881c00175e43", "comment": "Malware payload", "value": "ac11534f9ff77f6369aed9aa6464e131d07ec805ff82ba741079f8d7c13b92cfe160921e66264e9c1a3581294f3b32cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748252, "uuid": "31769872-0e1f-4117-bd05-20fe69f0329f", "value": "T1F455237731F518C9E946753CA860AAF905FB7933EA10E15D33C570027F3A3A2E4A4B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748252, "uuid": "b9611c29-8924-4467-8b96-141c7b2e1c19", "value": "74eb3656d050bbb0e1e1e4a8f5fa9d61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748252, "uuid": "001a1361-e61f-4536-97ef-492bd1f72e80", "value": "24576:kowQHLyQHLGQHLwiiiUd8VPbMYbiFb+j1QJlgcKBLGe6BtRGEPqmBtvx4:kowQHLyQHLGQHLVfUiHE+jW7aUj5qov6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748252, "uuid": "9e1b4083-c821-43ff-86c0-d50be35aaf57", "value": 1313872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748252, "uuid": "b14456ab-b1d1-4e37-b1f4-698769fc7e16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748252, "uuid": "8df9ed26-8214-4d9c-8842-d3a03c6eec2a", "value": "92d7c318254f62b6656d267f9fc19eb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a048ef-555e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638662632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638662632, "uuid": "ec7a6198-3139-48d3-a244-6a43f0158388", "comment": "Malware payload (Heodo)", "value": "974dea08786454a020639e80e186d5c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638662632, "uuid": "d1003ab4-ac10-45e4-ad13-b1fdb19fa38a", "comment": "Malware payload (Heodo)", "value": "f9bdfa9d776b4bc40b95c1c01d97ba78e857a1a066d6a5b51a32714bd78729d7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638662632, "uuid": "ce96b4a6-f462-4558-b87b-534ebdbcf4c7", "comment": "Malware payload (Heodo)", "value": "dcd1d9cc2c624bf7b401aab87c495d37c1b21ff1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638662632, "uuid": "0d5b43d0-3ba1-445e-84ad-9b05e7ac6bcc", "comment": "Malware payload (Heodo)", "value": "e4c463407806a09f72a6acef96d4bdadd2d21b4d30928458aa8713253bc383435c17938315171694ab17ed8a96b787cf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638662632, "uuid": "13ea9ee2-e2da-4b5a-b4aa-c2e425ed75ff", "value": "T180E47C00F351D035E4AF01B649BB869C55B9BE5097E856CB9EC87AEEAB710D03C3172B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638662632, "uuid": "75dc62ca-bed9-46d2-b28d-2b8c41817e61", "value": "12288:me+n9DJGtOal5V8yMcztuEpzZ4GbOXQ7bAobS3qTHPR101D:m5MtOK5VXNzZ4GbOXQXAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638662632, "uuid": "c0450f53-1541-474b-bc31-21dab71d4a31", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638662632, "uuid": "7f7b23a9-39f2-4521-91d2-a5bf5c61a115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638662632, "uuid": "1a79be0c-370f-4cc9-ae2f-7c6288d0ba47", "value": "emotet_exe_e5_f133117d9ac7ff195121c86214050404de93ee590eb26f54311a62f5c0a4a6cc_2021-12-05__000347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c729eeff-558e-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638683225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683225, "uuid": "f8067524-3818-40eb-a577-f9bf24cffef6", "comment": "Malware payload (RedLineStealer)", "value": "09316729304bcdafca0a47b23f7b82cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683225, "uuid": "cec53cb5-9ce9-4ad6-abdc-5336759fe69a", "comment": "Malware payload (RedLineStealer)", "value": "fb0e4f5bd6836542f5fa5074f5f80dd4ea7be8986b73559eeeca4f99bcf4a99e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683225, "uuid": "5d17ed20-ffdb-4da0-993d-4a72b6f9cef1", "comment": "Malware payload (RedLineStealer)", "value": "dfb3b157badede81ea7ba4de1e9319683ccff18d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638683225, "uuid": "07c19c76-92dd-4d04-baeb-b88dca87026c", "comment": "Malware payload (RedLineStealer)", "value": "f53a76069e9efc0220c7c7d40ed56951ed1ff8b9a82ad4c843c80d7e485cea13fbf96fad6f352063107032aaef1cbd17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683225, "uuid": "946e1972-1d13-4210-8f50-a5a57fc7124a", "value": "T1F354AD2133E0C032D58725768A15CBB58E7AB4316A266ACBBFD44EBD9F247C1973530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683225, "uuid": "8019b9b0-2f76-461a-bf8c-7b87d4d55c70", "value": "c5abd64536bf33cf9d17453c6dc09550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683225, "uuid": "3c10b394-adee-4b43-adb0-f49194777486", "value": "3072:LvTV8F8fejoNpVsYWJZYIDx9pJi8dKgMXUaFv1gRRACtbNYnqLqHfpQMpu5617:DxJf/VMsIVN67v1ktpm/+ML1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638683225, "uuid": "10cf0b4c-61ec-46d6-b142-7df84f7c2c7f", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638683225, "uuid": "a7adda95-9862-424f-ac2d-decbe3838d65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638683225, "uuid": "514e8aee-bc6f-43bf-8c38-b39584b45e04", "value": "09316729304bcdafca0a47b23f7b82cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a43bfde-55ea-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638722637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722637, "uuid": "3bfc1d30-6f4f-466c-862b-65a3b356d4be", "comment": "Malware payload (Gafgyt)", "value": "8bb9ebdd2895615bed869f5b3524e4c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722637, "uuid": "679f6a36-e9e1-4d3e-85ab-eab35bb95f68", "comment": "Malware payload (Gafgyt)", "value": "fb6070d198c11ca49197cf5917a889ea731cc0aa5c6e29af400f46831c22818c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722637, "uuid": "975ab78b-8c2e-47ab-bb17-e5289379a06c", "comment": "Malware payload (Gafgyt)", "value": "6efcbabd19b4b22e3440ec4ef69cae1bc16fb6f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638722637, "uuid": "22ca13c1-09ce-4771-88cb-6b71841e6187", "comment": "Malware payload (Gafgyt)", "value": "dd92d2a5b03aa44333a22e581aca4b7fbba5b6afb633fd6b7ce5f1c31ddc483147bddf422bf2fde2aaf7358b53ca2877", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722637, "uuid": "dd3da3e1-02cd-4db4-a81a-56a00e9d7486", "value": "T13DB3B717BB518FB7C81FCE3306AA8901108DA59612D97B6FB2B4D96CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722637, "uuid": "64738bb5-062a-49d3-a36b-0f62b94f3592", "value": "1536:ZLeT8AhSgCSkSHMwKJrZkhzw4dI6vwgck1U2zZUmkiSFxfC7xbXe:ZKkSHpKJr6fvw3UZUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638722637, "uuid": "de562bfc-9d37-444d-a4da-188518b32577", "value": 117386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638722637, "uuid": "b665c737-fa1d-4364-849b-89398f4214ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638722637, "uuid": "6a2c4730-e98a-49cc-b6ad-b6b5f989b327", "value": "8bb9ebdd2895615bed869f5b3524e4c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d779ad4-5627-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638748653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748653, "uuid": "144bb158-9261-4732-9261-b0ccfc905397", "comment": "Malware payload", "value": "a1babf0484d8b02a2488d7e5f7360cf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748653, "uuid": "abd2ab2c-8e78-4e6e-beb2-b055bc8d904d", "comment": "Malware payload", "value": "fde8fe5dce7787acbb104ae4d1496bdb7d18d21f6e66ce0fc59c055d20f68a61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748653, "uuid": "393c2802-9dd8-4ea8-a61b-72716eca1134", "comment": "Malware payload", "value": "1a1888655f4d514d430ecb4eb4e62f76108776fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638748653, "uuid": "3e682eb1-20a3-4b2f-b4fd-51a0c49cd95b", "comment": "Malware payload", "value": "3ff1c32247b1a1fe642931aa923d6d8a815187829118797c99b1f46477febb7d6a5c3bdd5666f5cea155333cb84a43a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748653, "uuid": "b635a34a-5f54-4dd2-b861-9ac64a0ef33f", "value": "T185255C29E6E29E06C266DA37811DCCB086D1E7D03252E396F6F712532E4F3B109963D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748653, "uuid": "27011171-aa08-4dfb-8943-73be64b3f337", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748653, "uuid": "faa98e54-79d4-40b9-921a-1677beaff5c0", "value": "12288:ffaO9CFlAAEPWaE41vxFnHEnHcc2dc3h+4jWDNxHItDr5HS81a6c8Uhs5l8ZquN:ftAzEHKn8cIc3h+4yHItDr5HpqG5e4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638748653, "uuid": "10d93913-5f58-4068-baab-57d9616c9500", "value": 1020120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638748653, "uuid": "557b9525-2efa-468b-bbb6-eebaf1dda8f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638748653, "uuid": "9d4d8bfb-8761-474c-b850-158d05f14895", "value": "a1babf0484d8b02a2488d7e5f7360cf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b069cd4e-561f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638745464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638745464, "uuid": "c3563dad-7683-4bdd-8151-a5a402ea5287", "comment": "Malware payload", "value": "34756465782ec294556a57aa2ddd2bf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638745464, "uuid": "17e1c283-4cd4-4365-ae51-9bc59f7f3001", "comment": "Malware payload", "value": "fe9b603aa67c0d7a86888ae88afa001f467e5566c7b05ce62263d392aaf92037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638745464, "uuid": "ae4a3cf7-c029-48a7-9454-632600c02c5e", "comment": "Malware payload", "value": "a3b1eba985e71937d61d5efcaa35b36579746a1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638745464, "uuid": "442a9785-4014-4e06-93d0-d6efc854d7ad", "comment": "Malware payload", "value": "7cc5ebff22e582fd0f70b0f33c6769cfb9f8885fba099c5159d79b554eefea641016bcb87ac097d806cc3e48e2a23751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638745464, "uuid": "cddcb398-73bb-4483-9b3f-809d0dde4685", "value": "T15765336D45C0B21CC0AA91B5EA3CAF5E184CBC5AA4F5F35E583C88F794140EBF4649BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638745464, "uuid": "1471e68f-446f-470e-a276-d4d660dc1fe1", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638745464, "uuid": "f1d94dd9-4720-4afb-baf2-a085f34a631e", "value": "24576:SWNtPL4Ywf1k6aluhc4GdnGC0m1Qx86TQfSkEaHNYK337oy3NVzLJh:pTjdoH2uhc4GnGCl1Qe6hNaRU6NVJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638745464, "uuid": "5e903814-35b0-44a5-8e73-26966e6c18cc", "value": 1469952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638745464, "uuid": "59e4228a-1a43-4ac0-8dd2-1654dff77fd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638745464, "uuid": "9bbc78d7-7082-4a8b-950f-8d591ab83f4a", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b646c41b-55ef-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638724858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724858, "uuid": "982637f9-dae2-48fc-bb93-4df5786d08c5", "comment": "Malware payload", "value": "48eafb567964dbc11d98f27bf4c799bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724858, "uuid": "f95cdf50-d98c-4cd8-8a75-e1977400c383", "comment": "Malware payload", "value": "ff9c2a9f30d1de620b3b32389ea8efd1f624113ec22ff7055a416539cac2afac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724858, "uuid": "b2be886f-195d-4702-8380-ae5aae5ea253", "comment": "Malware payload", "value": "b566e4ff48a9f8225468d12ef597dbd317e231e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638724858, "uuid": "a5ef1d77-fab5-4136-9a9d-770543652e0c", "comment": "Malware payload", "value": "330d490609166fc5f25d1de1bbce5823e4133b2a4a2fc6e991ca8140ed8544a38aa6a64c2936ecd17f30be6c46457d81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724858, "uuid": "79c63e3a-eaa2-41a6-8675-a2b52107d719", "value": "T17C642287A8C05FF3C9928270287AF5FCF33A91590055426F87956F7E3B638A309261F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724858, "uuid": "386bf0ab-ef97-456f-8bd3-fcad5d6eb578", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724858, "uuid": "dbf003da-0603-402d-96d0-741af99b1257", "value": "6144:rGiutp5AT1osF9MPMzEcGjvzXdk9D2rBTBT3JlfBSdNvtOCc93B64U+woh9WNC:qJATKs4Mzne9rBx3JlsHgBRDRA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638724858, "uuid": "72850f40-09b2-4d8b-9ec0-66eb63572db6", "value": 327839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638724858, "uuid": "c47d9ed5-7173-4b58-8cb1-7ae69e7c3852", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638724858, "uuid": "595671e1-8258-4d56-a553-20a22a942772", "value": "48eafb567964dbc11d98f27bf4c799bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }