{ "Event": { "published": true, "date": "2021-07-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-07-17", "timestamp": 1626566581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3bc993cc-dd27-4429-86e9-bfca6fa021d9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750e1d26-e695-11eb-875b-42010a9c0053", "comment": "Malware payload (Cryptbot)", "timestamp": 1626481515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626481515, "uuid": "0e6e6503-4739-4d7b-b39f-a428e56c9a9d", "comment": "Malware payload (Cryptbot)", "value": "29c88b0a1cee4b9b0decdaf213f4daa4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626481515, "uuid": "66761daf-f71f-4101-9e79-f043177a12d6", "comment": "Malware payload (Cryptbot)", "value": "057a4fa95610763f1aa6c88e6076c8492787a39dd23049fa2324c588c15f75cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626481515, "uuid": "866aecf2-3753-4e71-a451-0a64d17a5dba", "comment": "Malware payload (Cryptbot)", "value": "ba42ac8dcda21f6a43ac9e42a1c2f8ad5f1024a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626481515, "uuid": "02b57e9a-9daf-4431-8372-ec6019f46f5c", "comment": "Malware payload (Cryptbot)", "value": "82d24338cb694ecf1dbdeaf95ba884763e67e61a35e4d86d73f3324e39ffbc1c08f023eb99fd71c4a94191bc8e7fb6d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626481515, "uuid": "dce794cc-5a0c-47ee-8807-e7ae5d4bd0a2", "value": "T1F3E4122032F18773D1B34A70583491906677B8B37E38750A66673B1E2E313AD7A257B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626481515, "uuid": "8cb8707c-7b77-435e-bfef-2afa68a11201", "value": "e854b16b1e5e4f4b4d041111d063dc14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626481515, "uuid": "0b849053-aaf6-41a8-ace5-4dc75c7c55d2", "value": "12288:Q/VJ9quYDw5/hjUkrbNK8ot39hSqV2H8/r329SOPXZHZF0m:Q/VJ9quYD2/hjHrbcd3jzV2HOmsAXh7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626481515, "uuid": "d8329f76-0e96-4ea0-b9f6-e31b88b6e14d", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626481515, "uuid": "c4217d71-ede5-4ac4-becf-cdfa92c96bb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626481515, "uuid": "7bb445d6-a949-4276-834c-54bfc4d2a0e5", "value": "29c88b0a1cee4b9b0decdaf213f4daa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d41e16-e746-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626557559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626557559, "uuid": "f825f901-d791-4c12-8a20-33e147cd0411", "comment": "Malware payload", "value": "9a613a082cf1ffa458f0f12923dc9490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626557559, "uuid": "7dc0da99-5637-4bcc-ae9b-d9bc87807e94", "comment": "Malware payload", "value": "070ec3d1919bf35c817b1cb28ad379d2411a888160442d2e5e4c52f471611079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626557559, "uuid": "5ca716b2-30a0-40ec-9570-5cf4b3329740", "comment": "Malware payload", "value": "5a6a2b1fa3b04c49989633bc690aa3bf4aedff48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626557559, "uuid": "46438892-0979-48ad-a625-e6b091580c18", "comment": "Malware payload", "value": "3350e63df0e5cafea62ced5a661e53fed32af7f94221f47bd403744a47e6545de32444752d255e579f2cb19e682082f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626557559, "uuid": "c825d78d-3cb0-47ed-86c7-e4002d813b4c", "value": "T1BEB4F12179F0C433D1D60970587AC6A41A7ABD32A534758BB6D3BF1F2E322D0B5B6392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626557559, "uuid": "a3ffdf3d-efdb-4966-bce2-a5bbb1d3f840", "value": "4c2cb70eaa36e2f27e3da0ec1f2cb347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626557559, "uuid": "a21b5fe1-d4a0-4b37-8428-213a25fa012a", "value": "12288:iPEP0JDzXRsK0DlHBp4PCTKYs7NVSRNBJ:cXuK0DTpW8KzVSDBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626557559, "uuid": "2f6feeaf-bc80-4ab1-a0ac-1e7690768bfc", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626557559, "uuid": "e5021c97-813d-4faf-ac3b-e273bdeb8372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626557559, "uuid": "de305b30-7eba-40d6-a346-26f305a192cd", "value": "SecuriteInfo.com.W32.AIDetect.malware2.9540.5122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df9630a-e69b-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1626483919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626483919, "uuid": "56940e4d-f17c-4e72-b0d3-f2d9a52dd009", "comment": "Malware payload (DiamondFox)", "value": "90b1172f054ceae6fe035bac0b16464b", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626483919, "uuid": "bd0e0159-ab29-43c8-9468-c59f25ce148e", "comment": "Malware payload (DiamondFox)", "value": "09abe799d30cdceab1600a1421583b1d7a5d3a9b14fb89e7dfa8d4ca4e5c85ac", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626483919, "uuid": "545defeb-6529-457d-9e4b-6a38d783279a", "comment": "Malware payload (DiamondFox)", "value": "70b34bd1d15b86e68ec9ce4c31357da635358889", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626483919, "uuid": "e839991b-bb45-49b3-be34-f91639c39b5c", "comment": "Malware payload (DiamondFox)", "value": "1ec6d7c929afc01b5bca9488d43a444947b9e4dd9f49c94c09cc956ef732565c3bd0b402c8c9de2bad413aed58e3fce6", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626483919, "uuid": "b4784f77-3811-481e-a060-774676501827", "value": "T1E3F52300BDC094B1D1A11D3A42749628A97D7C306F148BDFE7E45A6E8B361C1EF35BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626483919, "uuid": "62f94d13-df30-4dad-8c39-06917c54cd23", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626483919, "uuid": "069d0b0c-9677-4145-9432-be636fb9c9e0", "value": "49152:UbA30BDzt1DcqD9PNl6yFtsKiaYcydNb3Wnt6jmjNL454v60NnP/xetQvWefp18+:UbdDpNv9SyFxim0Wt5L4iZ1XxHLv6ByL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626483919, "uuid": "98e93832-a21e-452f-b851-4ce8bfafb8cc", "value": 3331236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626483919, "uuid": "a8635def-eb69-4e4b-9a60-fc1c9204dcf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626483919, "uuid": "9fa7dfb4-9e70-41f0-9bf7-d82cad9a51e8", "value": "90B1172F054CEAE6FE035BAC0B16464B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e971677-e6cb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626504697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504697, "uuid": "e6ab7eb7-1bc5-4a33-893f-d9368fc4b666", "comment": "Malware payload", "value": "113314ce0d02c3dc504187177d0afb57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504697, "uuid": "19c941a7-60ca-4d53-ae50-4b8d7ba4478e", "comment": "Malware payload", "value": "09b7cc491328e8b5a3cde5a5369c783dc47656048816f063f68047775c1d867b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504697, "uuid": "f2adcc4c-2583-4dff-9320-bb3cc5d17aa4", "comment": "Malware payload", "value": "b41cad699e4ba6ed4b424f1c36fb522372a8bac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504697, "uuid": "a95a8826-2209-4bc6-877f-b2d897f51f6d", "comment": "Malware payload", "value": "fbc75232488e051ff2e794511a1b6a8b9719fee16452ea08fdfc0b386e68e8262c0e9d67d356e4e59801a647675cc085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504697, "uuid": "517ef9dd-6cc4-4aae-a780-829d2d5b925e", "value": "T1B5D48D27B6A1D836C1635E7C9D0BB76FED29FA102D18494A6BE41D4CDE3C6C2352A343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504697, "uuid": "ff911300-f0d6-4748-8689-5c33c0ea606d", "value": "12288:lKFL7IAmNLFEU8/TjQ6anRk7jZKqOeAB:lCLQNL2wS77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626504697, "uuid": "6c6ad726-305c-4976-b224-d2af729646d8", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626504697, "uuid": "7e34f742-7869-4f4a-8555-4687a67f9901", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504697, "uuid": "35e46963-40b5-4e6f-aba7-f97cd41a960e", "value": "PO OFF0027307 - DPR0009031,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e741e2b7-e749-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626559016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559016, "uuid": "406c3017-e018-4fb0-8d8b-c733a05bad9d", "comment": "Malware payload", "value": "2dc3e531360503c1a07f0b1bea179298", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559016, "uuid": "8101e681-fda5-41c2-8222-a3735fe48c62", "comment": "Malware payload", "value": "0a7e7f3998e61e8b477a83c06b8797d14eed2cc622bdd6b1e5ee20ba845a811a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559016, "uuid": "8ebacc6e-69dd-4a5d-9540-bdbe7025c88c", "comment": "Malware payload", "value": "67e846521769a8eed79a38f6f8dd649f321ad55f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559016, "uuid": "00477061-2c1c-4223-afc8-4f118078d985", "comment": "Malware payload", "value": "92874dd2baa3908ec47ef75196a2b8c77a5a632e61e562c9b3954c16ac1d527dfbf966620c42de90e268815981559682", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559016, "uuid": "a415b869-8611-4cf7-829e-ecfbbb5165f0", "value": "T189F33B05F4514367C2D327B9A64E968D3B325BF453CB33215A34AEB42FC2B9A1E39D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559016, "uuid": "7b93c519-2851-4d0b-b8c0-f1002da06e94", "value": "3072:dpEdpJEDaUYYVKChrtRWgLUoDpRTxzIZmxQOYlHXVe4:dp4YDaUYYPWfoD9sZmxQOYl3Ve4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626559016, "uuid": "52095860-c0b3-4102-9ec0-5b82824366f3", "value": 158306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626559016, "uuid": "2b4d221c-dc46-4529-ba66-f7290f5c2591", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559016, "uuid": "a773340d-87cf-4d23-954f-71e21bc1b31a", "value": "2dc3e531360503c1a07f0b1bea179298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab877ef-e735-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1626550110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550110, "uuid": "c8ff5bd6-209e-478c-bc3e-94f79bbb4fe2", "comment": "Malware payload (RemcosRAT)", "value": "bab85d677cb634a42a890266e000fd79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MorpheusVlog", "colour": "#9657ED", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550110, "uuid": "2d538aec-3666-47df-b050-8bcaeca5eae9", "comment": "Malware payload (RemcosRAT)", "value": "0c0a9b0df586ceb12e6b76f86473a2bf2db7cb9d8101dc90217959e9d12d48b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MorpheusVlog", "colour": "#9657ED", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550110, "uuid": "30f6ec2d-f4ce-481e-87ec-b5cacf0a2ea6", "comment": "Malware payload (RemcosRAT)", "value": "bcca157ab3520b1104411e86ea78f6a2efbb58ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MorpheusVlog", "colour": "#9657ED", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550110, "uuid": "b33427a4-60c9-42a1-81ac-865716033246", "comment": "Malware payload (RemcosRAT)", "value": "a35d2ebdea65ee908b65e2579cfa95ab3f6be4950c593d34220d85cb67e126014bfb0460eed3f22679b421e33b4da662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MorpheusVlog", "colour": "#9657ED", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550110, "uuid": "19520272-7edb-4bf9-9d13-38d75b584571", "value": "T14415126B335CE527D493423C2D268905627DBE4141E89797FBC93B0E12F93E0AD39DA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550110, "uuid": "33e0cf3c-5231-42ee-96a8-6c2097c7378a", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550110, "uuid": "4c2e542a-cd2e-4a81-9503-abc7096d9efa", "value": "6144:UPXfwQtRPN1aDriB76DeBVcFUarOSRdB+f9xXjiAJR0ZZbW9sUSEhVZsuXo7Lz/a:kFYDriB77/E6k+PXfP0bwzzY748WXniA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626550110, "uuid": "133a3fee-d92c-411e-81ca-f53bb55f1c59", "value": 887036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626550110, "uuid": "dad5c090-4d63-4852-abc8-b6e6d7930152", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550110, "uuid": "2893595e-5d11-4b5c-8665-f5b3803adedc", "value": "remcos", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a438735-e730-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626548015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548015, "uuid": "c628cd0e-1d24-4a4d-b078-d3a921bb4cf8", "comment": "Malware payload", "value": "c6597320431c3e82d1bfc796396c7953", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548015, "uuid": "17122e83-024b-424d-9a62-824466b7af1c", "comment": "Malware payload", "value": "0ffa64a965cea68bbc562a669e4389f7ffecdd2f4a9e1ed2f82d825938d4eac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548015, "uuid": "b841b171-f323-4d74-9488-da9e4260089a", "comment": "Malware payload", "value": "504e53cdd48c544352b335487c40504fd800b1d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548015, "uuid": "62cb28c4-d1bb-4e60-8487-f5b1b9b85deb", "comment": "Malware payload", "value": "260f2594d1df64bcfa46051b07a6622fa13e1c95f8483c30fc11483c799614729ea996008886c5a7c214e07863c7320c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548015, "uuid": "0695c552-57c4-401a-9101-fb2f2f2b9c55", "value": "T18913D68CB694E174D5FF8BF1B4A2B2890B70A01B9912D30F99F154D94FB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548015, "uuid": "8812b3fd-e662-40a0-967b-264086a7b190", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548015, "uuid": "ce49bbf2-5332-4e27-889e-97ba771ae4a0", "value": "384:eZyCd2MOGVK725yGt8izzLEf/EdSSszUIij+ZsNO3PlpJKkkjh/TzF7pWnd//gra:kBcCwG/zLuomuXQ/oE3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626548015, "uuid": "2136c996-4c38-4e50-a38b-40a97bb43648", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626548015, "uuid": "e19e823a-a4a3-45bb-a507-1af809c24e47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548015, "uuid": "55da8da3-b89f-43c1-a5d0-4d86ab5378c4", "value": "kFiedfc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0993b1-e6fe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626526620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626526620, "uuid": "c2655203-e78f-40ac-a3df-8af4697a2b5b", "comment": "Malware payload", "value": "7daa0221894d61fcac662545eaa09629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626526620, "uuid": "0c1d4acc-1f27-4819-9e4b-a98fc72ebd65", "comment": "Malware payload", "value": "117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626526620, "uuid": "aad286d2-e907-4bd3-ac1a-974aabf62380", "comment": "Malware payload", "value": "70bd1d9222b030c220ccc00c969afdeb32d61dba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626526620, "uuid": "8effc413-84a7-441f-ad08-bf400143145c", "comment": "Malware payload", "value": "3a71e09381573f1f18c3903140380ca2396cfeb03aa86e6ab79b627f00aa177dcc3ce1ef43d4e43e1af45d727ec1ee22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626526620, "uuid": "d0a7ed26-303f-4afe-a551-020dd3b4de64", "value": "T11A35225031B2D437E2AA097108B0C6A5503BFE43ADB2754F7A8B3E0F5A715C6B6E5363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626526620, "uuid": "97ed26dc-d0e8-4241-80d9-295f97cedd45", "value": "169d152bc3371452dbec26f63a5e0c58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626526620, "uuid": "3154e784-fa8b-499d-aa50-a2ee26cd97c5", "value": "24576:YXXSiy1vaKFhT+FCtZzomoagvnGhQvPT68B2MEBJ:wSiwaiyFYKmoTnG2PTtB293", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626526620, "uuid": "de8a6ab0-1fec-4223-8d22-929d1de9a534", "value": 1113088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626526620, "uuid": "19c0fc0e-696d-4222-af12-22530f0c9af3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626526620, "uuid": "a000d3d5-f313-4809-9700-921928eeeb43", "value": "SecuriteInfo.com.W32.AIDetect.malware2.809.3305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2707c402-e6f3-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1626521757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626521757, "uuid": "3d6ca0a6-9705-4538-8e95-ce0170b34a13", "comment": "Malware payload (ArkeiStealer)", "value": "abfc37485ad217c9d6f352c66dae53d2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626521757, "uuid": "2767f41d-f9b6-4787-b9fe-c4a3d14f0860", "comment": "Malware payload (ArkeiStealer)", "value": "1385c3d747eed12e6e8712a8e32820f6dce44531423d81e2e5763c16f7eb38ff", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626521757, "uuid": "71eac12b-8fbc-4c34-9b97-6d400fc9e3ae", "comment": "Malware payload (ArkeiStealer)", "value": "f57f5562cb33f0dfaaae43d05684b12309c93fda", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626521757, "uuid": "ba59d236-81f2-43ae-9bb9-c524cdb239c4", "comment": "Malware payload (ArkeiStealer)", "value": "20b0a30d006d5701830c4ff0e03e539e3ddc14f55625fa1ed7c14a5adb78e6bd9b51c5d7422d09d14716e17912b7046d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626521757, "uuid": "4cdda556-b0b0-40d9-973a-dbf27d8e2016", "value": "T1E9D53321BBEBC0B7D5034032A9442FB762F9C7890F3845D777A0D91D5736D6AC03AA9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626521757, "uuid": "c3911dea-e015-4249-865d-c4b4d9d6e9b4", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626521757, "uuid": "5b5ada44-a459-4722-a4c4-aef021fdb4a4", "value": "49152:xcByPkZVi7iKiF8cUvFyPj0TfrHMLSQDCku55YnGEwJ84vLRaBtIl9mTchEAkkmD:xQri7ixZUvFyPjgQLSQDCr55YVCvLUBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626521757, "uuid": "e8938aac-708e-4fb8-955e-ca420926fdf3", "value": 2831744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626521757, "uuid": "9a942319-ce17-4176-8944-57a6c1c73444", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626521757, "uuid": "c9c2b0a7-c416-4ba2-9cf8-40dc1da23c2e", "value": "abfc37485ad217c9d6f352c66dae53d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e902a159-e6de-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626513063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626513063, "uuid": "6b9005b0-bac5-4520-8841-624b7988ceb5", "comment": "Malware payload (DanaBot)", "value": "f808795c5f80f4739968d60243230548", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626513063, "uuid": "1ffdf8c7-2f6a-4edd-88f2-5cab5d5369e4", "comment": "Malware payload (DanaBot)", "value": "15f9857f558840c792ce0ea7778033570122aceba82dbaf65ee918ecb6cc1daf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626513063, "uuid": "c18c5bde-dfaf-4855-9486-d0599d500f78", "comment": "Malware payload (DanaBot)", "value": "66522cac807c740e60ba172a153774d72e8e3b22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626513063, "uuid": "72c22620-0d23-417f-a1c3-648ddfc6ab15", "comment": "Malware payload (DanaBot)", "value": "0881b3d5b6cb130756dbbd07d6c79ad0dfc2c56a59a45c89facb2f7a1dd26530526acdedd00449e330686455c1500487", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626513063, "uuid": "79f0bff0-b416-4735-8e6f-9956cd849eb4", "value": "T1AA35224165B4C53BD1FA1BB21A75C2A43E7BBC632864744B72077E1F2E331D1BA9234A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626513063, "uuid": "db1dc62d-8c08-40d9-832a-e1bc0056c1ea", "value": "169d152bc3371452dbec26f63a5e0c58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626513063, "uuid": "4854e144-33cc-4e30-b39c-098e7542fce2", "value": "24576:O0ndkB/YQm4HK3HXGxr9xtErR7WSrFVXtiD5TAJflRBJ:rn14qGp9xtEVWSrCRA53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626513063, "uuid": "aef76d8c-dafe-4738-9c62-8fb4d3966235", "value": 1113600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626513063, "uuid": "f79fe4f9-1afc-4d66-a72f-abf29b6c57b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626513063, "uuid": "245d5b0b-e43a-4994-8725-1137e0d0ba3c", "value": "f808795c5f80f4739968d60243230548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d67f92-e6cc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626505061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626505061, "uuid": "6b1a917e-b730-4de4-8cc2-d169295b7e82", "comment": "Malware payload (AgentTesla)", "value": "f2c11dc15dd41d48b94a58ffb54d5a8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "haggah", "colour": "#4A0645", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626505061, "uuid": "1fe2e3bc-1fa4-41a7-a912-3986d842e913", "comment": "Malware payload (AgentTesla)", "value": "166945b6e03a8cf3e2cc37e751344a5f57bd4cc47c70cbdd7fd396ca9eedbea6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "haggah", "colour": "#4A0645", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626505061, "uuid": "ab39417a-2b11-4d3c-a3e7-01d54a6ea9a0", "comment": "Malware payload (AgentTesla)", "value": "37638968184ed6a423efff572042bf7846e187be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "haggah", "colour": "#4A0645", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626505061, "uuid": "5f7e289e-0054-44cc-9743-259f0478a3c7", "comment": "Malware payload (AgentTesla)", "value": "dcc2beb50139b230acb5827c0b2c671e5f235b9fc998c7ac489d9eafcb1a755005dd7a2dc76238c8dd3e28a6ede52c19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "haggah", "colour": "#4A0645", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626505061, "uuid": "9c4c23a9-1159-47c7-9cb9-cb953ae8a6b1", "value": "T15362C00C4E3DF920D5B37874615952D05C969E4FA7BBABC9C702B028D9C1582A6CA9CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626505061, "uuid": "c342d85f-a9af-427a-b31e-07158584ab45", "value": "192:ZMAdhvVOcTwRRPQUI1lIDHsqBvmFoC3vBjCXQajrX1JjFjtfO684TCDhCGHRvta8:zhNOcT4RP/3uP/RCXQaHPjvPcHHRvta8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626505061, "uuid": "dbbe2ea8-dddf-44b9-925a-f115b16b414a", "value": 15735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626505061, "uuid": "06c8d154-c16e-4115-b0c8-91be7bffdfe8", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626505061, "uuid": "74e0121c-49b5-415a-be91-489948b6bfea", "value": "IdDetails.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d60a65-e6a9-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1626489923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626489923, "uuid": "eae1b778-25d7-464b-b9c4-e0b21c0566c2", "comment": "Malware payload (DiamondFox)", "value": "9b0aa8a5cb5f6b49918e8e8f54176e7f", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626489923, "uuid": "667ef44d-0ce0-4ff7-8ec2-34195e9bbeb4", "comment": "Malware payload (DiamondFox)", "value": "16ae5fec23f0db171bc882b07106c428fd7c51caf9c201a9f9b41dbe1dfd6118", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626489923, "uuid": "785837b2-180a-4b2d-8aba-7c725727646f", "comment": "Malware payload (DiamondFox)", "value": "ec63496dc851e5129841a712d7753fb8accfc46d", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626489923, "uuid": "fbd3c1ec-3f76-43ab-aeba-4a768f3ff98c", "comment": "Malware payload (DiamondFox)", "value": "d8d3531342e80b3dd1e2d2a01868e4f95b78e19b8e5de748f9de0c119eca61e8689d7f338f62d94afb0fa4547776ca51", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626489923, "uuid": "7455f5f2-3fed-4ff5-bc1d-147698efe3e6", "value": "T119D533123BD2D4FBDB12163C49842FB9B5FDC3CC13204CDB37949B095F6A4A6D42A9A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626489923, "uuid": "d2dc4276-c528-4066-9a0f-8105788fbb5b", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626489923, "uuid": "ddad4cca-a8bd-4668-ab70-931be6808fe5", "value": "49152:xcB2PkZVi7iKiF8cUvFyPSwCg9yp4GuMaMUaCG4pfwd25XQhGTEwJ84vLRaBtIlh:x0ri7ixZUvFyPfCpptv79C3poiCCvLUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626489923, "uuid": "36b6532e-cb91-400f-81f0-c57ee8eea742", "value": 2765394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626489923, "uuid": "d6b59c66-a64c-4870-8ede-fabf641fba3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626489923, "uuid": "a06de27b-7c79-459d-96af-1b64bccd1897", "value": "9B0AA8A5CB5F6B49918E8E8F54176E7F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb4f7bc-e6f9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626524637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626524637, "uuid": "aa18cae7-10be-4bfc-9246-e73146a8a9de", "comment": "Malware payload", "value": "d188a8526f296c7ce98afad1a4ecca80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626524637, "uuid": "412f2df7-7365-4ad8-9cb1-fcc17eb8811b", "comment": "Malware payload", "value": "1b71955325a527917fe44b6cff39cc26ae2abdafd8fcef8f22a0ba622321d66c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626524637, "uuid": "d2bc745f-df65-4ab9-b4cd-6303b23c5418", "comment": "Malware payload", "value": "04a9641680c9321af1c90cb41313cb9736801dd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626524637, "uuid": "63dc7fed-ee9f-4eaa-840e-f9fea958726f", "comment": "Malware payload", "value": "d703fbe7e0328f380f109fe966b9886a8ec7599e89dddcda4e2783528fc1785d468fa4b121c6b4670f50209b84341aa1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626524637, "uuid": "69f62448-d85a-496c-aedc-6c78e6f97937", "value": "T1D9E3F86703BCC026D16BD370E8765E0B766A9F241190F24DA0CBB1B58EFD29D8CB7256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626524637, "uuid": "1aa49f8a-62e1-4553-b9e3-039cace6f5cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626524637, "uuid": "68ebec48-2f33-4838-adb0-200ba29d6416", "value": "1536:wcNXkXC7t8xpExS0XvBJs+Xf7mIMrBVjmcYSUVvFJUj:wcKXCiovfv0rDjmZgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626524637, "uuid": "b76bd21f-1e42-4c58-a4fd-af1ac6a40a90", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626524637, "uuid": "53474fd2-8a25-4637-9f07-09a58fd0879a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626524637, "uuid": "b5bb580a-f75b-432c-99f6-f297a1951966", "value": "d188a8526f296c7ce98afad1a4ecca80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a51146-e6ab-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1626490956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626490956, "uuid": "a24601a3-ea60-4fb0-b6d2-6b1d90d59606", "comment": "Malware payload (LimeRAT)", "value": "43626a85bb97021a92641920e305bff8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626490956, "uuid": "a1f44d25-c784-4f96-a13b-9364b93c58b7", "comment": "Malware payload (LimeRAT)", "value": "1bcb972fb6df9882466a931025a47ec98d75bb23adef4ec14801be96967d56b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626490956, "uuid": "2e25460e-a5d6-4ba3-8e09-17e95424d36b", "comment": "Malware payload (LimeRAT)", "value": "4677f4a10346ad829d379a62056d6a08c6dfe2be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626490956, "uuid": "a81e8825-a7d3-4021-ae7b-078ed1ea83ac", "comment": "Malware payload (LimeRAT)", "value": "af7b5b98a2940bca7cbe42bc62335786908d6f1608db8c9c8ff8c0d1f07f87b39ce0ba908dcbfe3e18be7f8fafaebddc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626490956, "uuid": "84ab2631-ffa2-4574-b7d1-f9f3cf6acbda", "value": "T126D27E0477E08345D3DD5AF10BB161650FB1DA1BA93BFB6D0CC960931E5BEC18A84BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626490956, "uuid": "9a660132-02d2-4f73-8ba6-fbeb40a907b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626490956, "uuid": "555bc1a6-63dc-422c-9cfe-e930f3fd4ad9", "value": "768:KqpCu6vVwTI6BMqj945Nk8gP1GteSAhj:Kqp6VwTIqMiKg8gdZS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626490956, "uuid": "747fca27-26a4-4d8f-b4b9-d7a805342dff", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626490956, "uuid": "687adf01-2276-4cc4-a437-797c5681b4eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626490956, "uuid": "4bdbafc2-5901-4608-979b-b163c734b18d", "value": "43626a85bb97021a92641920e305bff8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fce3ae-e74a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626559249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559249, "uuid": "ffccc0e5-dde2-4f56-8a60-da3532b477bf", "comment": "Malware payload", "value": "7a4ea6252bc7182e1d64029affb37a45", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559249, "uuid": "82003edc-da7b-4576-b349-579d16ed97f1", "comment": "Malware payload", "value": "1ca3bdf6ea312e9cc0979089a2ee6b44c32809d4f8aab9801c7880f951bb4043", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559249, "uuid": "f1ddbfed-1bf6-4ec3-8519-ff65c07871f7", "comment": "Malware payload", "value": "c5a4d35e20d4176fcbd6c4053774176de8219d0e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559249, "uuid": "6c2e5228-43ba-4408-92e3-a4ee7761a7f6", "comment": "Malware payload", "value": "fa7c2b66cf4538dcf44d3c85042ece632f6b0657a12bf4688b61f909dd35b8f94ff83fbfc05578bdbe343b788bc76632", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559249, "uuid": "f5154e9c-a1db-44c1-86b1-83a647083420", "value": "T133342917B5E0CDF7C0C3467426DFA9A29823F4F90B66320B73A46DA42F0DD956A2DE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559249, "uuid": "c30a92fa-b568-4ad2-9244-da9599dc075f", "value": "6144:e60yTalgWo/zl8Z+zlwQKmPeLf/abLyyGC29dXJ:e1yTalW/KmPeLf/abLyyGC29dXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626559249, "uuid": "c459a346-0529-4883-9d5a-77f0e6190f42", "value": 234551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626559249, "uuid": "4db945da-1660-45b5-9751-a5c68790ef9d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559249, "uuid": "7eeaef71-fcb6-4a09-a69e-3e3fe8bfe07d", "value": "7a4ea6252bc7182e1d64029affb37a45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1671fe03-e74b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626559525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559525, "uuid": "b6522b8f-095d-4880-977a-50807da86fc8", "comment": "Malware payload", "value": "ffc6c9144b10be20a9b131938eaaf745", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559525, "uuid": "7c52ca2e-3f32-48fc-ac23-8b29b72288f7", "comment": "Malware payload", "value": "1e6009d27e59632a5bcf349cdad1bcb8ce9d3ebc79847959a0af3c5162a9b176", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559525, "uuid": "e246e596-ef90-44f2-8d89-7e82e78bde94", "comment": "Malware payload", "value": "b0e94cfa032138db775851107346c928678017aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559525, "uuid": "b7072605-c2e0-4a18-afe2-4fd48d74bd9f", "comment": "Malware payload", "value": "85d071c5a390c52faf4b517985b820b2f028e3f8652b0b476ae1ddb074427583a355c0f8104560aa2aa6d543b66994f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559525, "uuid": "f88536de-26e5-47d0-ac3e-67260bfb0d34", "value": "T18F54A41ABB618EB7D85FCE3301EA4902148DE58652D93F6BB6B4C65CEB0B90F04D3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559525, "uuid": "3114cb47-d70c-42aa-8a47-18f2bea0f7cb", "value": "3072:3ejP6lI1QChJYSSx/5rjQ6imj4SCdnxVmNDrLzBY7nvkoFh4ZS:3e6IheSS5rj4VmNDrLzBY7nvkoFh4ZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626559525, "uuid": "954c8302-832c-4d28-80c1-8ac3c472e339", "value": 291936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626559525, "uuid": "ea730976-6237-440e-bcc6-b523ff68e75e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559525, "uuid": "64f992cf-25cb-471b-898f-c9a8be6d3239", "value": "ffc6c9144b10be20a9b131938eaaf745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab2759c-e734-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1626550002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550002, "uuid": "73b87653-3128-4c79-a8ac-c964e9068b88", "comment": "Malware payload (Glupteba)", "value": "530a1feb891ef2eda24a9e4bb402bba0", "object_relation": "md5", "Tag": [ { "name": "backdoo", "colour": "#8335D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "MorpheusVlog", "colour": "#9657ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550002, "uuid": "10c71224-8a88-49be-8282-f536890d665c", "comment": "Malware payload (Glupteba)", "value": "1fa72a97bb347b6a7e962e19d9401b151a814898d0dc8f8009cc62c1e03f3503", "object_relation": "sha256", "Tag": [ { "name": "backdoo", "colour": "#8335D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "MorpheusVlog", "colour": "#9657ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550002, "uuid": "d2c419d3-7c54-4dda-a3d9-0449ca0f51be", "comment": "Malware payload (Glupteba)", "value": "c31c3fcc9af0cd3cb3b6e6b267960eaaf9eafd5b", "object_relation": "sha1", "Tag": [ { "name": "backdoo", "colour": "#8335D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "MorpheusVlog", "colour": "#9657ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550002, "uuid": "0c685057-62c6-4065-bad8-e8458f595276", "comment": "Malware payload (Glupteba)", "value": "7b5097f815ae55e5f57b65fd0f6882f62860a28acef628c805df4c3abed4e84279b8a8d175cf69e05ddf1b8db4c2a45a", "object_relation": "sha3-384", "Tag": [ { "name": "backdoo", "colour": "#8335D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "MorpheusVlog", "colour": "#9657ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550002, "uuid": "fc2b5166-71a6-4879-ac9a-24c8e86b6c85", "value": "T1952633617FB4D0B0D19396B00689E539EDD9B5308C2783463FCEA5F9DE24AD69A2430F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550002, "uuid": "c7415558-908e-4163-b59e-b3872c47f959", "value": "f847d6bb62efaafc938bc2759abeffb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550002, "uuid": "4bea9578-bff2-46fd-887b-b52faf40d169", "value": "98304:WVC/Na2FyHCWSe/eLWPgciKyT/Dcvi2dR1wYfu:b/NfFyS0e5hjD277wY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626550002, "uuid": "4d08b267-0a0d-4320-b95b-7d18f0681610", "value": 4613632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626550002, "uuid": "dd2fec0a-5aff-4212-8a31-cf87d383c493", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550002, "uuid": "d5fe9785-c70e-45fe-b8ec-13c9ce556603", "value": "glupteba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66f3e60-e6c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626502643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626502643, "uuid": "cec8b752-958b-4b70-b05a-0da1783dd271", "comment": "Malware payload", "value": "8daf9ba69c0dcf9224fd1e4006c9dad3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "Oscorp", "colour": "#F21584", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626502643, "uuid": "7fd94822-724a-4a97-87ed-f07054c834e9", "comment": "Malware payload", "value": "1fb81ff3d18f5c9d75f9c7117dec76ece31c2f80ea7cc3b5d932b8ce58516246", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "Oscorp", "colour": "#F21584", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626502643, "uuid": "efe61836-0e6c-4a3d-ae0b-cb3e890c4d88", "comment": "Malware payload", "value": "3b79553ad9b7310bff447eedd12b84bf1382d573", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "Oscorp", "colour": "#F21584", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626502643, "uuid": "ed984e5f-d7f3-47c7-a732-de6c43575ff0", "comment": "Malware payload", "value": "e9a15d62f4b127611ed7e1b09f9503a070032f4bc518a1d6ad65ae868ce2dd1c559fe1c0aec20bfb3e43e663d66ba2a3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "Oscorp", "colour": "#F21584", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626502643, "uuid": "4f9a1e75-07ba-415c-89af-49e44bd9c918", "value": "T136D6334ABBD47C2FCCB381364BB60BB919968C5B9716E7134165B12C8DBFAC00D96BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626502643, "uuid": "b8c4224f-dde9-4d87-8088-ae82cebd6d67", "value": "393216:DK0depil8+wMg8gjxCOJ/2zTWTV2Vrfns0JWoLK3ZMp5HKtfa:mJ4g8g1C8uzTQ2lslpiwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626502643, "uuid": "fb744d0c-082d-490d-99aa-9d10ce262de3", "value": 13798458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626502643, "uuid": "78fb8654-ac02-462d-9d9d-8911795c0349", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626502643, "uuid": "786ef0a6-219d-4bd9-be7d-f41a5993b6a3", "value": "Oscorp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ca81d0-e737-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626551178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626551178, "uuid": "92c31bdb-b582-445c-86b7-4136ba327b01", "comment": "Malware payload (Mirai)", "value": "df7ccd512ed6a321205a5465fabf734d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626551178, "uuid": "4fd61e86-6278-4b0f-8682-481394dedbe1", "comment": "Malware payload (Mirai)", "value": "2023aca67b44d4346efc313ac3175d21f3f460431936332f7516de05f2d86d0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626551178, "uuid": "3dfd2ec8-a06a-4063-9398-0692920febf4", "comment": "Malware payload (Mirai)", "value": "c2f9e652413f1875c56c0f583b89426abd177551", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626551178, "uuid": "85ffb0be-6acc-4552-ac38-5cc8516198c8", "comment": "Malware payload (Mirai)", "value": "add62d37c5ae26fe6e2f66df2999a013a9dc1ac14b1ed2ba71fa240afa069741143c794459b2f54a58aa8bdd64b2f724", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626551178, "uuid": "792fd494-3dd6-4875-bea1-949f7e50a590", "value": "T1CD733AC5B841AB12C7C25577FF5F028D371A5398E2EA33039D295FA4378B85A0E3B649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626551178, "uuid": "db81986c-7637-4779-b9c4-2180f34cc24a", "value": "1536:oFNKHCrGswBBDYBkyd/0nNUqULjO3+YvQI0uTvA:biPwpdnFUHYddA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626551178, "uuid": "7adc8c90-cf63-4bc3-8b5a-8e330a639790", "value": 76908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626551178, "uuid": "06e4a014-1d88-433a-9838-a8a20926be1d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626551178, "uuid": "18d946ed-e09d-40de-bc66-24c69efd776c", "value": "df7ccd512ed6a321205a5465fabf734d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6ce996-e6a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626487814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626487814, "uuid": "f9bfb9f2-226c-4812-9e1a-fc9aaee026a9", "comment": "Malware payload (Mirai)", "value": "9deabefb8d84f4d626e88f191b7f3161", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626487814, "uuid": "2b206275-d091-45d0-b217-42f6eda48c79", "comment": "Malware payload (Mirai)", "value": "204fce81d825fc0b15a57ef3b224beebd8a2cc76ee0520bf493eef4bbf5fdbae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626487814, "uuid": "d6abfc68-971a-4e59-ad46-d1456c441f87", "comment": "Malware payload (Mirai)", "value": "f2518e5948a34c3b79ac5826c00b96130729761f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626487814, "uuid": "5d88325d-b1f5-40fc-99c9-04983b0e302a", "comment": "Malware payload (Mirai)", "value": "4320b022bd0104e4919273dd49569225c4b4e614964b1a9e9a362400ff161a843ebf0655ad269c426dc4d0c50aba19ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626487814, "uuid": "90c533d6-5957-4818-8fea-b7b261a0ed9c", "value": "T1C95329C8A593F8F5DC140978307ABB66AEB3F13F7035E99BC3D86927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626487814, "uuid": "7b115f6e-9b06-4d33-9be5-54bb13d007d1", "value": "1536:IIG9170vwHbQXZ5+qXDEuX/9aBSW7V/DjObeFt6PuQ4ZG:I917iwHbQXZ5+qXAQ9eSWZ/XObeb6GZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626487814, "uuid": "d8f42a46-32ac-4128-ac5b-2e00669156b0", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626487814, "uuid": "e6da5fd4-0937-4f95-9ebd-8672032bacd7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626487814, "uuid": "1b32c9fb-4ccd-48a2-beea-037671f36584", "value": "9deabefb8d84f4d626e88f191b7f3161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7d30fb-e6a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626488879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488879, "uuid": "c8eac3c6-719a-4162-95c7-4a91e3536395", "comment": "Malware payload (Mirai)", "value": "2e8bb616999a3f73fd10f12c36e1932d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488879, "uuid": "e4acb75b-9f75-4d0b-a2e8-a6080bc6b8ce", "comment": "Malware payload (Mirai)", "value": "212fa23fbde8a5264be2ad6eadfbc266c68a59ad5f59dafb43f2b10e605cf2e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488879, "uuid": "b9f8ffeb-3006-4f43-b6c0-6192c2405cbd", "comment": "Malware payload (Mirai)", "value": "c68bc26dacbd5750d5eb3163730811dd407be315", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488879, "uuid": "bd042bc9-75c6-483e-8dd8-fc4a24e40b51", "comment": "Malware payload (Mirai)", "value": "e331b53db1503c30f56bb9432b56b0aeb1d8375263f2ed61d21a5cc02648da7909ca563a67adbe03ef7a1238d283b470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488879, "uuid": "b4243562-40d0-4a22-b00f-f15b1ab844e5", "value": "T1FD539DA5C4AC9D98C6264678F614C839AB23A00C62A33DF6DA57C656841FDFCF01C7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488879, "uuid": "772b8711-cce5-4a81-a54c-df6de317027f", "value": "1536:K/ue90IlCalyZyuhx+vACs2P/SO/Sfs3zO/QSwtPlCXPi:KGejAGyZyuhxaP/Sjf+iYdtPlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626488879, "uuid": "ce84b3d0-a24c-455b-982b-9e8269d4b642", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626488879, "uuid": "232ed2e3-d2d8-4cfc-a27f-d9981c17b05e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488879, "uuid": "3a784436-c8ad-436e-bf73-09b94ce5b870", "value": "2e8bb616999a3f73fd10f12c36e1932d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7773554c-e6ce-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626506000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626506000, "uuid": "d1bd4ece-b429-438b-b776-b374cf724b81", "comment": "Malware payload (SnakeKeylogger)", "value": "c0db0f5b98fa14347104876e411e4818", "object_relation": "md5", "Tag": [ { "name": "pw 7vLHRD4IdanbLrE", "colour": "#FECD56", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626506000, "uuid": "fb9d8268-d66f-4d29-83b4-070059af74c7", "comment": "Malware payload (SnakeKeylogger)", "value": "21c8974e5411d8e2de7a2a507405848010fac9ae49c70c3ad8632dcb3528949f", "object_relation": "sha256", "Tag": [ { "name": "pw 7vLHRD4IdanbLrE", "colour": "#FECD56", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626506000, "uuid": "0bdac4f8-403f-4482-b3b0-34b13bc30980", "comment": "Malware payload (SnakeKeylogger)", "value": "351864cb09dd29084ffa4b0bb16c59bb68e7a38d", "object_relation": "sha1", "Tag": [ { "name": "pw 7vLHRD4IdanbLrE", "colour": "#FECD56", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626506000, "uuid": "f9d2e496-4552-4a11-a9a9-5b419a145dfc", "comment": "Malware payload (SnakeKeylogger)", "value": "8f828c13ad9305496f40511d8a7f2f9c471a63d8b313970f6d1fa4777afa99a618a84f524ea2422f43abc60269cf83a6", "object_relation": "sha3-384", "Tag": [ { "name": "pw 7vLHRD4IdanbLrE", "colour": "#FECD56", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626506000, "uuid": "c12d2574-dc63-4b5b-9320-921aee0cbf90", "value": "T1C3A4230B65DA935D52B91C6166EB54092F716E50EC2FCF63A36A38FADC139C330E2346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626506000, "uuid": "da4a6223-d12e-4b0d-9d2d-675affb02d5b", "value": "12288:k05sUeMDOgJNIsuv2S6PufdceLUJ3l133ofjGDezRr69rTPJb:k05iMOPskf62SEUJ/HWGDWx69r9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626506000, "uuid": "ed746b7a-881b-4356-8f4b-cbe0ddfe40d5", "value": 489597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626506000, "uuid": "590adbe7-14bf-4e6f-b6c7-dd055a8c58c0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626506000, "uuid": "4ea6eabf-3908-47f5-928f-34f8b183dccd", "value": "Payment Details.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce639d5-e74b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626559535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559535, "uuid": "65aac544-6105-40ba-8a95-0f04f92a8ee0", "comment": "Malware payload", "value": "19836cb13ae0f175af408ca6e8c5e503", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559535, "uuid": "17022467-7aee-40a8-a3f6-323a318f7c04", "comment": "Malware payload", "value": "2354fc60493f79878e4af96b5a0ca998e9667a0bf71a6b1f0dae199251f41960", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559535, "uuid": "e96e5956-6796-4a4b-bf4f-a1194fe1a40e", "comment": "Malware payload", "value": "f2e663d07746427ca123df42155aabd96b744c0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559535, "uuid": "2e0cbe71-8f10-42c0-831b-0f0f302bddad", "comment": "Malware payload", "value": "a1d4966c63c19a5ab91f9e3124c1dcd8195ea4dd8fa7bd2be7cb8ec11d29367d72a2251a7072bedcd4fac11db3ef738e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559535, "uuid": "4fa64a54-735b-4592-a4d7-7fe5d0cf6fd9", "value": "T1A0242A03B61C0743C0971EB02EBB3BF18BABA6F116D76141F51AEA905273BB12519FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559535, "uuid": "e77d47f6-1dab-4b11-a3e6-f58256b23937", "value": "6144:oHjHfHE+ExGboAFdTYTqwHXImjam2gq+V/LOlrIs/9abJ:ecCtlYewHXVam2gq+V/LOlrIs/9abJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626559535, "uuid": "b108a6da-2bca-499d-91be-6778a4b1c9aa", "value": 218327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626559535, "uuid": "b49305a3-711c-467c-b9a7-177e377df854", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559535, "uuid": "9604a54a-91e1-44e2-b4eb-4ba3fe5faaf9", "value": "19836cb13ae0f175af408ca6e8c5e503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a97ea6-e74a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626559255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559255, "uuid": "89159350-3b53-4962-918b-5e6abf198993", "comment": "Malware payload", "value": "8cf6dd9fed984b0929d4ab30e4815b10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559255, "uuid": "fdd0f018-6f19-436e-9305-e9856591e4df", "comment": "Malware payload", "value": "238da050b30e0be29b79183285c7fe763df2e15d5280c1d6f5509c0e980dce52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559255, "uuid": "6f53b221-e153-46d2-ba9b-7a172c70434d", "comment": "Malware payload", "value": "54c404da00b70545e2642b718a4ce676497a2606", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559255, "uuid": "0c6cd741-0c56-4411-a5a7-0b48e6a8f4a4", "comment": "Malware payload", "value": "1a02bab214164326119fca8e8edc44d097ea45610c3c78ef9f4fce427b4a4052e92f89bce440c1b8c2b576d29eb1bbe0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559255, "uuid": "56dc6d8f-d6be-4472-8f7d-f23f1a89f7d5", "value": "T1D7241953F904CFA3F40AB63204D74B31B631BBE116536523B267797A9E362C5282BF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559255, "uuid": "8cc596b0-7fdf-4465-b4c7-fc26391db6fd", "value": "6144:+Iroh45lCIZvtXGILY0zrgXuyLRYpizgyJSvOeLmxgL+V/LOI/Is/9aXJ:+Yoh454IZvtXnrtvOAmxgL+V/LOI/Isy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626559255, "uuid": "aa478116-0b9a-4c2d-a31c-e29e269409fa", "value": 228498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626559255, "uuid": "15dc9362-e006-4145-9ec0-2a1f7890b8bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559255, "uuid": "2df9a7bb-6644-49be-ac4d-90bf2184c4d7", "value": "8cf6dd9fed984b0929d4ab30e4815b10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19859014-e6ce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626505843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626505843, "uuid": "bdd26aee-6cea-4394-b2d7-808d7cc638bb", "comment": "Malware payload", "value": "08684a98326e5e871ee7832859ff16da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626505843, "uuid": "48a7247c-d58c-4333-8e4f-319471825bcf", "comment": "Malware payload", "value": "24a163dbbbd12e458bcbcfa3e9707da5c7364369060344f062ef46dbf208169d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626505843, "uuid": "0c4c3b9e-47fc-430b-967a-9dd77622b1b8", "comment": "Malware payload", "value": "d43d471b3ba5a29edb0910ac5b8db6ce079fece2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626505843, "uuid": "e1ee741d-3022-463d-b70d-b05a49636d49", "comment": "Malware payload", "value": "da0f587b2492fdfb0d42cf1db1c0afa5edd023b6b79082ff289d48c6c30960789e0631377bcaa1c7a524a091dae04dee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626505843, "uuid": "09a3fdb8-2bac-4ce1-93a7-4f85918d1afc", "value": "T1C7F53346F2EE3AEAD1E310771D74713A62750EB58782DDB3C3097491C2396C6C13A6BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626505843, "uuid": "83da3f7e-6c15-4cf5-a9f9-9e9c9ca2fcff", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626505843, "uuid": "d5f1626c-90c4-4edb-a9ef-109c0db8efca", "value": "98304:cT2p3Q2zMofa6e2BLTQscZJziK0OFEt4:cT03Q8S0TQrZRiK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626505843, "uuid": "26d585db-e656-431a-bec7-5f75e48f2ad6", "value": 3460144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626505843, "uuid": "fcfaf7ba-16a9-4681-a002-e127e2f50022", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626505843, "uuid": "b3f0d002-7617-4583-9f77-286f0787b2fb", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942000b2-e73e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626554152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626554152, "uuid": "b25b459d-5512-4517-b83e-31d598e0d865", "comment": "Malware payload", "value": "8118a6fe28cb8a52a4afed525884d837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626554152, "uuid": "5ff77072-0beb-40d0-9693-4c9e53a31453", "comment": "Malware payload", "value": "2596ad5fce328fb8b5211941a28d8a7b9f3723dead923b7dfcde21154356f141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626554152, "uuid": "73f2ab95-7d3f-4b22-8bda-aa9d53cdcd91", "comment": "Malware payload", "value": "d243f7de246d71abfdb5aaa529a0f540ab8306d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626554152, "uuid": "31ca2c55-8f15-49d8-a8c6-a7de373b3884", "comment": "Malware payload", "value": "bc42c4221d127cbf13cea62b689974e607d167969aeadf0c0e2bb2c715e3be65a6ef6787106ba10bfa87e912bfd3f4a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626554152, "uuid": "2f9bb8a4-1376-48d7-863c-aa4ac74ed58f", "value": "T12AE38DFCA08505A8DA9A0BFC9E78BDECB4BC18537F10A51D993A72E11F7277DD460502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626554152, "uuid": "a296c100-5d42-4e82-814f-630c57f48563", "value": "1536:286OZbT+Ko+QKOefjk8G7iVOJtNkLtLrxsx/aq8ZkqBvVl/+aPV4isiqi2Kbsu+s:286y/QMOfzJ0usoKVRjf4zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626554152, "uuid": "e9fe9346-8262-4422-899c-1c8c3fe7ca2e", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626554152, "uuid": "c03b6fa3-3ad5-445e-b646-c5dcb2858ad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626554152, "uuid": "ccc6991b-18ea-47cb-8a03-8aeb0281aedc", "value": "d243f7de246d71abfdb5aaa529a0f540ab8306d1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b09a468-e703-11eb-875b-42010a9c0053", "comment": "Malware payload (Cryptbot)", "timestamp": 1626528635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626528635, "uuid": "a58460fb-1935-42f0-8265-10989b3ea7e4", "comment": "Malware payload (Cryptbot)", "value": "be8f8a6a796c925907d4047a808e7f5e", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626528635, "uuid": "bdf98a4f-3805-4ec0-93a9-8efb9ecd6f24", "comment": "Malware payload (Cryptbot)", "value": "292a5973504850b613bc2bf171ca13af404030c276b87b335d1f3877ae1d6533", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626528635, "uuid": "871e7bcd-867f-44dc-a6a3-bd0e83f1d8da", "comment": "Malware payload (Cryptbot)", "value": "857f7f2d7833597658dd00c4c31b3dd61393ecd8", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626528635, "uuid": "bf37d234-9439-4de2-9fb3-79b43b32e1da", "comment": "Malware payload (Cryptbot)", "value": "82fcf340e1c124e4c8d941b97a6307e9c1253a0ab7636a03b7c456c26642db927ac68d3eacb2a5b611dbe6700212cf9a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626528635, "uuid": "ad86c63a-e4a0-4889-a4c8-0631b9620861", "value": "T1415523567F82C43AFBD1087198B10BF0693BFE242EE8E716B709B9DD66704129438B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626528635, "uuid": "216d092f-b2f2-49ef-9eaa-8e6606e9ad65", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626528635, "uuid": "abab25d0-0a53-478d-b4dd-070d02628e2f", "value": "24576:PNxTwUibv1ZdVOcw4T2Upx4j6Y3bGF88R3sB56zlX4rgEBpXuwM:cbv1ZabY2UKaer6aEEBpPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626528635, "uuid": "670ac2e7-4cd8-4173-9536-d82ab92a68b4", "value": 1328685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626528635, "uuid": "1523833b-7f8d-4310-b416-bba6b60b1a67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626528635, "uuid": "d83e16e5-cdd4-4696-ad35-c1fac3d81351", "value": "be8f8a6a796c925907d4047a808e7f5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8133cb3-e71b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626539287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539287, "uuid": "9964ebd6-a76a-4d28-bfa0-ccf8d9d09923", "comment": "Malware payload (Mirai)", "value": "d00a9c5a64ac387eeaaa446b9db7da34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539287, "uuid": "6046d174-df62-4c4e-8540-d3881909491e", "comment": "Malware payload (Mirai)", "value": "2ce7609a414fb9abb1176dbccc39a0d7e5d8d7c916e6252557e3414554addd72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539287, "uuid": "265fc675-c11a-44c9-8aa1-8d042c19a807", "comment": "Malware payload (Mirai)", "value": "2dd6370b7b798ca4d3073d597c98a8b3a9bf0720", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539287, "uuid": "f17afcd5-3661-408e-8b2e-b6b25c3be94b", "comment": "Malware payload (Mirai)", "value": "4a825d1a052c79d5da0d04dd63c04df919dee5fa7c802bed66a5a4e655447ece78668d1175ad6914c1ddc98bbafac841", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539287, "uuid": "aeb6181f-17cd-482f-b586-2d41b4658181", "value": "T1D293C80E7E219F7DFBA8823547B78E219A5833D627E0C181D15CEA415EB024D785FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539287, "uuid": "8ecda41e-b27a-43f0-989c-ee3f1cd96ba7", "value": "1536:fA9ReHaigvqCzJkE4thwWY1LfQa66KWJkM+J2Nsx5Ig:I9wHrkzJQwWY1LfQ96RkM+J26xT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626539287, "uuid": "892abce5-bd03-4f8a-a748-706af6e6636e", "value": 93392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626539287, "uuid": "aa38e32f-dd93-49c7-8b01-06668431b870", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539287, "uuid": "66bbbebc-96c7-4430-9f43-b5fde1185f12", "value": "d00a9c5a64ac387eeaaa446b9db7da34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d8a651-e73f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626554606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626554606, "uuid": "18a075ae-5399-4d8b-adce-4b65a4bf8c75", "comment": "Malware payload", "value": "95f5f9111344c4c472b9d6656337abe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626554606, "uuid": "b816b505-57f6-489f-b2bf-22cda4719974", "comment": "Malware payload", "value": "2d0341608080764426d54990b8ed84fe425a93447b1d9ea4e2044c4f8041f655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626554606, "uuid": "cda70f3c-6bf4-4bd0-b6cf-8d2dc1c02b80", "comment": "Malware payload", "value": "1f832f0542938b8aaf134dd59f2f96b919b577ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626554606, "uuid": "46dce75d-5b53-4cbd-8eb9-7f83f495ab25", "comment": "Malware payload", "value": "3e025edbece4e6ab929711e19f5ab526ee6b59d4574aace96d07a3c798f2541e3aaff05a841cc10842b89168b998b31a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626554606, "uuid": "7a6599e4-18fa-41ac-9325-45b41da4104d", "value": "T19DA427A061650B23E67A97F3C520A300FFF066977215EE094EC3E1C71E26B425A9DE5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626554606, "uuid": "d69a8723-6dcd-4699-82ef-8a6c150d1b69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626554606, "uuid": "c96c25d4-bbb6-49cf-88f5-4f2d1a930f6c", "value": "6144:absvxq0wV/OhmHexAw4lflCtRmMeACsrNK5bT5khGoknz0BxnaaQ:absvQOhz3kUxfNKVkhGVnzGwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626554606, "uuid": "4854a1a4-ce02-48d9-8c1a-86e1934b69b0", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626554606, "uuid": "8d40b4a7-b03c-41a2-9458-165731ca1b0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626554606, "uuid": "2414227e-a51a-43c3-97da-2a4f483a0880", "value": "Documentos de entrega de DHL.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dda167f-e736-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626550705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550705, "uuid": "c4df5c2e-d98d-4801-af7c-082ea1faf0f8", "comment": "Malware payload", "value": "9c3d3679ea84ff9bf67bf8c7aa2afc48", "object_relation": "md5", "Tag": [ { "name": "Astro Grep", "colour": "#41DCB8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550705, "uuid": "5fbfa6e7-2d61-4da0-a959-1d6d17596679", "comment": "Malware payload", "value": "2f5639932c7a25cf51737748cdc495367a9203e0a963f930f0009935109da190", "object_relation": "sha256", "Tag": [ { "name": "Astro Grep", "colour": "#41DCB8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550705, "uuid": "14970650-c343-4cc3-ab11-777eb132bcd4", "comment": "Malware payload", "value": "0470d616e8918ef03098741bf7fb0b313bb8aaea", "object_relation": "sha1", "Tag": [ { "name": "Astro Grep", "colour": "#41DCB8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550705, "uuid": "cebff61c-f5e9-41d3-a191-cdb495d227ad", "comment": "Malware payload", "value": "b4619cafdfbf6982ee4b61d0882d2afbef866a028910a063c08999830cc414fa03071c533a118676abdc5acaa4f621bb", "object_relation": "sha3-384", "Tag": [ { "name": "Astro Grep", "colour": "#41DCB8", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550705, "uuid": "ffaa62fa-9cd2-4c7e-a6cc-d7bec9fef4e6", "value": "T1B2653390ED26FBB2EA4382F143CEB3DCC5A47DB6A3A21C0B303A06451558CB877D95B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550705, "uuid": "ef5249a6-8ab5-4113-9bbf-cdd5241382f7", "value": "24576:gbi5q1lXj0di8tpgg/d3EVxW5Y62ddfMqKFIqlzFOQ1Yq8X2LcDLN:gbi5q1lXPupgU8Wy62dJVhqUYYq8X2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626550705, "uuid": "05f2f5bc-fac8-45f1-b4f2-4c2068b91863", "value": 1446736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626550705, "uuid": "1867da62-6194-4fcc-a51a-7581a5aed92d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550705, "uuid": "a5b55722-5515-4a18-8e29-2ff9edea94c5", "value": "astro-grep-setup.exe.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d37d93-e6a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626487821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626487821, "uuid": "a3f7d8cb-f060-4163-a456-66065d0d3839", "comment": "Malware payload (Mirai)", "value": "b89465ac3c41d985024a54660d7977da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626487821, "uuid": "dd7829a7-627b-4bd0-b224-33dd9bd5b528", "comment": "Malware payload (Mirai)", "value": "30009785c672163f95aa10b5f90d3b5945d081bf11012092d2b9a978a6540a4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626487821, "uuid": "f849eb0b-8941-4e9d-ac66-06c77e1a17e2", "comment": "Malware payload (Mirai)", "value": "9c66885bd50edf1125908a666cd7687d5e2633d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626487821, "uuid": "c5832a85-1231-4d6a-8a20-2dcbba687ddd", "comment": "Malware payload (Mirai)", "value": "10431b445c85d48f6d96e4dd30c047e226f448a5bd755a1c80bc346c2b41385d71622db1a6d69e6480081d920afa1baa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626487821, "uuid": "63fd643c-8574-4393-91af-bee4e38b11c2", "value": "T15D534B0277684F07FAE61AF4243F1BE483BEED8025E4B589690FC7424635E334999E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626487821, "uuid": "e42d7c71-18c1-46d2-bdbf-1af0ffd59a60", "value": "768:Sr5Eg6nb5usRVQq8WTUqYhcBJcIGsllk5M9Z0v6GG4TlW2c5sjgi+DDiZ/vVBbsN:2KbpuqJlzk5qGpJgbDOZ/vVuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626487821, "uuid": "11241f3a-2944-4c3f-9105-348586a345e1", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626487821, "uuid": "2cd53e59-8c7e-4a38-bbc9-1179ba76bb15", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626487821, "uuid": "4c42dc47-1353-4b76-b5da-c00bf3224615", "value": "b89465ac3c41d985024a54660d7977da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8376e210-e746-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626557560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626557560, "uuid": "6687eec3-3775-4bcf-803e-13d1628c66f6", "comment": "Malware payload", "value": "70b40df7ac5f433762524a37d99a5c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626557560, "uuid": "e18939ce-e79a-426f-9102-7ec02fdbc96f", "comment": "Malware payload", "value": "31422b061307e009869a40d0a36aeb3a19e20a45d80ef1ce245ad0bd7267af14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626557560, "uuid": "96f960cd-1d8f-42dc-8fb1-73f1587993cb", "comment": "Malware payload", "value": "48f4e235fe4d744af613212da1fee46c3009f3f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626557560, "uuid": "3bf9e213-775d-4d3f-b94d-80ae88e05949", "comment": "Malware payload", "value": "c5907be34f45d65a14c2ff232c6da480aa79efda7b65b6c98574d97d4ad21ff326a050543824d64bf497e9972c6cf473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626557560, "uuid": "3e3e253d-d17f-48a8-9050-4e4b1a0e9a1a", "value": "T18D249C2172B0D437D6E20AB05475C6A12A36FC322A74B54FB6A73F1E1E333E1B566352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626557560, "uuid": "1fc4a955-db6b-4711-a60b-409747853ef9", "value": "4c2cb70eaa36e2f27e3da0ec1f2cb347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626557560, "uuid": "66b5347a-8cec-46c5-923b-7e253811e078", "value": "3072:TfaJKaMhbN+zsRQy2hTTsJ67jK9Xa7bFNTqn8huC+/pJaDHUZ:baJKa0+AWyMToYK9gKdBJam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626557560, "uuid": "6a16d9d4-82f9-4922-b07d-f8238f106a7f", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626557560, "uuid": "5f5c3c15-49d6-4d01-980c-b94728c24623", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626557560, "uuid": "4de501f5-dcfc-4525-89b5-fd0a40671964", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.1008.15970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715d3dd4-e717-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626537343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626537343, "uuid": "67c52682-8052-4876-8bc6-0e28acbeceff", "comment": "Malware payload (CryptBot)", "value": "deb1c7b83dfe3a38de11c81c355b862c", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626537343, "uuid": "31e098d9-d6e1-415d-aaa9-98f1134bc988", "comment": "Malware payload (CryptBot)", "value": "35babae4b41277acc99f86fd6c066c25a78797b69598c844f2005619342c2cd0", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626537343, "uuid": "2f4b11ec-4c40-4a15-b4ba-66ce26efff1a", "comment": "Malware payload (CryptBot)", "value": "f2f636befff870f1731cd72f8c82ac485974bc8b", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626537343, "uuid": "c7d4fe55-bbd9-40ea-ab2b-5e6411c1f7b0", "comment": "Malware payload (CryptBot)", "value": "9da082cbf1a45a393579c5836b006c99d67d68863fb7a567856efc85afba464705668d2711e7a51c9c7ad6a9bbba977b", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626537343, "uuid": "87bfca4a-29bb-404e-a1dd-aeb75a57bca1", "value": "T13AE4015276B0D573C0EB29705078C2656A3BBC732934354F26633F6B2E722D0BA76366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626537343, "uuid": "edb36fc1-5039-4512-ade5-9fc946baebf6", "value": "42a91e68a543cab2e800e3107645dc57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626537343, "uuid": "ede46f37-5f29-46a5-8287-d41fb3c47323", "value": "12288:c3n9x3kZ3aAm4Myd7k3rDSqQVdMs8NOxJDP0VfBJ:UjBG5o72qQVmshbYfBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626537343, "uuid": "edad20e5-3c0f-4baf-aea2-7840511332d3", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626537343, "uuid": "64932b28-fb58-4a46-b8be-0da635fbf53a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626537343, "uuid": "ffeb07c6-d99f-4869-b3ae-9c0e43b901b8", "value": "deb1c7b83dfe3a38de11c81c355b862c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900402b7-e71c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626539542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539542, "uuid": "2ed8ac15-8ac3-4949-b8bd-0ec1d31287a2", "comment": "Malware payload (Mirai)", "value": "8ef3a9cf2b6ca06f8b0e787f621060c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539542, "uuid": "3c02f939-c214-4e93-a239-cb0c9e85c8d9", "comment": "Malware payload (Mirai)", "value": "35c7c38d6748587432786d101404e607f588a0e3f39c222d2d752b08c6f0e9d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539542, "uuid": "f7fd2892-a855-4603-9e12-af5538c47324", "comment": "Malware payload (Mirai)", "value": "f47499b2ddf34ae870f9cf589ff2c9760ad8b353", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539542, "uuid": "dfeb647e-2671-4e3f-a939-13888b66c602", "comment": "Malware payload (Mirai)", "value": "dca95595c7b52962a15d73c6c177be13cab2ced26b621c45715047c2feccf9336caced9e6cab59d613e663dffd266096", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539542, "uuid": "d0e3a5cf-5c7b-420f-ae6b-c41fd1d3bf2e", "value": "T150732955B8929B22C5D4527BFA6D82CC373563E8E2DF3213AE211F10778651F0EA7B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539542, "uuid": "b7411e75-b154-44ce-8e1c-97ac1a64fc1f", "value": "1536:U8Cp6/EjUhNV5OOxsYomh8Jl9pRfk++84MQ+Yky:U8V/EXskY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626539542, "uuid": "acfe5235-d377-41cf-86bd-a3a322838c42", "value": 76396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626539542, "uuid": "9c710eb5-61f3-4379-9f72-2ed9dffc91cf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539542, "uuid": "1b288ee1-c090-424d-989e-b443c9ab6145", "value": "8ef3a9cf2b6ca06f8b0e787f621060c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb50476-e731-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626548425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548425, "uuid": "09ed362e-57df-4443-9ed9-d0728b8c0cb0", "comment": "Malware payload (Mirai)", "value": "2d810c6506757f1e57ba97502608657a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548425, "uuid": "1e634437-9ab9-4259-90b3-f98f1960f998", "comment": "Malware payload (Mirai)", "value": "35d77014071e1ca23bab8f0b1d91d64dd3038123ff18b3804c2741dd02c011f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548425, "uuid": "27f436ea-95e1-4450-8f41-672f386f1b57", "comment": "Malware payload (Mirai)", "value": "e32acad2b3028101789dc99cd44ddcd36fa620e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548425, "uuid": "2b144582-870d-42d6-8d7d-38bd003eeed6", "comment": "Malware payload (Mirai)", "value": "07eda271fb14b01ff64a673d3fd3abca60033dafe79657185756c934245cb4da23e0bcdb6a30d10d9f978fbc2ec20e69", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548425, "uuid": "63fabc2c-3275-424d-9fc6-0fe14d121eeb", "value": "T1C964D08AED41AF25F8C516BAFE1F034973738BACE3DA7111E620972036DA55B4F3A144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548425, "uuid": "3e395bb6-c457-431c-a24b-3d4ab3931097", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncW5wKSDP99zBa77oNsKqqfPqOJ:78QpZsKCaiWDSDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626548425, "uuid": "6984d971-fcfa-4a48-9ad8-b028ff6d9a22", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626548425, "uuid": "9308407d-bd08-4ff9-98a6-295986cca40a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548425, "uuid": "990ba4c1-4f74-4a7c-9d09-3501ebf64e09", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eba3f11-e736-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626550680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550680, "uuid": "78d666df-cc48-43e5-ae32-56340cf7be5f", "comment": "Malware payload (Mirai)", "value": "e9173303153cebbe268210cf92c43396", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550680, "uuid": "4e0654ca-bcda-4701-81f4-a5ccd658d3c3", "comment": "Malware payload (Mirai)", "value": "38dd0e48727065f9bd7f36e4a833c218e5e4bba9f307c288cc5a07447cc8148a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550680, "uuid": "a813be3f-7b4a-4343-8c6e-33608689f36f", "comment": "Malware payload (Mirai)", "value": "52ebf1ddfaf9e61747df0aed12f15bf9c62d5b67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550680, "uuid": "9d9a6b21-34c1-46f2-b54c-5fa8b7247c7a", "comment": "Malware payload (Mirai)", "value": "01d1853e67233c085821312bb88265173e16d526a2b4ac6cdd143254128bc2d2a81f64ff7903a698db824038caf63dce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550680, "uuid": "39579080-a0cf-41ae-a4d5-0fbf346e6515", "value": "T14A832A96F880AB11C6C2557BFE0F114E33174B7CE2DE73129E245B64778796B0E3AA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550680, "uuid": "7da7b6f9-da49-46e6-8cf4-bad193857c66", "value": "1536:hAnpgajP0T4fWX9Ujhh1CQDonVkf8vUpiIIMinOabhfqvhB/hadt0C5HY9/:Sgaz0T4fWX9UjhvCeoVfOabhfizaz0Cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626550680, "uuid": "0656732d-0faa-4835-86b2-0825e8c69270", "value": 87388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626550680, "uuid": "4cb17978-5e13-4b3e-85c7-73923700c975", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550680, "uuid": "0a9ea097-61ca-4636-b32f-4d3b47abf9e5", "value": "e9173303153cebbe268210cf92c43396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366611f5-e6cb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626504603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504603, "uuid": "791e9560-93bc-48a8-a4ed-405f45e6e897", "comment": "Malware payload (Mirai)", "value": "d8ff89a638d820fd484200aa248a9031", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504603, "uuid": "11e4d8de-2f7c-491e-962c-30490fb32155", "comment": "Malware payload (Mirai)", "value": "3a88b6c0827446adfbde76e940aaddab261a77c007aa0de765366a2fc3746f31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504603, "uuid": "a17fdb81-ee0c-4d25-a402-f2f544ef8f42", "comment": "Malware payload (Mirai)", "value": "c5b3437694bb6065128f1f40d6f93eb2ef786b68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504603, "uuid": "45703c41-5cb8-46fc-8490-117663a09e25", "comment": "Malware payload (Mirai)", "value": "4983b3be78e3ab0d7e3f73c8cc6bc0e520f8c7e7d4a7ac375bf1d5c503b72ba8a8c3c68a4705f1ecf084d0af97cbf596", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504603, "uuid": "d8f0c2cf-0545-44eb-b621-e012676189a1", "value": "T1F083B60A6F219F7EFB9D823947B78E25965833D627E1D181D15CEE001D6038E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504603, "uuid": "bb510a7c-b58e-4f44-a2a4-495e6a103ff6", "value": "1536:dED2GZiWqGVC5X3/B1JF6Mmq8I/+pHjdIx/GCR0veI+IEHy4vATzNjMXkAt:dED2GcWqGVC5X3/BXFxp/EGfR0GPQTzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626504603, "uuid": "59574b5b-6178-4631-bffe-a5265ae75284", "value": 85124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626504603, "uuid": "a90b5042-6648-4646-94d2-c718e34c55e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504603, "uuid": "ccbd8d8c-10d0-47c3-9c61-330b7a23df89", "value": "d8ff89a638d820fd484200aa248a9031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49df6362-e731-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626548444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548444, "uuid": "57dd5f52-9ae9-4576-b14f-c7122135734c", "comment": "Malware payload", "value": "7d23411a8cfc59744f332ba01c4932a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548444, "uuid": "a62c23f6-07a4-42c1-bb5d-b44d6732b767", "comment": "Malware payload", "value": "3c13167c7111de691342b0bcd747d8d176b2f6d28a1ed7aed6f1f120dc05f734", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548444, "uuid": "2105bc9d-7549-4746-9a9c-41613f4a9c63", "comment": "Malware payload", "value": "ea132d8385ad7029df47d5eb8601fe1a77bc4a1c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548444, "uuid": "fe8949d8-f696-4317-910f-3a57314dd233", "comment": "Malware payload", "value": "8ab35324bc52ada30f727dd33aeedbc376785ded6e4809230e5fa054b4c3bb368b78037322aa247e94af792e46d2615d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548444, "uuid": "2369a3ae-9549-45c0-948f-d3e9fa65520e", "value": "T19D91974B8FA1F411C68C133E9E3D4A8D3625B34492CA35039EDE5F2CF68728D6875792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548444, "uuid": "33068402-e0d6-4fe8-9b00-7b49173bd53e", "value": "96:ClcTnzSahljV7Xt+QAT9SKupvBoJdg5JPhzU8zyDZMO2zlWNMkrCMxZPTBd9p:ClcTnOaDjV79bAT9SK0WIyDZA0LBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626548444, "uuid": "2ca68aba-44e8-4845-9f82-fc626b2db875", "value": 4320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626548444, "uuid": "3e4316d8-7d7c-4a85-a090-4088f695d1ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548444, "uuid": "556e7d74-306e-43d5-960f-b015b4d41ea5", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f38bb78-e74a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626559244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559244, "uuid": "83023252-0514-417d-881f-8976223f7ff3", "comment": "Malware payload", "value": "7278c6eccd06b0f5044cf18ee38c4b40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559244, "uuid": "b9e27c81-8705-4a41-b502-b2f01691583f", "comment": "Malware payload", "value": "3c3dc1885ba75703adc253bf033dff702f4458714efeade414592ff443e76e0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559244, "uuid": "87f02067-a46b-443f-be3a-a24802b1d70a", "comment": "Malware payload", "value": "d60edc5c6f6e38c0280d4ce040de39bc982b3839", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559244, "uuid": "c9c0a072-c934-4163-b8c0-20e3733c16eb", "comment": "Malware payload", "value": "11f4a9c01f5206720260e75b6504a252b5661e1af11ea2eef8cd8f47a671b005ffeba6d633e80ee55f1ad9e049be15d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559244, "uuid": "d14e054f-3de0-433f-af09-9d8b07e37dbd", "value": "T13D145C05F707C2F3C4830BB2229FAA560932B5BA1B5FA605F32E6DB45F564C97125EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559244, "uuid": "e5049837-ac8e-4182-bd7e-6344baed6d8a", "value": "3072:EEOUUTBE2mtZ2tP4vYuOjn97sKX1hyqJcxQXzk761GtApGFNcPDiBpXNXOVmveLE:E1mtZ2tP4vYuOjn97sKX1hyqJcxh0GFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626559244, "uuid": "7acc6ebc-3e2f-4ae9-988e-001e17f2659c", "value": 195161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626559244, "uuid": "e3d0acf3-6b19-4579-a458-0411d83ff0c2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559244, "uuid": "870f87fb-339c-4639-9fdd-f6c702f6f751", "value": "7278c6eccd06b0f5044cf18ee38c4b40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0812a312-e6e4-11eb-875b-42010a9c0053", "comment": "Malware payload (Cryptbot)", "timestamp": 1626515262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515262, "uuid": "aa104d01-86dd-4c68-92c1-e07f09f675ed", "comment": "Malware payload (Cryptbot)", "value": "bcd4db4df2b58bfb92a5c7e7395abd99", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515262, "uuid": "39eb7faf-4e97-420d-8649-8925cfb06865", "comment": "Malware payload (Cryptbot)", "value": "3d364150c09d1f0c4a9eab0144fb4754bdcfa96ad1d0bd874308e625c5958b75", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515262, "uuid": "47a1aa9c-370f-4a91-9767-1ed526f1130a", "comment": "Malware payload (Cryptbot)", "value": "05d4f9b76adf28485bd8fa0b74412746b98c9d8c", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515262, "uuid": "3211b390-2690-44c2-930f-87a489e811ad", "comment": "Malware payload (Cryptbot)", "value": "b5403aa165ae573ec1e9093e19afb5f40a505b8ca110ed77a852ee04ea8421d6436f98919ae19d3da6dfd0e86a7528f1", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515262, "uuid": "fba8d568-7516-4423-956d-cd06da82c22d", "value": "T1AF9522017B94C772C66C03FE4B64F1B622B4ADF3021788D7BB743ACA7D70E95A629185", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515262, "uuid": "c0e93694-b33c-4579-bdab-f3cdf624f7a2", "value": "524711ec9c5a149fe3bf3479d0b505b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515262, "uuid": "04721543-840a-40d5-bca3-d14fd91721e1", "value": "49152:pJlN6I4kYlok9rVY1ODeW/eVITGjtVszOIRD50pP6lu:pJqIbk9qE/owybMR9Nlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626515262, "uuid": "d0ae6719-642f-448f-89e8-684810129a92", "value": 1908631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626515262, "uuid": "0901d302-a886-48dd-b593-dfc2cb991f82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515262, "uuid": "bbfbbe2c-069b-4c62-9d82-cf3c78160d96", "value": "bcd4db4df2b58bfb92a5c7e7395abd99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf17d03-e71e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626540233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626540233, "uuid": "88087637-3d12-4cec-afca-26ab468d8fed", "comment": "Malware payload (AgentTesla)", "value": "e24e5174ad14f83752150354518dc88f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626540233, "uuid": "654d99bc-c773-46a2-b365-1abb33e760b2", "comment": "Malware payload (AgentTesla)", "value": "45b632c39daf926ccf38d016bf4efae75229b07e222e346207e9168872d019b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626540233, "uuid": "b95e51f4-4f16-469b-8e92-59cd84ac8c31", "comment": "Malware payload (AgentTesla)", "value": "6c058bfcb6a9e4a93716b2f8f917ccebcf2e35ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626540233, "uuid": "b0dde3da-c700-4162-8e23-e1ef96130caf", "comment": "Malware payload (AgentTesla)", "value": "f8f41708108685207567e9cdc051ea691cdd2ff27f24048941f00aaf20055c28d7603c8d9bbe4ed50cd5544a70d982de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626540233, "uuid": "77cad04f-c603-44bc-b306-1b8f05a54c3a", "value": "T10FF46AA607884513C7EDB6B47750A6B4F3528D52FA14ED2B0AA27C83313FA63D881DDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626540233, "uuid": "82a1fffd-c112-48ea-8254-d01f905c1fce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626540233, "uuid": "d67470e1-fa80-45d3-957d-3e6d5f65b258", "value": "12288:J4GD4BqIbAUYZfcUa0Yy64fMMvYjJjDSFC78trcl8:JnNaYZ0UpYy3M7BS4wtrcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626540233, "uuid": "d7b3a46d-74a9-4b1e-90ea-0060ce2140df", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626540233, "uuid": "71f7a9f8-ea8f-4fe7-9a9d-460f5d20a409", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626540233, "uuid": "39a18650-eda7-4ae1-97e9-cbd72be5013a", "value": "Technical Sheet And P.O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a198e562-e6d8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626510366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626510366, "uuid": "5bc98d3d-6742-4581-9b14-17b9964be886", "comment": "Malware payload", "value": "90d4bcc076855fba54f132de991a28dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626510366, "uuid": "14cd39c5-511e-448d-bc0d-f663bf20292d", "comment": "Malware payload", "value": "4737ca30f531e602035c5e02a1d0563f4f64ea79b49e8c0d4dbda82a0d13781b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626510366, "uuid": "5492e57f-72d8-4a97-8178-6cd196cbf5d8", "comment": "Malware payload", "value": "9d2d017a5c8047898463f714bfa3c760113bb065", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626510366, "uuid": "a0419ddf-ac08-4dfc-a3c3-270f32f55749", "comment": "Malware payload", "value": "b088e38b5b534daac8c4b70ad24b59f084c993add902bf760b49635bf3f8f476491f3388d624ab82ba498ee5a02e50fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626510366, "uuid": "7fd5e5e8-e6f0-4df5-be38-85435a68c585", "value": "T1E4F37B1136B0D837D5E20AB85434C6A06A3BBC622A74754F76A73F0F2D722D1B966393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626510366, "uuid": "25e614c0-d4c1-4ac4-8705-4264ac7f62ff", "value": "339ee21d6e3887ac90f2297a6d04f07a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626510366, "uuid": "99434a1c-476b-44fe-a468-5da4e740895e", "value": "1536:jq7Tnb3lFfdL79tlNOnW8CQmyslbgWUA5huCqqgB7VVlo6k6pJ1wf5DHkRjs:jqPsMbgW7huCqqKV/pJaDHMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626510366, "uuid": "4eaa6bbf-66d8-40ba-9213-57b4b001f990", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626510366, "uuid": "bac64499-72bf-4e78-823c-b3c4372d25eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626510366, "uuid": "96c0b15d-f16c-4589-b976-763cb2b40fac", "value": "90d4bcc076855fba54f132de991a28dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79450584-e74a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626559261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559261, "uuid": "c4820d28-1331-44aa-8122-7dc2b1e96d5e", "comment": "Malware payload", "value": "bb349323d50f41b5a7427d70a5c2d1b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559261, "uuid": "92122e18-5bb1-497b-883d-92efd42fc9a8", "comment": "Malware payload", "value": "4813d2a9e15a4a7d02ef06432bbff1bdd86cd0e116df585d05248c5ac213832e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559261, "uuid": "d2f4c785-c8d2-4eb7-be71-db752bdbed5c", "comment": "Malware payload", "value": "17d6261beede05197dc602acac52b841183fda42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559261, "uuid": "18832a23-1057-485a-b255-f18c113bb06f", "comment": "Malware payload", "value": "cdbe969aca6189264ba8da9b96de468221102a3106832b4ea30810e7629c02740d8342b75b1d336b415899c386446b21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559261, "uuid": "d60b641d-ceee-4315-ba19-24fb773105c2", "value": "T1FF54B52E7D22AB7FF168873107F79E70879921D237E19356E26CD7181E2124D284FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559261, "uuid": "5dee3c45-f0e1-4088-9281-ffc7ab34347f", "value": "6144:ar6/XQn2BIkvLb6stcqmNDrLzBY7nvkoFh4ZS:qXkX6s2qmNDrLzBY7nvkoFh4ZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626559261, "uuid": "d187270b-36df-486d-8cfe-6fb27fd42393", "value": 291139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626559261, "uuid": "9feba048-16bf-445c-9c68-e6376f96b61d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559261, "uuid": "4dcc5447-2028-4d54-afec-76de87436d5f", "value": "bb349323d50f41b5a7427d70a5c2d1b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52edff64-e6e7-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626516676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626516676, "uuid": "69986d8e-8b64-4469-a5f4-c6f544a57e76", "comment": "Malware payload (DCRat)", "value": "aafc3c89ab0b115092416160141397f3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626516676, "uuid": "e51d7c9d-b07c-4728-97db-beab8c585a91", "comment": "Malware payload (DCRat)", "value": "4a86c7fe0c87645255b7e4b488923effe81cc746074e341df7d54fc79ae4e6a5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626516676, "uuid": "0352ae21-fe06-49eb-8ec4-dc488e23b9d7", "comment": "Malware payload (DCRat)", "value": "42ee3e72b59eb557d7ac514154d48898191ed0f5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626516676, "uuid": "69f97a9a-57de-4c91-bbae-3f85e2b32649", "comment": "Malware payload (DCRat)", "value": "d1d8e5e06863edd9115752c1baf47c2e05f4c0247be2c5a21617ee9ca6dfd59a5c709f121a9175e2d6f98902a8bb1859", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626516676, "uuid": "06e42a13-e7f3-4bd0-a6a8-11c4511caec4", "value": "T1C8355C243EE95035F17BAF7895F4799A9B3EB6623713D94E01A103890A23B41DDD0B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626516676, "uuid": "51f2e8e9-ddf8-4b11-8073-fceea17fb27f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626516676, "uuid": "02a59d4d-c79b-4332-816c-9a0ee75f128c", "value": "24576:O2G/nvxW3WhygXF+OtAZ+wbV+ugX9HY/j/pFnVyWwpxp:ObA3cy2MKglpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626516676, "uuid": "1ae835af-dedc-4a13-8af0-deda71914dad", "value": 1066639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626516676, "uuid": "1e132bfa-0771-4534-a80d-efdf26f6a7eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626516676, "uuid": "fc0e2d16-aa17-4cfc-a792-532cab8fd5ad", "value": "AAFC3C89AB0B115092416160141397F3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6b1162-e6d5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626509065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626509065, "uuid": "f3c12157-7426-4b6c-b08c-994185b77944", "comment": "Malware payload (Mirai)", "value": "b5221376bd56d551a0e0f448e829bb23", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626509065, "uuid": "84403c38-1f15-4867-a832-9e8bf3a63638", "comment": "Malware payload (Mirai)", "value": "4b31f5c466193f580d1befb8446feabffe5cccc74a20c881770270f8ad04625a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626509065, "uuid": "ee399f90-293b-43f2-8b1b-b574814b794a", "comment": "Malware payload (Mirai)", "value": "6bc91ee9090dd423a9411e2577cfe97cb64a230b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626509065, "uuid": "bb16cabb-e49d-4338-9084-58829b8895a2", "comment": "Malware payload (Mirai)", "value": "bed861f82618e3b604520e1c5a48f308d5678599c4b268109936389baf36530aee88531eb49ab8ee3c22dac47b170297", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626509065, "uuid": "f99818d5-bfce-4bb2-85db-3e959f929de2", "value": "T11C64E18AED41AF25F8C516B9FA1F034973B38BACE3DB7111E62487103ADE65B4B35184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626509065, "uuid": "066c86bd-991a-451a-b549-4883cbd6c362", "value": "6144:7O/QJHZweEL/NOjCHm7FZZnciBa77oNsKqqfPqOJ:78QpZsKCaiiBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626509065, "uuid": "e01dc3ff-3d28-4989-ab17-71b4238e67d4", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626509065, "uuid": "12deb0d4-c4db-4cd5-87b8-53ff4fcc1963", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626509065, "uuid": "ba853aa2-943c-4571-83b7-7d4b9b955fc5", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc27475-e6cb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626504887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504887, "uuid": "6bba5575-606b-4aaa-b1cb-0eb70dec409a", "comment": "Malware payload (AgentTesla)", "value": "c6a369d261a110bc743070d4fb91c327", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504887, "uuid": "ad5c5a16-cb75-4bb1-83dd-5694c93d07d3", "comment": "Malware payload (AgentTesla)", "value": "4e16a2a69d853930195ad73fefb6edb2b86a143f2dab97e46c27f2e347f2fc4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504887, "uuid": "f2a80c22-7d74-4fdd-bc5c-6d657fddc323", "comment": "Malware payload (AgentTesla)", "value": "408c00603bea3666c37d90b8b9aae9dd01225cc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504887, "uuid": "ab8befa8-f709-4beb-8110-42681692e811", "comment": "Malware payload (AgentTesla)", "value": "377797529bd7a5cdc4b74cb31899b4fc07c1aff26750059b29a6dd5ff18637b42e578279d6715eae5257950e70a61692", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504887, "uuid": "79e45c81-59e8-45bd-80b3-d070b39d4856", "value": "T11525FE3E6AA42A27B777D2614681C015F9BC41DB3A395DD742C7698C390E8027EE7F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504887, "uuid": "3ee94502-7b3b-4b4d-8e1f-ff7823658352", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504887, "uuid": "8e68f1de-4111-43b7-8e20-734ad81ce59f", "value": "12288:PatVs9oxZ0EG3KQyTs4XlhyI/vbU5Gb07SLIHPxlG1pSRRq5jumb5GwO:SPsnW54fO2R2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626504887, "uuid": "550a5bcb-c096-42bc-aff6-abd99c2f391e", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626504887, "uuid": "c120b857-5fc9-4e7a-a29d-f3308435edcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504887, "uuid": "ad292a09-a838-4a45-ae42-607ea4b366f1", "value": "Scan_Receipt160721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a113c99-e71c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626539478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539478, "uuid": "4cbe192b-7970-45f1-9cba-724cb1aed72f", "comment": "Malware payload (RedLineStealer)", "value": "4995c492f9ea855bc019e69ca5332013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539478, "uuid": "02ff0f61-826a-4835-852c-f164722fb4e5", "comment": "Malware payload (RedLineStealer)", "value": "50db5f118139b6880f3d6c02211f871313e988b82aff7dc8e329c1ada6752a5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539478, "uuid": "aa207f2f-e6fa-4c77-b751-eec8cc946a49", "comment": "Malware payload (RedLineStealer)", "value": "32830b2538284138005fb141d618bf32debc3cdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539478, "uuid": "746e9ea1-d4c5-4de8-a098-450d2a970131", "comment": "Malware payload (RedLineStealer)", "value": "80a210739e7e0945ee9bd1b9489ab63dee4e9d9b368709680212f6c22f615a28f638252bd0e1dde1b15064e9191ad1eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539478, "uuid": "5067ff06-f568-4e78-b9e7-1c623b2f6d93", "value": "T14A64CF1037B0C437D1E30ABC5476C7A8263BB9A26A71B54B32572E5F5E322C3756A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539478, "uuid": "eb430a23-9e2f-431e-aae4-6b72fe94fd3b", "value": "856de012d16335e459e934f601b8fd9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539478, "uuid": "91dc47e9-68ac-4bd2-8268-67b41ffe4089", "value": "6144:ACCbbPGmevTGW9AmoFpgIEe0dabA+CBhgqy:3yPGWZkm4Awzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626539478, "uuid": "7fab2674-6f60-4836-ad25-a77d6c99da41", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626539478, "uuid": "07948bf4-e3bc-4558-a4f4-ca5d38c65444", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539478, "uuid": "95653041-ac7d-4d00-be51-886218984f22", "value": "50db5f118139b6880f3d6c02211f871313e988b82aff7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea5bce0-e6cb-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626504858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504858, "uuid": "8d5c813f-fbb4-4ea0-bbd0-a3c34989b431", "comment": "Malware payload (Formbook)", "value": "be986c495952935b1e6cad471cf14747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504858, "uuid": "0d35f867-18d5-4bfe-85aa-c96d7cb38b28", "comment": "Malware payload (Formbook)", "value": "54ab4a1cdce2eb6cac3d05ca5eb317a247a6b5e9164d8c1067f1601953ec8729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504858, "uuid": "8a52bc51-73dc-4b50-b511-87b76de01616", "comment": "Malware payload (Formbook)", "value": "6bb3fa03d81e4a8855a35760a9ef2804ca2f7eb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504858, "uuid": "17cef51e-6ba8-4674-af6c-9b52de59aee7", "comment": "Malware payload (Formbook)", "value": "bd769a1170a76b71ed84c047521336bf99f98c13b430cab8ff24f603dcd78e3579f02ef4577b28b1568ddd073ef0de0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504858, "uuid": "db732faf-5d3a-4b28-8015-99f1ef5dc802", "value": "T1D125FE3E6AA42A27B777D2644681C015F9BC41DB3A395DD742C7698C390E8027EE7F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504858, "uuid": "57fed224-d449-46b6-958b-16b697f43569", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504858, "uuid": "357f4cb4-6214-49b4-85cc-ec12b1ddb6fb", "value": "12288:wSLZWxZ0EG3KQyTs4XlhyI/vbUFUH9vWt8cgxzzz3GrjI4WgL4/z+/8M:hL1EWtfgxzzz2rjI4WggOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626504858, "uuid": "fce1187c-6608-462f-816f-a3235b92f9f6", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626504858, "uuid": "792b47ef-8f3b-4683-9dac-e7f0b084e3cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504858, "uuid": "5ea1b6ec-5394-40bd-b14d-9d2d8b173575", "value": "PTELOONB39-67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378272b5-e710-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1626534240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626534240, "uuid": "dbffa4ab-3ded-476d-8507-ddeb139d937b", "comment": "Malware payload (CobaltStrike)", "value": "bb4fe58a0d6cbb1237d46f2952d762cc", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626534240, "uuid": "00fb56e3-3e9a-40cb-b302-973bfc17a346", "comment": "Malware payload (CobaltStrike)", "value": "56f3f593d4bf728840e00df5ba1a1fe1ffddf142a3e42dac6023c866d3670624", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626534240, "uuid": "127f981f-fb7a-4d68-a916-a3c4a7afa63b", "comment": "Malware payload (CobaltStrike)", "value": "55b9b0e5fae34a3f62e07c9ad0be9a87886d9f65", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626534240, "uuid": "133e8032-f53a-47bf-a94e-43ab6822915a", "comment": "Malware payload (CobaltStrike)", "value": "939818a96928dd29955cc45305c23cabe109f268584d294ad95418e1171ca241e22200b2d93afde46732b0e301d50076", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626534240, "uuid": "00adaa74-c6e6-4d36-9d32-2494aa73a1b3", "value": "T1D4C36C57B3A134F9D5778239C8A0591AE7B678760A318F6F039406A62F372D09D3EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626534240, "uuid": "e995be37-2ec1-4303-b3e0-0fd0296de02e", "value": "9d99ebd37709d0b6eb21f50ed812bceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626534240, "uuid": "d8a3ddd4-f3f0-467c-b369-9359d6265985", "value": "3072:DMEqRX0NTe40kMU/9DGdhn4bYZuTn0Dkt3cQVx9E:DMEqQa40kPZM54b0uTnz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626534240, "uuid": "e3bbfd20-f264-442d-afcc-e0926fefddcf", "value": 120320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626534240, "uuid": "b1c46f71-a7d5-4d65-a502-26948dd5e4f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626534240, "uuid": "9835626f-7f1e-4e58-a1a2-88282c5b5776", "value": "bb4fe58a0d6cbb1237d46f2952d762cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f640bc4-e725-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626543353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626543353, "uuid": "2a250ad7-0217-40b3-b642-aa1bd874c67f", "comment": "Malware payload (CryptBot)", "value": "f012091742dad985c58f22a0d458a57c", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626543353, "uuid": "b3727fd0-f793-4a49-8fbf-9659a9bfbd06", "comment": "Malware payload (CryptBot)", "value": "571b3f0b4685473b424f7fb3b67344cd1441930fa7f966e3a4cd41875fde8de3", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626543353, "uuid": "f4eb5a73-1ce6-47be-9968-aa8dbfef2378", "comment": "Malware payload (CryptBot)", "value": "5a8bbef52f4962e2fde6cda6500c5ddfc9edfa86", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626543353, "uuid": "a7b41776-2cb1-48f5-bf05-fbabc51ad579", "comment": "Malware payload (CryptBot)", "value": "c6c88b421cb67e65141bf701367cf897bbd26c59aff17531cf16fdc76fc679eac6701f107f8bb3e2ca6015c3a1d8244a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626543353, "uuid": "db455cc1-d8a8-4793-ad6f-85e699c52b65", "value": "T13F749D20BAA0C039E1B721F4497993A8692DBDB15F2490CBF2D57BEA26352D4DCF0753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626543353, "uuid": "5cf1fac7-d402-4795-a30a-630866b037fc", "value": "c9b75d0691c0c72e90e8c7c05332d1a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626543353, "uuid": "5803a988-3e51-4ba4-b33b-717e4279325b", "value": "6144:RjaDyhty+lIbwjLs+D2JLs6eBMvEU1Fm5/:t0Gty+lias5NDeCvEog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626543353, "uuid": "bf185126-e730-43cb-aa68-01b2b0ff3532", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626543353, "uuid": "d82d619d-72b9-4646-a890-7e0a7ddea597", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626543353, "uuid": "41e61777-8209-40b9-a1d9-cd22d6f744b2", "value": "F012091742DAD985C58F22A0D458A57C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe4a213-e70f-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626533771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626533771, "uuid": "4ad9a5f4-ea0b-4765-ad42-4678b1b350cf", "comment": "Malware payload (DCRat)", "value": "c49b3f311acc59e9c99b55c2ada71002", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626533771, "uuid": "d448bb84-26e7-45d7-9cd9-27b6ab374675", "comment": "Malware payload (DCRat)", "value": "587ccc1e9cb1ab35402bd58787fa9f02646f9561f8f7906d09095a62fbc9149f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626533771, "uuid": "3cdea9e9-798a-4a1b-b169-a6cd8a045012", "comment": "Malware payload (DCRat)", "value": "e393d3b8a8f8802323cd612571321609a92ba616", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626533771, "uuid": "748ea4fc-4b93-45a8-9e55-b2a9fa41efff", "comment": "Malware payload (DCRat)", "value": "ac84184c6a5b258c5b08bede479091abb5c3516358f8e7981d1420136a6634522af52aa8b650547e38b5aaa386842c99", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626533771, "uuid": "b2447c61-a415-4967-a857-7135b61e457d", "value": "T19325078937E59E96C54C977958B1068A97608302BFA3B71342B19E6C0ED33DB5E4CF83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626533771, "uuid": "ac686e41-715f-4c59-a344-2dadb6c82fda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626533771, "uuid": "8735d397-8bda-4809-b5d5-800d3b32219a", "value": "24576:mlob+TyRxEqSiykEm3S1zMvmqF+uKuFnJYpHoiC0rbDpMRMb7cCZpkl9m:msmb+EQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626533771, "uuid": "9225e582-6da8-4ebb-b401-385bd6fb4495", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626533771, "uuid": "8c377d58-9736-4a63-9deb-b70b5ca55f42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626533771, "uuid": "4dfcbf63-8f16-4dfb-a331-d15fbdc31194", "value": "C49B3F311ACC59E9C99B55C2ADA71002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e5e3e3-e726-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626543636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626543636, "uuid": "b270f771-9c89-43b1-8c08-77fea3291133", "comment": "Malware payload (CryptBot)", "value": "eef9be1c376b2031d057ab3f50ef9fe4", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626543636, "uuid": "ab71017c-5a3b-4529-abb2-9bfc9b5e0bb1", "comment": "Malware payload (CryptBot)", "value": "5bddc130613ede4832dd4251843b168282b71c4eedfdb1772fd83bf08979ed32", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626543636, "uuid": "f1b69591-be97-4db8-a94d-9573ddeb68d4", "comment": "Malware payload (CryptBot)", "value": "411cbfe2ce9d7c680ab21abfd84a8ae85659a33e", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626543636, "uuid": "f848d295-7bb9-4a04-8a30-43c39f8ab802", "comment": "Malware payload (CryptBot)", "value": "c3039b6583e1af6074850a2d62cabb8a69471d031bf18606dde491817b379246d634b7d7d17c4a27bc5b234308e8ff05", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626543636, "uuid": "9150fcdc-a5b9-4509-9e09-94e9d4c96a6f", "value": "T1F984AE20AAA0C235F1B326B4897993A89929BDB15F2450CBF2C57BDF26353D49CF0753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626543636, "uuid": "c8b2374e-a308-4bc9-a0c9-0c85c159c50d", "value": "fe900e822e1a14acc67063f6a133bd2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626543636, "uuid": "78a2e997-f485-4a43-b693-f1ee55213ccf", "value": "6144:RHaCyWp1qVtHBdnYPzEDNEKSCJFMcaEMaC2zwPmmy:tJdp1qVlXYL02rCJiEFxc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626543636, "uuid": "c864423a-ddf1-48b1-bce8-258b38c477c9", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626543636, "uuid": "613adb33-6340-47c7-8335-b023170ad06f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626543636, "uuid": "64a51a1a-f8a5-40e6-9709-5048771d2188", "value": "EEF9BE1C376B2031D057AB3F50EF9FE4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5ceb43-e714-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626536150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626536150, "uuid": "b135cad8-c8f7-437b-8ab5-f0a413aaac94", "comment": "Malware payload (RedLineStealer)", "value": "c21f9c393077da2f80a2010f93173060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626536150, "uuid": "c53cffb2-5d75-4f1a-ab2e-228a306b289a", "comment": "Malware payload (RedLineStealer)", "value": "5d48d87a55faec775f5c43a2dfeb936d09df03e59b731e118c772ebebd4a273f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626536150, "uuid": "91173804-7f6c-48e1-a85c-97b0bfe31793", "comment": "Malware payload (RedLineStealer)", "value": "7d1f82bc1f2b8010eeac850eea8eec780235ffa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626536150, "uuid": "0818ea72-abf6-49f0-8b90-524c1a9c642f", "comment": "Malware payload (RedLineStealer)", "value": "7c53778bdc16b4f07e3d1ff1735836da9c7b8a5f2ac08aacdb120119f27ba433679fb645492da063e5704c9b93e8cea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626536150, "uuid": "edc64465-71d0-4658-8b0e-06c92aa0b6a0", "value": "T1D6D5337188D60060E57518FD1F23ABE35A61063651F983564364F9EB3E2FF8BE44A3AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626536150, "uuid": "38acefde-bc73-4cb2-81d2-a4abf6198cb6", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626536150, "uuid": "1587df73-fcaf-4b53-a7ce-91018714e244", "value": "49152:EgTb0N3mcRwwIAMozCxSaGq5+qNK8U8tExhfAuZfdRdN9nz4gRIrlhImiR:JTbm3mMzCxl2mWxhIu9p4gqRha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626536150, "uuid": "3a14e1c5-bbd6-4d51-9a28-54fd5d210316", "value": 2774027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626536150, "uuid": "3742933e-810d-4c72-ac31-1cc6543aef72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626536150, "uuid": "11be6b1c-6570-437f-a374-7db2beaa7913", "value": "C21F9C393077DA2F80A2010F93173060.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7c7650-e701-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626527784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626527784, "uuid": "07ad4c2b-7a35-4a15-a10f-d9f6e70cd1b9", "comment": "Malware payload (Mirai)", "value": "e53315ad07a123ec760c60a4479cee6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626527784, "uuid": "df20538c-9a99-4ac4-8f66-2a09fca863c8", "comment": "Malware payload (Mirai)", "value": "5e24b227b58186b359e4d012ce7d0c737962365574161b826800e122adfbbfc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626527784, "uuid": "04f14cda-6042-4454-bde2-16073c91a677", "comment": "Malware payload (Mirai)", "value": "fc656aa0da939625ee529042b8c1b4169797ec28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626527784, "uuid": "bc31c9f0-3e4e-4201-b820-a91e911b6fbc", "comment": "Malware payload (Mirai)", "value": "36686d4909d0067fef14be2e73afa8092b320306048a6393da6e0c0abb301c27924636232e178d10b9eb775818676469", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626527784, "uuid": "86ab3b20-db46-4647-b34e-9fa102bdf83a", "value": "T18933F1C1C6159AE4C3109CF65B5BA84053A86B68F0F7B3D582D982BD3BE30CD1BC5885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626527784, "uuid": "f079180a-776e-4837-9283-aed0675f4579", "value": "768:EURwTspmnk7hrbuSNfbh7nEiIB/jBu9Q5Cq3kO9LQ49vpD+P59q3UELBDI0azEux:5Rzpqk7hrbDEiWLQiCqkupnL5NpDn8CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626527784, "uuid": "390f1cf8-73bd-410d-baaf-8d9d365ec201", "value": 53456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626527784, "uuid": "6dadb596-ea29-44d8-add7-d163ed32e46c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626527784, "uuid": "83cb7e64-991e-44ff-bf09-b5c2c6f53e04", "value": "e53315ad07a123ec760c60a4479cee6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a53ee37-e74b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626559531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559531, "uuid": "42b4a067-1b1e-4eb7-adb6-0c7970073896", "comment": "Malware payload", "value": "79434a80b705d47ea121273c278fbb73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559531, "uuid": "ee2bacca-0ef3-4c8f-b42f-3436ffa34522", "comment": "Malware payload", "value": "6130c1bb08a51023e625707de8b00cdbf092191eb415be3cf984bc480bef4163", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559531, "uuid": "4eda16e1-6358-4e13-ade7-b9d4968bee46", "comment": "Malware payload", "value": "364a998361a4d175e63bc93a298857b928ed7362", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559531, "uuid": "794318f5-728d-4015-ae11-58883c5337fa", "comment": "Malware payload", "value": "d72f9d5a46f313cc7f40b244909ddef43a506590c63d6bdbb3b548ce9e1a95d4370903ef9fdd7ea3731fe1172be048f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559531, "uuid": "5c6dd712-c960-42e8-8d38-4d822b1144f3", "value": "T11F145B52B741C6F3D0830AB2129B9F110633F6FA5B4FE64AF3796CB08E950857126E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559531, "uuid": "a8982b10-5cbe-4c08-82ba-2607ed8f397a", "value": "3072:W7xyZUhUQAUP2kbAzEvJaCcraXzmhs6qgKEPLrgd15gmveLUI/bYNy1sy96XH:Ou8bAu22Ab2DmBqgKETi5gmveLUI/bYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626559531, "uuid": "7a2457de-80eb-42b2-bf8f-c8b77174a349", "value": 192569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626559531, "uuid": "d5d852a6-1d55-4fdf-95f6-febadd888eca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559531, "uuid": "c18de7e0-ad94-418c-9a4c-313363d47922", "value": "79434a80b705d47ea121273c278fbb73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccb5500-e74b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626559857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559857, "uuid": "42d5fc6d-71a4-4266-8328-db1712418703", "comment": "Malware payload", "value": "1920fb0bedf699e403416cc15962c57a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559857, "uuid": "9aeb11a5-807e-4ec7-b78d-92a1752c0587", "comment": "Malware payload", "value": "6256527c14f620b3e72b8841930d51e83d9a443a5f3676e966d3f2969ed35bfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559857, "uuid": "dbc7338c-f323-4ae3-91e3-a053fc2a59ea", "comment": "Malware payload", "value": "5197ab87644d768bdea8431c266ef6aca0a7f627", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559857, "uuid": "6846d85c-6f42-436a-89f1-28b4094fc42d", "comment": "Malware payload", "value": "efdc85ac273e6680d140be475fdeda96232841908f72ba7a4ec11f3ff3e6550167a82353a8039cf8efecdda3e74cec04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559857, "uuid": "79299a9d-0078-4eae-9cb8-856cc1874164", "value": "T1B4E53302FC8568B2D5791E714A2D6B5135BDBE201B14D99BF3C0C9AAED790E0E6307E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559857, "uuid": "7f5c74be-5576-4aa7-a423-ad42f25fcf65", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559857, "uuid": "ffc5fbe2-c673-4ec8-ad04-3472036f4119", "value": "98304:MAK96cdQ1vsIjez3kr7Sd3QyPj65LPKWrUk:O/dQZped3rPW5LCoUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626559857, "uuid": "829cdaa9-a36f-4b4b-881c-f9fd5e061df1", "value": 3258318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626559857, "uuid": "22bdc002-759e-4d5a-8557-4ea00a03d855", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559857, "uuid": "aeeb7bcb-d88d-4355-bcbf-47672900df20", "value": "cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d380719-e729-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626544987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626544987, "uuid": "85d0ba04-3845-4bfe-b5a7-b6af5bd4cfcb", "comment": "Malware payload", "value": "08b9906c0e803e0e869772f367ed81f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626544987, "uuid": "3ef26d80-82d2-49a4-9b1b-09552fcb07db", "comment": "Malware payload", "value": "62e7abae50c6cd7e8877e16fef6cc7066cfafff7bdc4ad31cfdd520aeb54d569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626544987, "uuid": "a63b011d-85af-4701-8dcf-bbb21d0570cb", "comment": "Malware payload", "value": "58c264240f8bf2c69cdb0e1473cf38df1b026b1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626544987, "uuid": "8b9645aa-6957-4920-8e65-d87d3b859211", "comment": "Malware payload", "value": "b054936b5216f7508898c7c480fe8eadb006ecfa9e8c26d3c3e1581a4b3735c00b8b72db73b332a5b5a2aa7e896d075c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626544987, "uuid": "b4ce81cb-c31b-4084-99f2-aef89632924c", "value": "T18B13D74CB784E175D6FF8BF1A492B2890B71901BA902930F99F154D94FB3AC09A11EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626544987, "uuid": "7b086b79-9ce9-4e48-9aae-83e7e6ff9dbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626544987, "uuid": "6ea3e58b-7cb6-4314-a8c4-6062a20a661a", "value": "384:sZy8rll4Ruoyvv75V7eAy88M+PEfPY/h9D9O5UE5QzwBlpJNakkjh/TzF7pWn8/1:K1lOIlvv75N3DucHvQO+Rl+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626544987, "uuid": "c0e97920-eb2b-43ce-a050-e5f0924eb696", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626544987, "uuid": "1d61b372-a7e3-411c-a2df-1c1298364e6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626544987, "uuid": "20aed641-a6c5-433d-ad97-11766af8ffe5", "value": "C5SmJR6t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3920ba86-e6cb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626504607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504607, "uuid": "9cfcccac-5b6f-479f-8b26-9e5286b48d41", "comment": "Malware payload (Mirai)", "value": "adbe45344fad6f6115bc65962a162934", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504607, "uuid": "6e940505-53be-46fb-85ba-a8b82969d450", "comment": "Malware payload (Mirai)", "value": "6309052cc775d8672410340bc6da780f2399007f924ea53507c169f4508a1be0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504607, "uuid": "dce30d00-1037-48cf-85ba-6e81ddd100aa", "comment": "Malware payload (Mirai)", "value": "1ebb84d411516a84ffe3e8b9204219e76b8a898a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504607, "uuid": "936d5310-b122-4c31-926f-5a235c97f862", "comment": "Malware payload (Mirai)", "value": "1087b0d635298da2ba3ce5d50fe3d6c0b2cb023041a7f8e173e9b7e249e6f7d8cee58d9785284e02c9381bae8fa7a810", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504607, "uuid": "2d9ed0e2-1359-4f0d-9d44-d9da125b8491", "value": "T1A5533B99F8029E3CF98BE97944160E0AF92123D121831B2767AFFDE37D331559D21D8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504607, "uuid": "1a14136f-ebde-468d-9033-6409561686e9", "value": "1536:aC4wB3su746Yg1pi3cin68jp2ghgLl0zSMg:aC4S8z69piHJ8lISMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626504607, "uuid": "e40c42bb-93d1-41cb-9135-bdf2adfdb179", "value": 64576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626504607, "uuid": "b6c153b4-0653-4b03-b3ba-62f3cb12f0bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504607, "uuid": "65ef2d01-f804-4701-82fc-e7fcd71c8e2d", "value": "adbe45344fad6f6115bc65962a162934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdf0cd1-e6e3-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626515029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515029, "uuid": "1dcb45d0-3bcd-41b5-9767-b125ae29cb3f", "comment": "Malware payload (AveMariaRAT)", "value": "24dd86688a277a16ca013809c71ab8c0", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "haggah", "colour": "#4A0645", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515029, "uuid": "ccba9951-54a2-4a52-86c4-ef1b851a5219", "comment": "Malware payload (AveMariaRAT)", "value": "643ce9630631fdc9051b4be5b3bd9d60281885380fb2fa777379711d938c3c91", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "haggah", "colour": "#4A0645", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515029, "uuid": "cf99e7cc-8764-4033-824a-8e5d05130e51", "comment": "Malware payload (AveMariaRAT)", "value": "d3a1915ced9501a7ce269ee1ace23b4a50c8c5cd", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "haggah", "colour": "#4A0645", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515029, "uuid": "d28313e8-76f6-4668-8bc5-ec714ec20e51", "comment": "Malware payload (AveMariaRAT)", "value": "5df0cf9b4cf6514dbd979b0f3c2a33f49ecb96a1fbaf0721e53e1d6d93efc2f5b9004d160a7b830453af1093167bf0b2", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "haggah", "colour": "#4A0645", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515029, "uuid": "e4f21ac5-a258-460b-8a32-2c334466ae25", "value": "T10662D03814D396CDF6B65C38B13948E8D1BD9DAEFCE573178A4640507412A1213DB9AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515029, "uuid": "5565feca-769f-48d2-b689-656f412f8e4f", "value": "384:H3x0nvQVFoL33k2JsRSnWlZzXbNZvsFX93Lr9eyPI:BgIVGL37JAxlZXBZ0FX932", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626515029, "uuid": "953e939a-b5bf-43f9-9ebf-da63db19b5ad", "value": 14865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626515029, "uuid": "a191208e-f86b-4db8-8a09-460fba25f713", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515029, "uuid": "bdad8a48-2e8f-4f95-851c-7479ad788aad", "value": "SO-19844 EIDCO.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f4bd14-e730-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626548271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548271, "uuid": "11cea2bd-aab5-441f-b8f5-8ea9be498eb9", "comment": "Malware payload", "value": "b0a43598ad5a48a9c244f9d52135dcbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548271, "uuid": "e24d237d-e7d3-41ad-9a1b-c4b4cfcd0f89", "comment": "Malware payload", "value": "66b7801dda02c0960db7cd209083293efdc66669552d602fa74cb468b8b41150", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548271, "uuid": "81bd84d8-dc52-4603-bd10-db3f33372583", "comment": "Malware payload", "value": "d2a3c06e03692a9a98bccb65446ae6d7ff2164a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548271, "uuid": "386bf32b-64ea-492b-b775-42b6b059d1bf", "comment": "Malware payload", "value": "6bb8a8f79d864e476a13158ba438551a09f3522090819bec2f936896636af4895367b433cbf99605cb85cab61eac60e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548271, "uuid": "bca7b48b-0b64-4b56-9b90-8f9b8fa349f5", "value": "T1F613D68CB694E174D5FF8BF1B4A2B2890B70A01B9912D30F99F154D94F73AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548271, "uuid": "8b667273-14d0-42b8-8a5e-2b960f88ac4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548271, "uuid": "97bf5f95-05e6-4782-af76-eede4b322fd0", "value": "384:SZyCd2MOGVK725yGt8izzLEf/EdSSszUIij+ZsNO3PlpJKkkjh/TzF7pWndG/gra:gBcCwG/zLuomuXQ/od3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626548271, "uuid": "02c35594-27c7-46fb-aa9e-65028474433b", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626548271, "uuid": "2eb6baf5-cb64-4e3a-93db-d40abb435c7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548271, "uuid": "232cb9fb-5310-4918-b886-3a5aa7b418cf", "value": "7RRJrxGc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa50c63-e695-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626481685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626481685, "uuid": "5517efc3-9523-44c3-b4b9-7e8f2891b8a9", "comment": "Malware payload (SnakeKeylogger)", "value": "c621fb2346b7a18ae43297d2a58022d0", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626481685, "uuid": "35bc104a-229b-4299-b54b-1db465fd7d6e", "comment": "Malware payload (SnakeKeylogger)", "value": "66d7ad043396cef881a3a169b72f53d156c243903a13946fd6166e67d612b6e7", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626481685, "uuid": "a676e9c8-61b2-4d47-8c0c-dd8e7c7220d3", "comment": "Malware payload (SnakeKeylogger)", "value": "0f88f1f68f37baac5cccb653314f6ca3654e3f41", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626481685, "uuid": "ac6a6e8c-2f6c-46fe-ae76-0dd5d809048b", "comment": "Malware payload (SnakeKeylogger)", "value": "aa61eb8785a71a4ce40b78cbdc2090fd2f497a2f7c481dac495d3ba898f11b34f753bf75179ccbce3cffe7f6ccd0f954", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626481685, "uuid": "551738ae-73d1-44a4-a1db-e605ace7ca35", "value": "T1ADA4233E959E1DA76879AA056258BD32831C4BAC8F500C10BBBDBF45C404F56EB349EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626481685, "uuid": "443889ea-c14e-45ed-98d4-3649f1341821", "value": "12288:fMe20/f4Yrq/oFXgvCGVthbkIxZMzkKoJ+zRL/Bu/J1ztRX:UD/2F0CG7h2kKq+B/BIJ1ztl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626481685, "uuid": "812a8de8-20f5-44e8-9f33-bdc55e098293", "value": 456178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626481685, "uuid": "2e8f36cc-ad0f-4adf-b808-c4a91e079271", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626481685, "uuid": "940f60e4-fff7-4d53-8ed9-8ddd60342797", "value": "P.O 16.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7166d82-e741-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626555606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626555606, "uuid": "2aa968bc-b83b-47d9-9262-917b86d4f435", "comment": "Malware payload", "value": "77b1d87133b0a130727cd81e36f6c4d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626555606, "uuid": "c172c76f-4bea-438c-82af-dcd156acc7a7", "comment": "Malware payload", "value": "66fadcc9d4216b801823aeb07d6023ed82540e6111c27f3e2bbc18a3e40fd571", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626555606, "uuid": "93286f50-766f-4fbc-afbe-d5baf8e9616c", "comment": "Malware payload", "value": "2c0f352a41712079f1d41e0e353a97b74a3636b0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626555606, "uuid": "5ff9de75-22a0-4767-a0cd-4d1a303112cf", "comment": "Malware payload", "value": "323a845758a96d56f18ff284bd93019da2f33dbd6eb56302a4cc59dd4310d62e43a2637f3b15d4718519ef709cfb1f7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626555606, "uuid": "36cf8024-a2d6-4780-9765-6912fdf1f58c", "value": "T1A673C50ABF511FFBDC6FCD3709A9175525CC650A22A83B367974D828B64B24F09E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626555606, "uuid": "f45297bd-c32c-4e13-8d66-11a448958311", "value": "1536:Bpcb9UzPhI4roNkaK2Hu7PhO0b6DVHM/:Bpcba7amjPhO+GM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626555606, "uuid": "32735a44-b826-4b8c-ac98-145ebc754f14", "value": 73704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626555606, "uuid": "852eeb04-0c26-42a1-9429-c6e863925be3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626555606, "uuid": "fa283157-c2f8-4fe9-b410-d6c6b089e446", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1d6aaa-e6a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626487808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626487808, "uuid": "5e73bb1d-bc67-4016-880f-f86fa549c223", "comment": "Malware payload (Mirai)", "value": "feac04926f2708cf6e13d55f3bd6f7fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626487808, "uuid": "8fddf99f-f21f-4447-8fc0-6d0f8a6be846", "comment": "Malware payload (Mirai)", "value": "6805565afaa8e5804065aea86909eea64f1e1810657c8d03a1467ea793b6d469", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626487808, "uuid": "298da040-a86c-4676-961d-1d98af1f4bad", "comment": "Malware payload (Mirai)", "value": "c74d903c29090d9f673a66fa00642e039a50047f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626487808, "uuid": "8bad360c-e71b-43fb-bbb1-4268bfed21c5", "comment": "Malware payload (Mirai)", "value": "f18db3590acf0a6e5fb11662cb88f51c2008501ca0240a00c234e2341b4788361ad34e97a8018ff7509830380fd10c27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626487808, "uuid": "4d17ebfe-29b5-4483-9893-545efb172ad9", "value": "T1D66319817C80AA26C7D0177BFA6F108E3314ABD8E1DA73478C145F9576DA81F0D6BB4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626487808, "uuid": "7f5a6c0e-4305-4d44-9d5b-0537ff562384", "value": "1536:GZQZrx1aWQuTJPcsCmNG59ioO7PW75T5FrHxBpJeZW6rV+M:GZQVx1W5bbrTwPBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626487808, "uuid": "acbaef9b-62b5-47b7-bb2a-c85d1ec0559e", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626487808, "uuid": "ef957722-3b30-4174-a7ff-e6e44f59ca7c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626487808, "uuid": "3fc76dfe-048a-4a3b-ba86-4a65ea160dce", "value": "feac04926f2708cf6e13d55f3bd6f7fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f429d8ec-e6d0-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626507068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626507068, "uuid": "5cbda8b9-592a-4039-a7d0-cd1bc6504f92", "comment": "Malware payload (NanoCore)", "value": "95e1e328d416f230521c4e86e172580e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626507068, "uuid": "9d87b335-f97b-4b1c-9423-bc1764d55824", "comment": "Malware payload (NanoCore)", "value": "684d86e8df7a780df29b8cb2304c339f362422a993aaa81ca2fb24147e9344b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626507068, "uuid": "46482a06-d99c-46a2-9dd8-3e2e31cb8cb2", "comment": "Malware payload (NanoCore)", "value": "1eebf90ea41daf7b46c3fd23601dba2ae556fefe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626507068, "uuid": "1ccacd91-9137-4034-b4a7-866a2fab3fc4", "comment": "Malware payload (NanoCore)", "value": "299d64f1927baf62dad0854e84225106812373b774d71aa99ee34c4a59df80cacc2004373a68f42d21b383e5932b5601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626507068, "uuid": "3cd71e63-a737-4048-bd8a-8c555c10a715", "value": "T1FF05CF7AF1DC964DC21BAA7D844538021A95B5F26B3BFBC1F8427DFC48996039A4B1C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626507068, "uuid": "3649d6ea-dd52-41c4-82aa-c08db52679d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626507068, "uuid": "e235936f-21bf-4a6d-a305-7deb381498f5", "value": "12288:FTOhD3kTrpa4/ou77SorZQUgudp6IXY1bUh6o98cHrTpcrIlo2M:FTYLwE4/oKprKM76IXY1BZGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626507068, "uuid": "f92f4552-6f21-4b24-acb2-d2751be003ca", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626507068, "uuid": "c524fe10-6e7e-4eed-b0d2-1c59bba98c9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626507068, "uuid": "47abf9dd-4880-4afb-8169-881f001be4bb", "value": "PO64882570060US.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ca2863-e6eb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626518584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626518584, "uuid": "fecda4a6-7bdf-4a29-8433-e88b1864afa4", "comment": "Malware payload", "value": "fb10f2f9b79ed2c21061cec17160fe20", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626518584, "uuid": "af26cf44-213e-40b2-abbd-c37b984ac16f", "comment": "Malware payload", "value": "68888c31c2e30b003d08f001548ac321985975bb64e48de368310cf4c4df9df4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626518584, "uuid": "fd3a417c-7ab0-4ee4-bd5f-e66af49d72f2", "comment": "Malware payload", "value": "7f1e62f31793ca39ccee63075625cd148c86beb7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626518584, "uuid": "65496cb9-9d41-4c5b-bf08-8b66f24ee1dc", "comment": "Malware payload", "value": "0b2092e67c837efc6c6afc535bdceb51c788d9b9f7e8e68bcf93f1d8ef7063578145782604746222d5a805e416cdece1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626518584, "uuid": "05adb32c-25e9-4bec-ba04-a4f2616364d3", "value": "T1EC851253F611E416CDFAC33222165A3620365D28D703A7876E447BFA38BB8D84BD6BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626518584, "uuid": "1cbfd861-e918-478f-81be-e5d3ffb87d83", "value": "49152:k40HbLIByrurRCPu22OgMUsplOsO287MhcPuc//NMCS:h0HhrOCPu22OgMUsm2hh+uK/Cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626518584, "uuid": "a56caa2b-6c5b-49e5-9530-3bca15227dd2", "value": 1869778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626518584, "uuid": "843e17bd-2720-46cb-ba4b-220d7c3e2635", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626518584, "uuid": "ebd98bdd-e73d-4046-8633-494d47d82a7e", "value": "SicurezzaDispositivo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe29c887-e696-11eb-875b-42010a9c0053", "comment": "Malware payload (OzoneRAT)", "timestamp": 1626482174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626482174, "uuid": "eb8167c1-908d-46dd-a70b-ecdbaa2ecfba", "comment": "Malware payload (OzoneRAT)", "value": "8611f1bef473af4d966c3bd0c33d2d63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OzoneRAT", "colour": "#691468", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626482174, "uuid": "92af52e0-500a-43eb-856a-0a73941c1fce", "comment": "Malware payload (OzoneRAT)", "value": "73bcbd57e7cebba665e2a6ff318fb3acd77c0986aedb88caeece9505c4d1d7aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OzoneRAT", "colour": "#691468", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626482174, "uuid": "f87c651c-d855-4c3c-9b6f-c30267c98594", "comment": "Malware payload (OzoneRAT)", "value": "8952c2281054b69ca6be8d88693b2d3f7f238207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OzoneRAT", "colour": "#691468", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626482174, "uuid": "c9d4208b-308a-4e28-8aca-37e1468d047c", "comment": "Malware payload (OzoneRAT)", "value": "c7857671fb42d76f35f18b4be820ce184c5f2e800a559657062894c0ccd16887cf5c94246a5138b5e28c79772f839d04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OzoneRAT", "colour": "#691468", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626482174, "uuid": "7e252b72-bed7-4e30-9505-c2a622c3a5a4", "value": "T16774234A7C323652CD1CC4FFB7AA3855B01C6B8C1C1850A697BB11596CEDBBB06F2789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626482174, "uuid": "7d76389f-f8bb-4530-821b-dc0c87357b41", "value": "91699e4c53616b7b4080ff05ef794118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626482174, "uuid": "067f5a8d-f4ab-433e-9cdd-fa56abcfa9a2", "value": "6144:9XJ11N36UPWgDK6pTKFBLKj4d3BWpfcIZHoSG0Pm7P0bKd6B:9HTPjD6ZB3Bgf5o7R7P0bKd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626482174, "uuid": "6d0fb1d0-bf69-485d-aac1-abc94813ee77", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626482174, "uuid": "f4a1fbbb-bd94-4c37-8dcd-8e0c6b695592", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626482174, "uuid": "f8f0dd85-7481-4c98-a795-26b68f7e1399", "value": "8611F1BEF473AF4D966C3BD0C33D2D63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa29acb8-e743-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626556336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626556336, "uuid": "5636d725-a3c6-4fd4-bb00-ccabb9b30bb2", "comment": "Malware payload", "value": "967dd5f14d134533243739a7f1576825", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626556336, "uuid": "bfce802d-1ffa-4b37-bb88-f0ea77426c2f", "comment": "Malware payload", "value": "7abdd61f3e2e144098be118c2b38aacefbb7dbfb4250d34f223a15d17e665936", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626556336, "uuid": "c6b609cf-24c0-46ab-a501-d79847fedc00", "comment": "Malware payload", "value": "e78e55272747365b3f7215b85054b88e7cfada37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626556336, "uuid": "f8416af3-aed1-4447-aac3-be2dbbc4cd50", "comment": "Malware payload", "value": "937552c2fff46d7f004ad0939a35977250b7ce76bebe807f0fe0b1891a65602240478b98fb0bcd72292b67b8b081fb1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626556336, "uuid": "61276159-948c-4f61-a67c-d7a677c507cb", "value": "T188433B45BC919513C6C463BBFB5E028D372653ACE2EE33039D256F21778796A0E7B221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626556336, "uuid": "95c06037-28e4-45e2-8b3d-b8b03d4deb96", "value": "1536:qmFC1ZwzBfD5sFlBzN41t0HSAVQS/y2v6T:qmZsFl/fHNDZ6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626556336, "uuid": "76b58417-925c-4a19-8197-da8ec9a8561b", "value": 58780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626556336, "uuid": "b6b25185-8781-4998-9503-03d526d074ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626556336, "uuid": "39360898-4ddd-494e-bda3-54217bf077fb", "value": "967dd5f14d134533243739a7f1576825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda08343-e6e3-11eb-875b-42010a9c0053", "comment": "Malware payload (Cryptbot)", "timestamp": 1626515218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515218, "uuid": "9b5b5cf9-9ab9-4ce0-9f67-783aeb1c2015", "comment": "Malware payload (Cryptbot)", "value": "01e4b6d23a48864f6fe05e58aeb50b64", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515218, "uuid": "a133382e-9528-44a5-8d2e-02ae0a0b30f6", "comment": "Malware payload (Cryptbot)", "value": "7b0e112df90a8571ae4b3c9021e290f03c950d25c86de3093d0185372dcbe895", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515218, "uuid": "cda92cec-0b82-4f34-b072-3a6f53c62fb4", "comment": "Malware payload (Cryptbot)", "value": "c50d97f908cdb0f817ce4dd66dfe4c17be57b1f5", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515218, "uuid": "51121953-af6c-4cc4-a297-a57b239becb5", "comment": "Malware payload (Cryptbot)", "value": "309a598b60163606faaaae3846ef65acb8aab729861112efe17306a6a64997b2cc7d50a4b1bc6cfdc17b56f030f9ef8e", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515218, "uuid": "bfd7f4c3-33d2-429c-b01b-5c4f4682fb49", "value": "T115252383AEF2C571E4560BB0ECB16B625976EE7C0164CF1F23407DEE617A462CD3861A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515218, "uuid": "dcdb6363-d0bb-4cb1-80b7-5a2328ac2ba4", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515218, "uuid": "00c82d96-d3be-4073-9232-3fb27a6d002b", "value": "24576:1/f1ZnWVcvLXAwPiVbUV2aUfJOQ6vN1gW1cu:pf1ZocLDiGM0vN1gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626515218, "uuid": "9df665a8-60e5-444f-80bc-2afc5278148f", "value": 1056760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626515218, "uuid": "4201fcd9-13b9-43c9-adb0-3fd409d452c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515218, "uuid": "978ee4e3-1c76-470a-800b-1ea3aa561ebc", "value": "01e4b6d23a48864f6fe05e58aeb50b64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8097bf1b-e724-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626542952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626542952, "uuid": "d72efd93-e8b0-4244-8a71-977234773d49", "comment": "Malware payload", "value": "f42547787dce72e8461bddbd19999cb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626542952, "uuid": "8880314f-23b8-4b82-82a7-58a0766612ba", "comment": "Malware payload", "value": "7dd1c908d34a6170526100d59e3f9bdba5b40bff6655cfac2165e9a600b74052", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626542952, "uuid": "594df780-c206-4700-82c1-914d4b31bd16", "comment": "Malware payload", "value": "41b352fe9d82c8cc9a1c1aa182c1493963ee52a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626542952, "uuid": "4cb37a4b-f9e3-400a-a1ae-05a2bd679be6", "comment": "Malware payload", "value": "5f72e9ec961f014f557ee371c1b72621967310e5a8d0fd33128ca82578f8340847f0d9dffa93eb96df9780f9df7e1dc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626542952, "uuid": "6cab3136-4ea3-4232-a8e1-747d873f5bc1", "value": "T16AB4011171B0E533D0FA0AB16834C6A12533BD216679B94BB79B3E1B3E322D0B176397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626542952, "uuid": "cd8f9a9c-03a8-4d4c-9ef1-80289d24a8ee", "value": "4c2cb70eaa36e2f27e3da0ec1f2cb347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626542952, "uuid": "25e24d26-a082-4a04-9b8b-5eb17b347d13", "value": "12288:uu96S3wk4/nSRxEqy9/v9CLqoV61NhSuBJ:uBPkgnSRCqbMhSuBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626542952, "uuid": "30fbddec-5b3e-4837-a2a9-c013df056943", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626542952, "uuid": "6b04f7b3-7612-41a7-8a50-f88070516a71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626542952, "uuid": "c49e518b-91e8-427a-a52a-04d42d0b2bfc", "value": "f42547787dce72e8461bddbd19999cb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa520f4b-e6ca-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626504368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504368, "uuid": "fb1e7718-5ccd-49c1-a891-920536739b27", "comment": "Malware payload (Mirai)", "value": "6b4b5d60f2436e231a94e39af21325b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504368, "uuid": "fd7f2582-7bf9-472c-ba75-e8e5a114cbf5", "comment": "Malware payload (Mirai)", "value": "7f5c3b718275add1107bf7aa1689cf3874ad895b62f01128816e9353cc5232fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504368, "uuid": "90803197-22cc-4ee8-bdad-00f89f7aaac8", "comment": "Malware payload (Mirai)", "value": "cc6becc64de49d1da43fb94f6ff8cca336052e37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504368, "uuid": "94cd0e71-93fb-4e96-9e8d-0c795b3f2ac4", "comment": "Malware payload (Mirai)", "value": "c3ee295319618a62a0b9246ae1920ebe8a1efd16ce86360af332184da3397e4f5f1b8ae5bf6e0b47d755dde01a5f9e01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504368, "uuid": "0a168dae-ae97-4ab2-861f-3bb61194886f", "value": "T1D04318C4B143F8F1EC110538306BEB625F37F1B7A13AE997E3999973AC466019903A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504368, "uuid": "ae0d9301-c4e2-4eb5-979c-08f126e73155", "value": "1536:TpQdTHY5VpI9BmqK7Zeq3crjUhcafIVSWA/FkTK7Xt0kK:idjYfpI9BmqK74ecvUhlfIVSWA/FiK7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626504368, "uuid": "510be946-bf92-4dee-a4b7-57820e4e9dad", "value": 59408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626504368, "uuid": "495797b4-7a98-4f5c-9ce4-ca1eb6b1f811", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504368, "uuid": "a0cfbace-71aa-418c-ad2f-e237739557d5", "value": "6b4b5d60f2436e231a94e39af21325b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a36e7ac-e6e4-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1626515266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515266, "uuid": "b17b4354-1379-4d48-8ba4-5c8cf51b3ca4", "comment": "Malware payload (Stop)", "value": "133c316394311ae70d18116165d1e719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515266, "uuid": "924ea6b7-870a-416e-9a28-270b9df9ec8e", "comment": "Malware payload (Stop)", "value": "804b9c87f98a32101b51f26c221e589bc80350b69c163abfab2de64f7e9b3e72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515266, "uuid": "f9851bf4-5c06-4493-bfd0-f8173274e777", "comment": "Malware payload (Stop)", "value": "bd21cfaad543e6f593218b32a6207d7ea96b0062", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515266, "uuid": "80407a17-5fb4-4fa3-98ca-ed44d21d9e70", "comment": "Malware payload (Stop)", "value": "6d4a4e4d4363a37a168f4c19399cd304c3bcbca27c7e2833e9690d29f5e731008c84bebefb055ff6aa72d2ab1e2f18a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515266, "uuid": "b70b5299-2111-41bd-8d77-80fcf292e506", "value": "T157F4122072B1E123D5E24970DD788AB02B3BBC626D74B58E72873B0F1D721CA7569393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515266, "uuid": "35283469-a8d0-4eb5-8097-40fa0dc8e4cf", "value": "97bf1f0575aad20ea6d291ede0d6d0ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515266, "uuid": "a4ae622a-d8c5-4af6-8185-c28320bb54ed", "value": "12288:oXGqZgAwKZhnMnbRuvpldkqQWzW69r4a24thzFvi+kVosRDNikz1ibj+AQOXV:oXGdAwKZhnMn90Y2qW924t1FviZVtR0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626515266, "uuid": "0fc82020-6b59-4f19-8b57-81b7c751e26f", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626515266, "uuid": "a77f6e49-6bdc-4c7d-a264-9ef42c801986", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515266, "uuid": "5a426887-30cb-4fab-b824-1bdca5fd526d", "value": "133c316394311ae70d18116165d1e719.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecd12ef-e737-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626550922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550922, "uuid": "b8e77296-2500-445c-ab55-2290f8cf2bcf", "comment": "Malware payload (Mirai)", "value": "43555cfb06587dc23156ab55241ffc73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550922, "uuid": "a170af03-60bf-45aa-affd-c715055d0f0d", "comment": "Malware payload (Mirai)", "value": "84f7af5ea3ee781ce312b065ab9f9a1f527f1bf8dc2a8e3d180257d51b0012a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550922, "uuid": "d26bfe97-1728-4b7c-a6ce-d05c9edce87b", "comment": "Malware payload (Mirai)", "value": "2c47cfd73645ce24e203bd65d9794a91092c3f51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550922, "uuid": "6b63473b-834a-4450-802d-6c790e8229fc", "comment": "Malware payload (Mirai)", "value": "ee28a43cff27438383f94257abd888f792ebe83232162b669bf1d407bcff354cec188edf2fcd70f448a3867fc9366955", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550922, "uuid": "8fc5bf87-2352-4a46-ba4d-bde60c585679", "value": "T14E737D01B31C0D47F5A72EF0393F2FE183AEED8011E5A544790EDB869172E72598AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550922, "uuid": "ce8721c6-eb4d-439c-ba2a-e1fad2ef3267", "value": "1536:r031R/r1C0FWtomSsMP9giHM74YGanMbWKx0Kpkx:r+RMr2ssmOhYDdqax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626550922, "uuid": "1524ca4c-9121-4a55-b079-b643af51e4ac", "value": 75220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626550922, "uuid": "6c51cbed-8f48-45d5-aff5-19f576fcfcfa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550922, "uuid": "db570ffd-9f83-43d6-920c-4b35f3a84a98", "value": "43555cfb06587dc23156ab55241ffc73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae34ba0-e729-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626544902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626544902, "uuid": "478256d9-7387-4676-96d7-65a05c9871c8", "comment": "Malware payload", "value": "1afd1322dc9b3c3c3a952da37cdfa645", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626544902, "uuid": "7909a4a5-adc4-4aee-a4d3-e49f3ee76a76", "comment": "Malware payload", "value": "884a1949638e54c76eb0ee548d3a23b4ecf29aba47408564d379fb2dc6cdef92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626544902, "uuid": "2226781a-d462-439a-9983-f898c9c6cf65", "comment": "Malware payload", "value": "4ecfc61937f74c20b8eefb8da8eff1cd988d1b6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626544902, "uuid": "392236f8-ff65-44ff-b85d-97b52584e5bf", "comment": "Malware payload", "value": "0e34b89a2976cffd92e7c0f7f60e891829fd80f7676544c73858ee8b078588819e5d7d7c2bd42d8d240d1a0d41da9bc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626544902, "uuid": "1780075f-dc9b-4c79-bb7d-797f6ff9590a", "value": "T1F624AD1272B0C433D6E60A705474C6B52ABBBC3A6A30754F76973F1F2E312E1B566392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626544902, "uuid": "0351510d-2242-4025-bcf5-b470e46e217e", "value": "4c2cb70eaa36e2f27e3da0ec1f2cb347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626544902, "uuid": "5d719000-4509-4217-8bf9-c013649350c5", "value": "3072:76x13Sw/MmJ67nK/ng7u7JpTxR8huCGF3/pJaDHUZ:7YSyXwK/lJFj3BJam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626544902, "uuid": "3c3749c6-a679-48bb-b26d-8d73d2ca6047", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626544902, "uuid": "8b667bba-386e-408d-9f6f-3dc088d32a3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626544902, "uuid": "f4dda82f-1788-42db-a826-d7303a5e6e3f", "value": "1afd1322dc9b3c3c3a952da37cdfa645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e2801a-e737-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626551174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626551174, "uuid": "e2313ed2-0520-4b61-9be3-727ab78f9b2e", "comment": "Malware payload (Mirai)", "value": "58f84e102ced4bf5a8c42958c8eb4240", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626551174, "uuid": "82f25eab-462b-456e-9547-d2391092fd99", "comment": "Malware payload (Mirai)", "value": "893020198d9b6e7dc8d520b8b1b2c42c1fad89844c6bd6d094dff1870259e8f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626551174, "uuid": "5fef7219-7cd0-4309-941d-9939d2351c85", "comment": "Malware payload (Mirai)", "value": "4a48915f5cdd0429ce59f56e248ccff757c11e07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626551174, "uuid": "04092a66-cc58-4351-95bd-1293656d7c76", "comment": "Malware payload (Mirai)", "value": "0ea754d9f6c9e0193e3602a336019dabd5ad925ea646dee08de1e7c39fcf9fbf64497be34c84f99168067ff4ca53bdee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626551174, "uuid": "f7c08b3b-31d9-4a62-8299-f983226244a1", "value": "T13A93D50AAF611EBBD86FDD3306AA0B0634DC555722A93F257634C528F61E64F0AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626551174, "uuid": "4249e614-84ba-4cd3-83a4-f6dbe787f1e6", "value": "1536:TcizN5U1BwGYoyAiJL5e3ZFBA8M1L2pvMYW1OSKNg:T3puA5e3VXEOSKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626551174, "uuid": "9943e7a7-231e-4c18-bb98-94036e83497d", "value": 97160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626551174, "uuid": "480a3ebf-cc4e-4d87-904a-0dc55b065468", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626551174, "uuid": "fd2ff018-6092-429d-96db-934a389dc9d5", "value": "58f84e102ced4bf5a8c42958c8eb4240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fb34d9-e717-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626537546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626537546, "uuid": "ede51a10-b4da-48dc-9b04-b01e792b697f", "comment": "Malware payload (RedLineStealer)", "value": "be3975e872adb57b05477f2f2c7c5e39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626537546, "uuid": "30ae77b7-ff51-4c92-93cd-8dc9bf82c7a2", "comment": "Malware payload (RedLineStealer)", "value": "8981f674828af4982d8838885ab4c4a43d949180fb9822d1f1c588c67dfe7e0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626537546, "uuid": "aef28910-d84f-430e-b16b-158dcfac2c32", "comment": "Malware payload (RedLineStealer)", "value": "619ae836ad78ab9f22ae3b427c75baefe261dbb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626537546, "uuid": "ecbc9906-b3a1-456c-8a0f-25b183645ed8", "comment": "Malware payload (RedLineStealer)", "value": "dece39382fb0627be217b8a9ac7e9ff9e0dd69e43317705f3a913a98f56b355887883de9f8a99d48da93a75d60d311e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626537546, "uuid": "205270e7-2e6c-4250-a211-e644fc665253", "value": "T12284572868BFC05985E3EEA52DDCA8FBD89A55E3640C743701B4633B8B51B80DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626537546, "uuid": "d5ac8887-a476-417d-b0eb-09ee9f13cd50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626537546, "uuid": "e849af29-2cfa-41d3-9c6b-94adb3480f60", "value": "6144:M+UmajpD5pgD7YzFaE2xxkk8sbS8ur78f94n:M+UmatD5pggzFaE2xxkk8sb5ur78f94n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626537546, "uuid": "3760dd0c-8e6c-4ca7-a97d-a53b41d0c909", "value": 382344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626537546, "uuid": "3ef5e303-8137-4cfd-9a94-9f91bf52ed37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626537546, "uuid": "2f50a462-b4fb-479c-a9b3-2e6ffed7456b", "value": "Collapse.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812f24be-e728-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626544671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626544671, "uuid": "da2d3f5b-0583-497f-9b8d-ced04a530929", "comment": "Malware payload", "value": "cc5e48eb9cf7308dedf57d5e468e836f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626544671, "uuid": "347bbf9a-b384-4573-a3e8-7df1235bf3c6", "comment": "Malware payload", "value": "8babde64a6d3b85c2c4315205ae58884ee01f6364477a777f09d5b9c3ceef2a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626544671, "uuid": "43668b32-68ad-484b-ae90-b5d75b9dcd21", "comment": "Malware payload", "value": "d163e441046697c5f91f714ae4ea1056afbcfc73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626544671, "uuid": "4e477612-931e-48ff-a835-199da4e20ccd", "comment": "Malware payload", "value": "1e6630bf0cad92e8b8889cdf13ef92a612c56d3a7b0e43e9c592defa2b09125a11c2f5f7bca2e3ccbf78a8c0ee6b8dae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626544671, "uuid": "694639d4-94a1-4265-933e-620dd9716d6d", "value": "T14254CF6132B0E433D5E3097054F4C6A0AA3ABC322B64B64B76673F1F1D726D1B5A6393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626544671, "uuid": "d6f8fc56-08db-4315-a649-6f60464e124c", "value": "4c2cb70eaa36e2f27e3da0ec1f2cb347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626544671, "uuid": "8fd91855-7e27-4edd-bce6-a9a02a8ac54d", "value": "3072:IRYVlZfwzT8EGJOSQ2py3d2Rv604eqpkDcCQcAf7b0y1bwIHYtTV6GhuCGSI/pJZ:VATtGA2ogRZ4gCfn0ycqlBJam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626544671, "uuid": "4cd7b8c6-ef45-4bfd-9754-8f75c3c6de84", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626544671, "uuid": "1a8d22e9-5877-461a-8208-7e162b6a6ee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626544671, "uuid": "0bab39e4-5350-4258-a654-8f4f5edfd028", "value": "cc5e48eb9cf7308dedf57d5e468e836f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31736a20-e74c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626559999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559999, "uuid": "7596968e-e61f-4b08-8898-86169a949ca2", "comment": "Malware payload", "value": "5828a92e50847f773904e85878f2fc6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559999, "uuid": "ac2c0f80-e735-42b1-8a20-72a356a58ef1", "comment": "Malware payload", "value": "8bc0620aa9e06ff8861c9cbba4ea13329b42b13fe35c9ba35c30580cf27068b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559999, "uuid": "c547dd00-546f-49f4-b0e3-98972e9c91a8", "comment": "Malware payload", "value": "33b4001d291e40fd950e36f3976e99dcef2327be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559999, "uuid": "ba755bfd-f59c-4551-823a-7d000ca86ebe", "comment": "Malware payload", "value": "ac00ea822b6c8cacbc911d5fda683fb2163f808e977ab9a039d5dd5622cfbed75c6f8fc32e430029a24342aada8a1104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559999, "uuid": "45eb82bc-2d7a-405c-b386-fac029e2c638", "value": "T11D52830173E80225F1F79B797ABA1209CE37BE5F9952CD6D344C500E6F31A4189A3BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559999, "uuid": "4b0eb8f9-994b-4bc2-8400-5129e96e3cb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559999, "uuid": "1e9c93a9-5aca-47f0-907d-a0748cff9ca2", "value": "384:IQE2qRnwQ4Dh9c95t5KmbZS+uJGxoptYcFSVc03K:RqZwQ4Dh9c9X5Rb7nx8tYcFSVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626559999, "uuid": "7c30da03-906c-40cd-9607-cc04be724b90", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626559999, "uuid": "3cff804b-a061-4025-8480-1d2cfae97289", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559999, "uuid": "62f876f2-2af0-4b10-844c-e05a47b0a247", "value": "injecter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b23e6e8-e72f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626547614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626547614, "uuid": "565009ca-69fa-4371-8f17-eac87ca4ad84", "comment": "Malware payload", "value": "bfe434f1b9025699318b22e3cd682d0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626547614, "uuid": "b8eb3a8f-f2c8-4d91-9957-9710fae1dd20", "comment": "Malware payload", "value": "8c281412e64050c64d1e734d844ecc6a94e7187378365d5d9ade89e67871d20e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626547614, "uuid": "1e46ced4-8ed4-4f55-a37b-88a5e0c05715", "comment": "Malware payload", "value": "3e4c96cd6e9aa227e4ac95fb4f31cdb952933883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626547614, "uuid": "b4375a2f-97d9-4358-a890-d2acebedcaa2", "comment": "Malware payload", "value": "29752c34d2af86ae9d65fbfdd6380ce217d149fed1023224cc47a2ca489aab0318324e387495366fe3868e94bf89dc5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626547614, "uuid": "238e2439-c9d5-4d44-98b4-3d22b8142ea7", "value": "T1CEE35CE6238C5AC9D046BDBD8B35B777E0AAAC731F12C044F5622FC746345A98F14A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626547614, "uuid": "7898c845-9708-4d7d-8b3c-ea0f276832d8", "value": "3072:8/caF9qoDTpJYzth+DhQ6GUiT9MJT7Hm1cjg6bbpa4X59WKFz:8kjKJchAQ6GUiqHHpjgIag5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626547614, "uuid": "f4178bee-4727-468c-b09b-4b24bb6c9b5b", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626547614, "uuid": "3eaa4a4a-0427-43d3-8e28-16a32c578675", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626547614, "uuid": "46617f0f-8c75-4f65-b8f8-c49dc01551fb", "value": "8c281412e64050c64d1e734d844ecc6a94e7187378365d5d9ade89e67871d20e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de4dea7-e717-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626537337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626537337, "uuid": "67fda3c0-f18f-4ebf-b066-e781db7b867b", "comment": "Malware payload (RedLineStealer)", "value": "ca8c28106ef4cf7701356bd97e2ebed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626537337, "uuid": "0e988c88-4bd5-47d4-be6d-d7d25c9ea111", "comment": "Malware payload (RedLineStealer)", "value": "8c7964362c125bf14139540436ac14612f600b36b92fe85f5a63cbf0090ce3d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626537337, "uuid": "85414f68-f9ec-4128-ac33-e8fb497a3366", "comment": "Malware payload (RedLineStealer)", "value": "be2a4ae8f81547cefa42d31234df5f69555a3ef1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626537337, "uuid": "20ce30ef-a952-4867-a290-4786361f5de9", "comment": "Malware payload (RedLineStealer)", "value": "78a6d99f87afca14fc688918a72f434afd9a2424088dd9d411a4c36ad2df40242b29758c2f6a1ea374afca66b51ceee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626537337, "uuid": "e4041d85-910f-441e-b391-8c087a4c4ec8", "value": "T1CAD533013BD294FBEB12153859882FB5E5FDD3CC52104DDB3B90EB494F29896D03A9BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626537337, "uuid": "b2de8df3-dbaf-4d1c-80f4-3a48b2e558f8", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626537337, "uuid": "72f49d5b-ccde-43b8-9d17-77ed659024f8", "value": "49152:xcB4PkZVi7iKiF8cUvFyPSwCg9yp4GuMaMUaCG4pfwd25XQhGTEwJ84vLRaBtIlK:xOri7ixZUvFyPfCpptv79C3poiCCvLUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626537337, "uuid": "f194505b-9532-4272-ae48-7a1254a05436", "value": 2765521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626537337, "uuid": "2887fd51-49f1-49d8-a191-a553b672b9c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626537337, "uuid": "ebd03694-9b7f-4977-b3a7-575f021c7e9d", "value": "CA8C28106EF4CF7701356BD97E2EBED2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc48d62-e713-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626535831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626535831, "uuid": "41ba15bd-f361-4176-860e-4adf16e28b95", "comment": "Malware payload", "value": "7ec8a9641d7342d1a471ebcd98e28b62", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626535831, "uuid": "4c7975b8-1dcb-4dbb-90d8-d536e06ea96c", "comment": "Malware payload", "value": "915ad2650186cabd48befae7e195783e5b3bbdf38f0b4af9e0a9e73726779fa3", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626535831, "uuid": "d8c71e28-2163-4c9e-aebf-92056b33a619", "comment": "Malware payload", "value": "25cf8ebd4667b63df880e51744c98df51be374a1", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626535831, "uuid": "1c192f85-d82f-454c-b31a-b894c4f80fe9", "comment": "Malware payload", "value": "5077773f53987ca33398c41f85e8ed49d48020615010489e81776d9c8f1a70416daf17bf89b39216dd5f25a2a722a815", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626535831, "uuid": "ddab3523-23c3-4813-a84b-18f1bffbb173", "value": "T157E35B2E23C446EACC1AD2B4EA661617F272B4921F60933F0360DA7A0F27B71F52D755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626535831, "uuid": "60320849-9b06-4f4e-92bd-e4524ab3fbee", "value": "8022f449574d9ee2f724dfbd2f02e754", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626535831, "uuid": "fb9c5bbb-f1bb-4dd5-8012-fad0d9cc6e43", "value": "3072:VI2CFKWMb/jgziQfYp8SU2CpDRJX9i9f3bFma1Hb:VIube2eX9i90ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626535831, "uuid": "2ea1b020-5c2b-4afe-92d0-6f94a4cb7ce4", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626535831, "uuid": "fa5087bf-b93d-4853-936e-2c761c9019b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626535831, "uuid": "1e676076-90e4-4a29-ae93-00b34b9075e6", "value": "915ad2650186cabd48befae7e195783e5b3bbdf38f0b4af9e0a9e73726779fa3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e438393-e722-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626542009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626542009, "uuid": "43eaeafc-f87e-42be-8474-e628cb69585e", "comment": "Malware payload", "value": "b4b6891aeb21106225c1fb69954f859b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626542009, "uuid": "f4566fd8-af19-46e4-bd51-617780d779a4", "comment": "Malware payload", "value": "92c79201b019efccd41eaa985d94ad4fcd4989c2023d323f4cdcfe359e3a5433", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626542009, "uuid": "e7ca74a6-7426-4169-9e9a-d757b4d1ac6d", "comment": "Malware payload", "value": "acfc04bdc9e5663956146b9295c31ac9de0e9502", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626542009, "uuid": "3733d0be-f04c-4fb5-8915-781c2e9f78e9", "comment": "Malware payload", "value": "f81cb6ed40891c9cdf16ee499a474885c60692e767977a7e8919610a4d7ff8fe0ce0147a9b947f4dc588e4ec7c7d00ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626542009, "uuid": "fc63b348-7114-4427-96e9-abd734c85d1d", "value": "T170B4F11131B1D533D2E25A709874C2A01A7BBC226934754FB7A73F2F2E362D0B569397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626542009, "uuid": "142a1d6a-ad3a-4af8-af29-ec76033a6385", "value": "4c2cb70eaa36e2f27e3da0ec1f2cb347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626542009, "uuid": "3fa5fefa-1675-4775-81bb-a51efa2dba0e", "value": "12288:2ZbgJP+Ra+fS/ZkTSW7w+HCEvPLGZvUFBb/H4heNfq+IBJ:IsIsJ/ASAw/uDOvUFF/HM8fqjBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626542009, "uuid": "4626bdec-93e0-43ea-bab0-6c277dd0e717", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626542009, "uuid": "b4bb765d-86e7-4267-8e67-76594645aef8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626542009, "uuid": "7dff8dd5-1ab7-44ba-9421-49c6e162cdd3", "value": "b4b6891aeb21106225c1fb69954f859b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4139a183-e714-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626535974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626535974, "uuid": "33477c56-3004-48b5-9c09-4092c27068cb", "comment": "Malware payload", "value": "f54a29234eb253f3cfe6d1686e018c6d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentMoon", "colour": "#B1B0D5", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626535974, "uuid": "8fa0327f-cb11-4683-afc4-c945af43bc92", "comment": "Malware payload", "value": "94421ccb97b784c43d92c4b1438481eee9c907db6b13f6cfc4b86a6bb057ddcd", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentMoon", "colour": "#B1B0D5", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626535974, "uuid": "76fdc16b-9f05-4490-a579-8743dcd156e9", "comment": "Malware payload", "value": "68e4c75d8596e674f77cf497b2bd80956bb849c6", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentMoon", "colour": "#B1B0D5", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626535974, "uuid": "60b8da07-e70c-43ae-aeab-2e27d71d5f6e", "comment": "Malware payload", "value": "88533ebfc1f5a198e54cb5e936403303cb17ba69d145d276eb4309fe945cb8daf634a614257af06ea26d34c525ce8589", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentMoon", "colour": "#B1B0D5", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626535974, "uuid": "b5270ba7-3d69-415f-854f-56f2a7d70cbd", "value": "T19B431A179D824D57D7A901FCA0EA49AE95BDF8B6132094D79A641FDA2EE03F048F03C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626535974, "uuid": "8ae10a27-cb91-47b8-ac04-4958008c2c7a", "value": "6a320d2c5fb51ca393771d060d34701b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626535974, "uuid": "32a19599-5c0b-49a1-bcea-989a3f4347d1", "value": "768:oXDzmcPUJqOyVUaWRBrA0lbLQPfogBWdUhKeTDpKLt+0bD23ACjDEtdV:TcPUJqhnCv0ddp00I8xwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626535974, "uuid": "98dd2ff8-3a86-4a10-9145-ee89f4002bd5", "value": 58608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626535974, "uuid": "9f80501e-bdf1-4cb8-a3d9-92ee23fd036c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626535974, "uuid": "806ef835-ec5f-498b-85d6-ec5b405e4403", "value": "94421ccb97b784c43d92c4b1438481eee9c907db6b13f6cfc4b86a6bb057ddcd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a1fdb9-e71c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626539547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539547, "uuid": "0e8a8e09-ed53-453d-8f7f-3af83b318103", "comment": "Malware payload (Mirai)", "value": "a0cf10921fdafd32c324a6f930ed1fd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539547, "uuid": "2ea31065-15bc-4e9b-8ee0-8eb81697ee1e", "comment": "Malware payload (Mirai)", "value": "94e23bb7414a2047bfb80705fe328ad7136be2534f17d2af265703b6f307b9dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539547, "uuid": "0cf910c9-fb55-476a-a512-57e21445f12d", "comment": "Malware payload (Mirai)", "value": "94b6b9d58adbcae72bfaed258d5f896711906c8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539547, "uuid": "2e127ed2-2f30-432a-9a52-e82c60a5009e", "comment": "Malware payload (Mirai)", "value": "71bfdc61c48bbf9e63c7c489b6ef4db2aceffba771efd7373b8a0268620855ac6f854a6f1de469cae071e583af81c476", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539547, "uuid": "48811c49-144b-4dfa-9d71-4cd4017b438c", "value": "T1EDE34A46FA418A13C4D52776BAAF42893332A794D3DB730799189FB43F8365F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539547, "uuid": "06904b28-6610-40b0-bcf6-4eb64c304e8c", "value": "3072:fA32MrUmhGqRJ4OP8AMD2FYjEflNrHZGj082rAGQafLVzM/9mNWMiKU:fAmMQmhGqRJ4O0AwcY2fHZGj07rOafLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626539547, "uuid": "9f5a44f8-1365-44cb-8a7f-c21e57bbe41c", "value": 149790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626539547, "uuid": "4a06f672-40ef-4bd9-a0d2-cce9015b8567", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539547, "uuid": "02c6bcbe-05eb-431d-abe4-547f10acca3c", "value": "a0cf10921fdafd32c324a6f930ed1fd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42ee374-e6eb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626518531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626518531, "uuid": "95322d7b-b667-4d67-b7a1-3a977764fcf3", "comment": "Malware payload", "value": "a1bb900ae8003b924f333442c4117a84", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626518531, "uuid": "bbf8025c-48d6-4294-973b-f330c1d5260a", "comment": "Malware payload", "value": "9c5912424f920b71a98b0ac032cb3e74ca830dd0c9e9e2d406f4b9ff1f53af80", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626518531, "uuid": "d6853904-9303-4fce-b841-4baee309a2ea", "comment": "Malware payload", "value": "126cd9e2de926ade2cdb20fb8d2a059b7786fde6", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626518531, "uuid": "57eca200-d5eb-464c-ad82-7b287492b511", "comment": "Malware payload", "value": "fe0b4c6eea16062b6155811973f1bf52332a5fedf459c27b9fc4237e9791379a5b72fb88e122f718c1eb0637380b5c57", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626518531, "uuid": "0a56ffef-f225-4310-9d65-af645497e410", "value": "T129240130B7A49621E1A76F3496C4934FA615FCC66C4DC18F21DAB36B3B3424CE55263E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626518531, "uuid": "fcbe7635-a46c-420f-8976-06374555836a", "value": "6144:0xf4yOJ0ClS6p9gHS3unAnkw5ZKZCDrEwzq:Ow3iCl1//3vkaZKZkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626518531, "uuid": "58b42c15-8bf1-45ba-bc44-0787971a8198", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626518531, "uuid": "76e4bb5f-5026-4329-ba8a-43a7e3042b95", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626518531, "uuid": "7e75ab18-c3d0-4ecd-a3f2-ac61724cc31a", "value": "SecuriteInfo.com.Trojan.GenericKD.37243367.2021.2242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332e7a3e-e6cb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626504597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504597, "uuid": "accf92af-1106-4863-aae6-b1f650458216", "comment": "Malware payload (Mirai)", "value": "b643cdead4b4856998dc3e1bc4f106b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504597, "uuid": "302e9ae7-ec3d-4387-808a-4e730f775fe6", "comment": "Malware payload (Mirai)", "value": "9ddd4a39b22aacfadb195eac02868d1d357c3528d6e92e9d4f9a27b748a1b317", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504597, "uuid": "ad06d419-3e7a-48be-b7d9-de4f2ca27a3d", "comment": "Malware payload (Mirai)", "value": "e4698c8aea05f32a8f1ebf96746e0ea8d5d888af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504597, "uuid": "39aa3cbb-7053-4da8-a6e7-a91edf04d5d6", "comment": "Malware payload (Mirai)", "value": "fb0f0e63715c8b7d04c195c7a74ae75af2a8c7f0ce8e13bc5c20f8ca543f5c84a146b26146a706620fcd3c605cd6c065", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504597, "uuid": "4ba2cc36-c16c-44ce-8eb0-ef01205aad7c", "value": "T19943E991B8825A39C6D557BBEA7F018E3354A7D8D1DA7313C8240BA47ECA90F0D17F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504597, "uuid": "36566307-074c-45e3-9684-499c5c9547f4", "value": "1536:ClmoZRg6WLgdCKZaa6/QzZ0//HHV46+TAMC1JJmB05:CBZRg5LYCXaX10//HCfTXCxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626504597, "uuid": "3c861aad-a413-4a97-a6f9-f0a6bcf5246d", "value": 57128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626504597, "uuid": "8e4c9ea4-2b67-4267-b8b2-885300f9714f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504597, "uuid": "a099ba96-dfde-4d94-aa45-16ffec19c393", "value": "b643cdead4b4856998dc3e1bc4f106b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac79fcd-e71b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626539292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539292, "uuid": "b08ddb1d-75ee-48b9-8b4c-f1524a25d71e", "comment": "Malware payload (Mirai)", "value": "1d198bb166d423da8156495572471abe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539292, "uuid": "37304a6c-13be-4cea-8e8e-742c801d2462", "comment": "Malware payload (Mirai)", "value": "9ef8a2bdf168bede9069a1a87a5d4427249a15459d1bca5e98416e6c4e3c32ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539292, "uuid": "ad3676e6-b649-4440-ba06-f31a762c6b4e", "comment": "Malware payload (Mirai)", "value": "3dbd69f7630ad834d63a944371eca725ae7d627d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539292, "uuid": "52dac73e-f121-41b8-8657-e614d55771d4", "comment": "Malware payload (Mirai)", "value": "aaad46f6b0d4c49191d5bd6075045a18b61a64bfefe0841b857f67e2c5dad10ec5c97df17e839e3a3df50ed55d520486", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539292, "uuid": "ff5ff2ce-ddce-4a94-b228-be301cac67c3", "value": "T1B5534AD8E543DAF4EC0241703176FF338A32E2FD2169E6C7E3A15673B8566429A0638D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539292, "uuid": "9a191c1a-c0de-4590-8395-a31fa85115cf", "value": "1536:XMZ7vOLRfEq4dBlDrvUJvXkWe5HCqU8ecZJMyA4WrSeLAMPJJ:+OLFj4nprvUJvXc5C18rZRA4WucAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626539292, "uuid": "43321983-c0fe-4b50-8c0a-775d46bdb8e0", "value": 66352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626539292, "uuid": "427eba4b-e53e-4e70-983e-cfc1a86bfb1b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539292, "uuid": "254a85e7-b24a-4cd8-bc48-bc00b5b9b1dc", "value": "1d198bb166d423da8156495572471abe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1291adff-e70e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626533319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626533319, "uuid": "b0878b7d-3c0f-4c56-85fc-9ba89da644c3", "comment": "Malware payload", "value": "af9fde69078e906d628f5c04fe4ab11f", "object_relation": "md5", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false }, { "name": "toddler", "colour": "#7A8967", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626533319, "uuid": "ce8f5184-8a7b-4099-b4fa-85bf6adb922d", "comment": "Malware payload", "value": "9f2d916b1e0ee486f5a49e3e9887eae59dbdca0a554139ae9a4dc8edc2f12de0", "object_relation": "sha256", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false }, { "name": "toddler", "colour": "#7A8967", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626533319, "uuid": "ae594c91-c129-46e4-83c6-f4d5c30b2ae3", "comment": "Malware payload", "value": "6607baef8a3f4d0a077b8d38eea4afab4b8e9c5f", "object_relation": "sha1", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false }, { "name": "toddler", "colour": "#7A8967", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626533319, "uuid": "ba66d8a9-6b8f-4121-81dd-009964ba9952", "comment": "Malware payload", "value": "0f5450bc1892f45bfe91bf1c6f36f84fe0d17f391cc7c7b904b8a21f3c8041c82d7043340415c5c02f5f70b291cd7d95", "object_relation": "sha3-384", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false }, { "name": "toddler", "colour": "#7A8967", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626533319, "uuid": "5162ebcf-baf5-4933-9c24-eb0f0c270136", "value": "T164D533C17BA7EC0AC25BC5391CB0D44AB705A3BE8140D90A46582D27F5FAF89574BF8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626533319, "uuid": "ab2601c0-a7a2-4308-8312-29868e916075", "value": "49152:CdB2WK9IVhZGa7+o4Dmu1iAYOSMA+418rU4+xVRgOd35UZJlTn7C:CdIxWVhZGaCoCiTrU46UPhlO9TG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626533319, "uuid": "0a1c47c5-c66a-4928-8aa9-6b2bd88dd4d9", "value": 2896783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626533319, "uuid": "234fe976-7cb5-4adb-84b3-c12bbfb97b48", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626533319, "uuid": "a105e6c2-ad9b-4b93-ae50-9b5ff80b71fc", "value": "9F2D916B1E0EE486F5A49E3E9887EAE59DBDCA0A554139AE9A4DC8EDC2F12DE0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ab34a1-e71a-11eb-875b-42010a9c0053", "comment": "Malware payload (Amadey)", "timestamp": 1626538849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626538849, "uuid": "22ace7fb-041c-4c51-9455-aad93ed9d990", "comment": "Malware payload (Amadey)", "value": "2964ea014ca6c3770dd7e28339348eb7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626538849, "uuid": "c74b7be0-f63e-4297-8cc8-44c62d4c6734", "comment": "Malware payload (Amadey)", "value": "a1b0074cbd56956cc94e6161361f8f7407075f2903d14d082c1006f411bec90a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626538849, "uuid": "03926d3a-d7c4-47d8-a0f1-3c2d436afae5", "comment": "Malware payload (Amadey)", "value": "902189db5fd7ac729c24e06bcdcb24df589e8a58", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626538849, "uuid": "58ed7767-1df8-489d-9814-d015ee1eaa29", "comment": "Malware payload (Amadey)", "value": "c8faf1cb2509ac2f60271d7f68741b68714999a92d2d8d88f8e46b07116880f60100af1ed4ab366bc0dbebaadc3a323e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626538849, "uuid": "eae14ee0-878b-459d-9634-86b458b91584", "value": "T18E44CF2036B0D433D1A34A70D4748BA1663BBCE36A74B54F72572B5A0EF22D2B967353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626538849, "uuid": "26d71267-1258-47e4-a5a6-434ba81ed74b", "value": "88e0d4240229a67a4a3fa07eaa1c2b10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626538849, "uuid": "6e53f684-235f-493b-bbc8-0de472739f0a", "value": "3072:9vh1y5y//Ld3cYosuUZcFeVMZF5qG6SH+p8r9w/NQY7tQ6qhuCQ3WxiME:w5y/zd3cauUMsbZ+X9eQeJb37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626538849, "uuid": "c61dd3e1-68a5-49ec-9835-38933b85735d", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626538849, "uuid": "50cd4d80-f509-4124-a34c-c29213f7e4b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626538849, "uuid": "bbf8e4b5-b943-4cb5-af97-68c717a63761", "value": "a1b0074cbd56956cc94e6161361f8f7407075f2903d14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005eae06-e71c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626539301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539301, "uuid": "caf023ff-71d2-4c50-a43e-ce641c4951ed", "comment": "Malware payload (Mirai)", "value": "b55d7e7ceec1836f0d1c491b526430f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539301, "uuid": "1a2f6a31-1651-406f-ba83-dba72835b4a6", "comment": "Malware payload (Mirai)", "value": "a2d27cdb2a908b92d99c4b108993c7f527fe42833dc92502569b913af8a4424a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539301, "uuid": "4e41fb01-2f9e-4dc1-826c-860d51be6b7b", "comment": "Malware payload (Mirai)", "value": "44ff8a14b5ce0221255aa01bab180a127e54de8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539301, "uuid": "befd1cdf-85b3-4c34-8e11-d5cc892f8065", "comment": "Malware payload (Mirai)", "value": "a7a84f6da588ea5314c53343b53283d9a972c42d8f41824773998a1f20a04599cb5875861ecbf1ccd60a942fe0ead5dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539301, "uuid": "ba9908ca-e33a-4c8d-be6d-56c05d90b230", "value": "T189637F3AD42B5A60D087853074F88E741F23A1C597666DB75BD28AB30463EBCBE44FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539301, "uuid": "bbb91fa1-b915-436b-8fa6-efd7d6ef7192", "value": "1536:alOwtVcZkFF6aZ3jw/vFEY/cPb3XoTgvfC9UvE:alORkX6UjuvCF0Tgvff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626539301, "uuid": "a658b02b-7121-4d70-a718-b10b114b796c", "value": 67152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626539301, "uuid": "c5f28116-b7e3-4099-a5c9-4ae2c7926fc2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539301, "uuid": "65f528f9-bac8-4fa2-894c-131722b10481", "value": "b55d7e7ceec1836f0d1c491b526430f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332bc08e-e731-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626548406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548406, "uuid": "f674c72c-db00-4788-aa5d-1f4ed2c3ed03", "comment": "Malware payload (Mirai)", "value": "42591ef410ec398aaeac4b8b5677b915", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548406, "uuid": "fd9e969b-d547-4805-8a92-40e581475fa4", "comment": "Malware payload (Mirai)", "value": "a34ab2b9caabc502987be8bfe687fe9aca6d462a12932bb7b6c029a7cf6bc9a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548406, "uuid": "154d7d88-f09f-4cfb-a859-1a44fa689fb3", "comment": "Malware payload (Mirai)", "value": "4c3296a100172bac5ba41b8e3e4ed850bd8fa4fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548406, "uuid": "3491a965-d35b-4235-8243-7788cca76e33", "comment": "Malware payload (Mirai)", "value": "c27d2817c0ad168ad277e11e0c0006cd3c9714c95154ac59ac95e266e3815730358bb86ed46fc4cdacacf87c421b6c9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548406, "uuid": "ba3945fe-375a-4c26-90c3-bc8fb32accc7", "value": "T1AB134BCDF583DEF9EC11067230BBAF7297B6D63F2054AA86C3D9D972DA46502A10630D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548406, "uuid": "a014612d-1e4d-458d-b39b-3ead173b11ca", "value": "768:sXKliE6ZJAlx0CKITPhutaA3/VsKDotNBGB7bkdi:mAiE6ZS0OS3bDotNBi7bkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626548406, "uuid": "fb5f92a9-ebe0-4782-b0b9-940aadc67fa6", "value": 43504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626548406, "uuid": "7fd825bd-0c10-4c77-a522-0dc061e545dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548406, "uuid": "e4844b57-444f-4a9c-b8c5-294d90409f5e", "value": "b4ngl4d3shS3N941.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd71af6e-e730-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626548235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548235, "uuid": "891a5112-d615-4c5d-aa12-fdeae8ca3038", "comment": "Malware payload", "value": "e3612d6ee0006451547cf0fc8e1bd116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548235, "uuid": "eea478bb-4cc7-477c-afa3-ace1647c3ee2", "comment": "Malware payload", "value": "a9db0687534d01246d1d0fe08563e4847fd765f20660e2b4f5aa17df0737c6bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548235, "uuid": "57e9e4a6-e20f-407a-9004-25c6db550f6b", "comment": "Malware payload", "value": "28f8c1cd9a18035d4b2fb4b407c9172a6ac24e7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626548235, "uuid": "57c1f3d3-e225-44e0-b74c-48f5b6742614", "comment": "Malware payload", "value": "3006632a27ed13f23db2340894ac23bb74b49a2be3fe2beb59a4a2423786aacd70b71d2824edc5ad12d889d45e64acef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548235, "uuid": "9f8cfcec-9d5e-44d5-942d-33fc2824d3d4", "value": "T1BE13D68CB694E174D5FF8BF1B4A2B2890B70A01B9912D30F99F154D94F73AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548235, "uuid": "099492c8-c8ed-4ffc-ad3b-2405f7448fbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548235, "uuid": "dfbc9c9c-f25e-4a7a-8928-b895daa71c59", "value": "384:5ZyCd2MOGVK725yGt8izzLEf/EdSSszUIij+ZsNO3PlpJKkkjh/TzF7pWnd//gra:bBcCwG/zLuomuXQ/oE3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626548235, "uuid": "aacc5cf2-93b2-4131-a8d8-ec71214897bc", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626548235, "uuid": "9af72f0e-e9fe-449c-b3cb-7391e7e0c9fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626548235, "uuid": "3c099d0f-93a6-423a-883c-c593b65ec88b", "value": "8PyVytHj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e65c012-e6e3-11eb-875b-42010a9c0053", "comment": "Malware payload (FormBook)", "timestamp": 1626514897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626514897, "uuid": "a3e203d1-1ade-4369-9bb5-d105a67445f2", "comment": "Malware payload (FormBook)", "value": "80626a4811180e34d67c64296b08f2bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626514897, "uuid": "b00cb0cb-3981-4bc8-aa3c-27593ef39dd5", "comment": "Malware payload (FormBook)", "value": "aaf51eb435ca7b4a2241a951e3e131d7e73fa9f7bab18ca026f9a4d080c9dc0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626514897, "uuid": "af1031e5-a435-40af-9c07-a5658d443328", "comment": "Malware payload (FormBook)", "value": "2f6f31a65cbbe330788335521d8475ecf9cbf8b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626514897, "uuid": "fe4ef720-4347-4306-b9f1-64f993ab598c", "comment": "Malware payload (FormBook)", "value": "20950ff523dcef795ace1dabd08327e507e3ddda581848c40906a0efb134910b73c2bf4d2d9ba3c49b797fe0179afaa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626514897, "uuid": "13af8da9-1819-4562-b1a8-a81f3d984949", "value": "T18BC4AF63B1A25833E1731E3D9C6B75AF992BBF103E24A8456AE41D485F782D13C2B353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626514897, "uuid": "959e9ada-67d6-4171-9914-fc9dc3f4edaf", "value": "28eccc7fd55aad785bc5357b324e2458", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626514897, "uuid": "b11fa1ad-b2a0-48cd-ac30-44d4e6f20697", "value": "6144:4zhJJJdTd8zUVHiB93U/77wYvmhHG/FAVF4QbUZkKirK70YEJIzu5Fhya1vilxgp:s7JJczUVHYzhH5zKeIir1KlqOeAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626514897, "uuid": "8cc84a91-8252-471d-be98-558e09260f8e", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626514897, "uuid": "d0105add-423f-4fd1-a769-96f96f7e05c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626514897, "uuid": "f6ff9e29-e918-4fd5-9a57-26f87b0dfa91", "value": "SecuriteInfo.com.Trojan.Inject4.14369.15008.30457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9843412d-e710-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626534402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626534402, "uuid": "56b30dde-dc9d-4393-9720-51e493113534", "comment": "Malware payload (AveMariaRAT)", "value": "c19da592366d6c173dee901add093e8e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626534402, "uuid": "cb4a7533-7d93-4023-9a04-8780fa5d6e08", "comment": "Malware payload (AveMariaRAT)", "value": "ab915bb1e45aba4cbbb762e4bac31510539b4a418d8466839bf6e4c1b40b87a2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626534402, "uuid": "f1dc78ab-ddd1-4b42-837b-b43c58cabf01", "comment": "Malware payload (AveMariaRAT)", "value": "ddd038c49bee36557cd203b581948e98a5e787a1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626534402, "uuid": "a40d98bf-64d4-448e-a7ff-44922db87a2f", "comment": "Malware payload (AveMariaRAT)", "value": "32086b35d035442e0a5046a356c59a1ab786e47195fc27955b7715f4bf8138c08a32c8de23e59ccda1938a1056d62222", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626534402, "uuid": "732c9ab1-5dc4-4542-afb2-7908949328b5", "value": "T14A31CB29D8F11762D776893A80E6E106C731BB15E993CF5E749C12CC28269C2B875F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626534402, "uuid": "ed8a9ef7-74cf-4b61-825f-5cff73c1506c", "value": "24:8R1m4kW8AoZ+/epeFxx6csDyJ4I0WUpE00zW00z5XQaR3+hab/0GGDtCGO+/efmq:8jFaiKcsDyWIau0F0UXv3KabwvO5pJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626534402, "uuid": "ffd17e3c-425b-42ce-ac30-d8fdb54a80e1", "value": 1658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626534402, "uuid": "aa60022b-cb59-4ea2-b8e0-63b7dc55f3cd", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626534402, "uuid": "63be458a-395c-4218-90f9-365f46cbc977", "value": "Booking.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc21be0d-e6da-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626511269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626511269, "uuid": "c05eef4c-8628-4599-a0e7-2f3f8e2f3a64", "comment": "Malware payload (CryptBot)", "value": "28032b139b5cd56d34239af205c7b8d4", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626511269, "uuid": "372cfd45-8a0b-4419-b748-595a460593ef", "comment": "Malware payload (CryptBot)", "value": "b3a99ecc4ab9f73d814f0f64a3aa0c71ee3cf94872f2f8ca3a2a1c5d630c095d", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626511269, "uuid": "151ec77c-6ba9-438d-9f34-4201d7ded9e9", "comment": "Malware payload (CryptBot)", "value": "1695a4f49f6a0555c9e6903c74a7836233a53fae", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626511269, "uuid": "a8dcc15e-382c-42dc-83fc-c98d399692de", "comment": "Malware payload (CryptBot)", "value": "edfd6a94781e7b23f94cff337ceff691fe1389c985713fac47ba079ad9d28ff17696efab08c82d0b5036619ff63958c3", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626511269, "uuid": "76376a51-6398-424e-bed9-d0ac43c55bd4", "value": "T13B95BB02E6978366D4A3F7F9395CFAB905A0AD3F430505C37371FECA29E9E818624176", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626511269, "uuid": "f66136c5-8ae1-4eed-98ec-8093670e5de4", "value": "524711ec9c5a149fe3bf3479d0b505b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626511269, "uuid": "93fe2e4e-78dc-4888-9dab-c593c90d759b", "value": "49152:sJlNDHyAvpd+5luqwtqAS9ot2vHf9pbd9kzvrsx:sJzHyWdWlizSyIvlpbO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626511269, "uuid": "9dba3056-ea86-42ec-92d1-f3f8791759be", "value": 1876547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626511269, "uuid": "3587ba79-380c-4337-ac79-a304b8b19195", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626511269, "uuid": "037573de-6016-4133-a419-0f5fcc2d8a4b", "value": "28032b139b5cd56d34239af205c7b8d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b303d61-e6a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626488853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488853, "uuid": "76d42eb8-8415-4be5-b270-c6e4d7aa5ecb", "comment": "Malware payload (Mirai)", "value": "96d07cff0b1a221a4ee3e4f7b4f7839e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488853, "uuid": "e9652b92-4206-463c-b626-14b6a444a07d", "comment": "Malware payload (Mirai)", "value": "b4ad1d3ca2b103a95b63720ac9493f20d89e9567eeb49c75021a31db6517f40a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488853, "uuid": "d4c8e7e9-ff94-43b4-9a70-51caadb8e207", "comment": "Malware payload (Mirai)", "value": "c646da529e069ed801ffac70cb9735ac48953adb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488853, "uuid": "cd33a440-d21a-4fa6-a2cf-22d20d1ac06c", "comment": "Malware payload (Mirai)", "value": "5e23d7e55f20cca8452c9173aa44e53a86385698950d3d4b50800ff1e8e80cd6fbeb6a7f1f3297ec48a0af03bc40a453", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488853, "uuid": "99f266cb-aaf2-4e5a-889e-1a7195163e5e", "value": "T1DA735C34A97E2F26C0C4A17E52F78750B2E5220F2AB4965D7CB20F4FFF24544A8562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488853, "uuid": "35bc583e-7ec1-4c8b-bb52-c16ba5ee2d3b", "value": "1536:vsnCSemCLLWeKNJ+1kbOSYcwC636v/bcYSZHFFi:rS1+SYcXv/gpxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626488853, "uuid": "326ed73b-fcdd-4e87-9b0a-e7ab7325482d", "value": 75388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626488853, "uuid": "81f34b4c-3d55-4d1d-a835-99e1fc7edd64", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488853, "uuid": "9809cf3d-af61-49a1-a3eb-6af8f25a262c", "value": "96d07cff0b1a221a4ee3e4f7b4f7839e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e1d672-e6b3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626494616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626494616, "uuid": "87a54824-6d3c-4d6d-b160-3f4a95894ef5", "comment": "Malware payload (Mirai)", "value": "bb04bea7e4aa46de583f8e44f65471d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626494616, "uuid": "0224c494-1644-4c2f-9d9b-0128ea5d1322", "comment": "Malware payload (Mirai)", "value": "b97c0c17add1abaaf5f39b8892ea7d91cb2ed18225e0d2e621569ece09023d1e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626494616, "uuid": "ea992b2c-406d-4868-a673-b9d651cd118c", "comment": "Malware payload (Mirai)", "value": "4733c0981a3a83d1f03f436dbdf83be00cf63aa1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626494616, "uuid": "f0396ec2-5890-4816-bd29-cc7615d0ecc9", "comment": "Malware payload (Mirai)", "value": "5eaabb0ca81c9807aaa4e0bfddee4b2f85f464e9ce41ccc3d3fa3c0eefbef2c28560a77a62d2642a9383e79eebbb3e25", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626494616, "uuid": "02b8e2eb-8fe3-42c2-9b03-f3b4c11709fb", "value": "T14E64F1CBEA01AC7AF9DA47B5696B0B0AB3F1DAC5D3C3B140E264C5443CBD6459B605C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626494616, "uuid": "d054197a-255c-45bf-8aae-887046e15139", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co9wPa5POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZnc6fPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626494616, "uuid": "83323532-7fa9-4814-94a3-7b8bdfa95eb2", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626494616, "uuid": "88fc0e76-4574-4c0d-a187-60e46af4b58a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626494616, "uuid": "d426f02b-46b6-4473-b992-cb1189a70e97", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf75422d-e6cb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626504832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504832, "uuid": "6dafc01d-1318-4571-a7e5-e4165c0bc3d4", "comment": "Malware payload (AgentTesla)", "value": "28932085303e002c23d6c77b4643f0c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504832, "uuid": "56efc6d7-fdba-4302-a3b4-aae220db41b5", "comment": "Malware payload (AgentTesla)", "value": "b9bdecad95f12652d5836428a1b1fe94467156f0d7c2743101b1350961da720c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504832, "uuid": "5c4a7641-f98c-40e7-9d5d-ad65f9ae909a", "comment": "Malware payload (AgentTesla)", "value": "9333a81930eef7f5fe68dc5fa755f3b18647d853", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504832, "uuid": "c11f1c1c-51a9-4535-9379-5639f478f0d8", "comment": "Malware payload (AgentTesla)", "value": "ab1837da807361c9b43a998f909902c4e3eb2a8d8e285dde56d48ab9472da6fd6adef34045b772d55398b49f1e4aaada", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504832, "uuid": "2f568e97-3e8a-4688-904e-1c40b878f2d2", "value": "T1DF251F3EAAA42A27B777D2644681C015F9BC41DB36395DD742C7698C390E8027EE7F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504832, "uuid": "b6ceba71-4386-4041-abaa-02f90f0946b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504832, "uuid": "0c1b7f5c-34d8-46ec-ad0a-d4671aab3e70", "value": "12288:L0B2xZ0EG3KQyTs4XlhyI/vbUDH1XwYJgDgeoQw7yATlGdwOCyn+gdbWh+EDyUZ:QPHSGogeoN+WGdwQ+pt2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626504832, "uuid": "38545a68-7ce0-48fe-af6b-c6c2886e7a29", "value": 1013248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626504832, "uuid": "8780450c-11ce-4226-845d-2f339d5c1dea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504832, "uuid": "ef0f2007-2a69-43a7-ae4c-4116cf2f1d5b", "value": "Lista de compras pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13de48f4-e737-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626550930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550930, "uuid": "51b6d342-0579-4692-a17b-63206c8fa7c2", "comment": "Malware payload (Mirai)", "value": "530b20a490bb07fbf8f20e1a5a14daae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550930, "uuid": "077d4840-aa0c-48c5-9d2c-6e8ea83c839c", "comment": "Malware payload (Mirai)", "value": "c36e135a36c65f09e58f181c3b3655217e398336e5ff82f8211e9bb4cc50b583", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550930, "uuid": "298746ab-3aee-497b-88e1-c67b65ab6260", "comment": "Malware payload (Mirai)", "value": "a59c52ccc77c5514908c94072a10321ca102d5ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550930, "uuid": "20e49d6c-0566-4ef4-9233-8e93edf4d3b3", "comment": "Malware payload (Mirai)", "value": "56561f05f1a5b7936541a56fb42d060595e0cf4e473acf14f657a5bd10a7f98687b419911fad2a88012d2a5a30c7ea7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550930, "uuid": "39bbd664-8bff-4621-8d90-b522046de56b", "value": "T151639DB2C9642E18D2598AB1F128CF3583639504A2973FFE916AC76DA443EDCF5183F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550930, "uuid": "9161dc6f-e16d-4d87-a566-de5c0b0d35c4", "value": "1536:k6ICOnrFOwlhO6xMmwo99i29r3mCriMXwKQ10cm8RK:3Aw2O6xMuL9r3mqXQMYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626550930, "uuid": "6f783bf3-5cb3-429b-8f88-bbd7416a64bc", "value": 66928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626550930, "uuid": "37980ebf-31f3-48a4-bedc-f73a5d58a6c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550930, "uuid": "f2991b2f-e508-4307-8619-1d1ae5e2ba8d", "value": "530b20a490bb07fbf8f20e1a5a14daae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8af421b-e6ce-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626506136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626506136, "uuid": "e545fcb7-56b6-4dfe-b608-1e14c57e29c4", "comment": "Malware payload (SnakeKeylogger)", "value": "87252a7dc3e57b82a34f1d27041e5ed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw 7vLHRD4IdanbLrE", "colour": "#FECD56", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626506136, "uuid": "0ff67597-221e-40dc-80b4-4770a07f360f", "comment": "Malware payload (SnakeKeylogger)", "value": "c39703a0644e67f2c3486446350a71c559d3f35414df73dbcde3fb731948eb2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw 7vLHRD4IdanbLrE", "colour": "#FECD56", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626506136, "uuid": "38f9fb3c-f1a4-4e16-a41c-0b5dc0079920", "comment": "Malware payload (SnakeKeylogger)", "value": "05b6ebe373e70a09f1bebde65413ceb31604d087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw 7vLHRD4IdanbLrE", "colour": "#FECD56", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626506136, "uuid": "71b1470e-4ee1-404d-8f67-67a6900bbb7b", "comment": "Malware payload (SnakeKeylogger)", "value": "1135825c2c6618979f3fd8e34b1593129c3d535eba83ed6aded16710055219a8a2904ef3724efc3150340f3a237dd138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw 7vLHRD4IdanbLrE", "colour": "#FECD56", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626506136, "uuid": "72f24adf-7350-4067-be34-0f157bfe387d", "value": "T147E46AA607884513C7EDB6B47750A6B5F3624D56FA00ED2B4AA27C83323F963D881CDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626506136, "uuid": "97aeea39-7cd4-455d-8f2a-9be0299fca5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626506136, "uuid": "8cb2a165-cfb1-48ab-8b2b-616cf773ce81", "value": "12288:I4GDK57wf7Pej6nzr7cdkQ3nW6JKctKKsn2C5:IngwD0CQqaW6J9k5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626506136, "uuid": "aa7b51cb-0b8a-44a4-8d46-46b501da55eb", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626506136, "uuid": "3a44ef09-7481-455b-98bf-6c072c365955", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626506136, "uuid": "703d35b8-9773-4fa1-af84-561aa848c068", "value": "7vLHRD4IdanbLrE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054293dd-e6e4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626515258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515258, "uuid": "f8f5ffbb-f236-41e0-a48d-ad285397f9cc", "comment": "Malware payload (Formbook)", "value": "bbd2f0585dc1db6e0765422c0caeaa29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515258, "uuid": "22df796d-9518-4c92-abb9-120c716f6385", "comment": "Malware payload (Formbook)", "value": "c422b04b5177a83b94f15e8bd6b8eca2e7e91a0c082b5035a7aa4b475e38688c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515258, "uuid": "90bbd96d-6599-4a36-8fb1-ef1d944a1bf3", "comment": "Malware payload (Formbook)", "value": "40dc9d381b4bc46b13f24f75b5969a3ed40b8de9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626515258, "uuid": "e7ed4d73-ed59-4515-b664-b4f37560d7c9", "comment": "Malware payload (Formbook)", "value": "da0fd78533b36e0f0de85113c5c2c6e7cd8f5becb26d03db7559b807908373d4a7a325956dbc45bae68cca89dee50eac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515258, "uuid": "7866237e-ea2d-4a9a-8a10-7173e5774e9a", "value": "T1C0C4F16D32187BAEC6BFDB78C5515C20A3F09137831BE74A5C5711E84C4D782CBA62AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515258, "uuid": "1f8795de-f09d-4a94-9787-59ccfce9dfa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515258, "uuid": "5e6c7c08-5211-4870-9b9b-6311ac066c42", "value": "12288:dufNMRpXE6y8M5hdDnzGkYVlF8ugF/2E7oY/kx0VJ3WzGgW9fV:d5RpXfyjvxnzkVlyF/l7o+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626515258, "uuid": "9f1e8875-6395-446c-a31c-824bd3afda56", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626515258, "uuid": "e1bc0bef-1f32-4152-a702-349650a64c5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626515258, "uuid": "4d38ae47-5aba-4fe7-90cf-e03ac53815f8", "value": "bbd2f0585dc1db6e0765422c0caeaa29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b72ae8f-e74a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626559238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559238, "uuid": "38b3824f-011b-4dd6-a256-e2b6a726ac0a", "comment": "Malware payload", "value": "c167093bea55b0d608771026ad477f09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559238, "uuid": "46f773df-7d3e-411f-ae38-a680b13884d3", "comment": "Malware payload", "value": "c656f26fd6fd3874b4c69f22ea00a93ffa93f75565d81b12ab4015723204a5a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559238, "uuid": "581eb167-a8a3-4cae-80b3-0645962b4a78", "comment": "Malware payload", "value": "5a9988a9a7a16600d7f09a6082bd9eb089698311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626559238, "uuid": "c67f55a4-b584-4373-ad19-7d1a2588d5ce", "comment": "Malware payload", "value": "11128c9d37c7d3a6f2d1363f3af487894f3fe756feab8a881e06f3a745f260f6bae27f1233bef44e82ea91166b9611ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559238, "uuid": "54aa879c-1285-4c96-96e4-08cacc940aaf", "value": "T155143A53F8658FB7C1869AB621679D300B13D9D61B8B178BB53996F0064F8CDB00EFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559238, "uuid": "6088c4a6-0aec-4e4b-81b7-f119790b3e53", "value": "6144:2d2l6CwV2KfUYxuZMEYKmAwq+K/LvFr6s/9nX9:k2Ab2kxuZ59mAwq+K/LvFr6s/9nX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626559238, "uuid": "0e1f2d6f-7b96-43a8-b7b1-5878a69059ae", "value": 207352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626559238, "uuid": "15ab29e3-6495-4b43-94f9-4af367c99be3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626559238, "uuid": "220a1525-5240-4a89-a324-b49ea3d3a2dc", "value": "c167093bea55b0d608771026ad477f09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76387dbd-e6ab-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1626490966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626490966, "uuid": "2debc0e1-0741-4c50-aa4c-6d6940321f4d", "comment": "Malware payload (QuasarRAT)", "value": "9137c99b88b701fc6315c36c67bb7b05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626490966, "uuid": "92afab23-38a4-4124-9c05-739b9d6d63f9", "comment": "Malware payload (QuasarRAT)", "value": "c913114ca9567407334925e993f90611b6a7a5d068c9ca6a879f34a993e88fa7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626490966, "uuid": "b5131978-0b40-448a-a438-65403036c37c", "comment": "Malware payload (QuasarRAT)", "value": "75903888ba49ce18ee83976b781c2b5cc818c23d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626490966, "uuid": "fc41db8b-693a-4165-9156-baa9292a7863", "comment": "Malware payload (QuasarRAT)", "value": "3af09dc492c28bac8b3ec780d917bfa2d824ee9e9116057080918404c4734918e220d01da25d6b7c5d2ad155c46cdbc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626490966, "uuid": "966424ed-b813-40bf-b838-1dc882b6da69", "value": "T19C748C1373A8E93BD1FE173AE43246054BB5D883B712E39B5A5855B82C233868D917F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626490966, "uuid": "4122d489-cfa0-4810-8f33-13e6ce5ac978", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626490966, "uuid": "3f4dbf5a-2a9e-485a-a547-aca0b3875d04", "value": "6144:da6bPXhLApfpQ0sy3BPbaxVp/y0HueSsky:omhApau8Q0HueQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626490966, "uuid": "5155b715-8644-48b2-b450-a6f59fbd1705", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626490966, "uuid": "ae7dbada-719b-4b77-a697-396afed2df88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626490966, "uuid": "a741fdf4-d987-430b-b054-17b15e73e832", "value": "9137c99b88b701fc6315c36c67bb7b05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad8ad9c-e737-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626550942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550942, "uuid": "6bc7ec84-7982-4ae1-9120-6dfc7b654d09", "comment": "Malware payload (Mirai)", "value": "40dc56f529182ed7d3cf5b70e020d768", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550942, "uuid": "9bca3b2c-3b6c-4ac5-9acb-5ab6049c6d01", "comment": "Malware payload (Mirai)", "value": "c9f32b026cf231f761582da99afd27054c3c88dadc70e0385f41e5209279b4ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550942, "uuid": "14735b4d-61b9-4931-b3ad-06364bb05bb1", "comment": "Malware payload (Mirai)", "value": "1d4a8d57f785999fd4da6c13d55490c77f9fca2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550942, "uuid": "aa3cee75-2177-402e-8ea3-26e310b4433c", "comment": "Malware payload (Mirai)", "value": "c278df52ae23d4b6abd3dd10450765605e45741cf1d3258264f2d10f017bc86011bea36a4c818d43216069e7c30c1917", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550942, "uuid": "2a88b470-5138-4f7f-a5e5-c19599644c0e", "value": "T1EB834BD7F800DDBDF849D73A84934909B130E3A10A921B3273637D6BFD761A45826F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550942, "uuid": "4ef056f7-9ffa-4dcd-84d6-c75b84d2d844", "value": "1536:jBE1FUU6nfCnD0w2LHEHsiq8twbR8tMJvnyrSv/1lLEdjLX5Gjmm:jy1+nqnoH4RtgDJvnyrS3zL8imm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626550942, "uuid": "a3bb136f-2435-4986-8c4c-b6c67f181e9d", "value": 82796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626550942, "uuid": "ffcb36d2-6a09-4549-b4dc-85a051d7f079", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550942, "uuid": "3e728c3c-84c1-4b55-b047-eae08893741e", "value": "40dc56f529182ed7d3cf5b70e020d768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb5e610-e701-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626527777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626527777, "uuid": "c7401600-c251-445e-a6f8-88666a2eead7", "comment": "Malware payload (Mirai)", "value": "60f678f43ba359d4d6b992ec079ca787", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626527777, "uuid": "06190304-92bb-43f4-9589-9a829afd3690", "comment": "Malware payload (Mirai)", "value": "cf17f93fd5b1e77b46f5a640680da3d7422a5b4d8b021a6807f08d8a44888c83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626527777, "uuid": "fe725b48-62a3-4567-a5e0-c6e7335f6025", "comment": "Malware payload (Mirai)", "value": "80348201e8d5efa2e31617adcc85d00bc5fc26ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626527777, "uuid": "fc9bc3a3-af08-450f-9ff9-60ec13ef5b4c", "comment": "Malware payload (Mirai)", "value": "4fcb51a0043ea2fd15205eed6b522f910ed5460996998828951dca17d49179257628306fcef133dec2c5cc7fe3c314ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626527777, "uuid": "774e9219-f950-4c03-a44f-1d1b7dc3f8d9", "value": "T1A8D2E13062B989E1AE757434EF7CC78E7207323882DD7D353D1671ACED6229614BD506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626527777, "uuid": "13307d61-0401-41fb-8de9-1879cf5655f0", "value": "768:OVVkfjLMKfx/7zFRItjOc7jubZqrMZBCBs3Uozfu:KVbCgtxuiEzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626527777, "uuid": "e321b216-91cc-4590-9184-8b37581f4f57", "value": 29376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626527777, "uuid": "3feee8c2-c851-4652-8f9c-1347c2563e4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626527777, "uuid": "cbcfa7a1-be58-4407-9a41-f1b5d1e49859", "value": "60f678f43ba359d4d6b992ec079ca787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced306bb-e739-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626552103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626552103, "uuid": "8323ac7a-c0d3-40f2-811c-c94d77d20ac0", "comment": "Malware payload", "value": "2d04354e39484597165021af6b955088", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626552103, "uuid": "248221a9-9062-4824-8164-c3b26f873a94", "comment": "Malware payload", "value": "d1b1d075c53212425e9b6398dede709529031bb12e6bbd84d790ce2476c96776", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626552103, "uuid": "65afab45-5e40-4734-a667-87c8328929a3", "comment": "Malware payload", "value": "97c7f11179d3ce911c2784d0545c89de98c35ece", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626552103, "uuid": "f7d76a71-11c9-4f8f-81bf-4c950976d440", "comment": "Malware payload", "value": "4f13f8d51f13ef8bcea2de17e893c7b9b83e0d72e2ea7a65c442df36d4269db530a92000f134921347bca55f3d2b580b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626552103, "uuid": "1d680486-2493-4648-91ab-3462298c5fcb", "value": "T1446412E3D7357ED7D40385F071AE278C612893CAC38A95917748886E25BA38717BA3C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626552103, "uuid": "1c4a3a63-8575-4162-aa1d-0e7ccacda67a", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPtoq:2IIKXhZtL7jOTyIG87X1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626552103, "uuid": "6c8b9d37-c5be-41bd-9ce9-32c3836d7109", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626552103, "uuid": "e415d2e3-d05f-4f46-a441-0a6fc73f013f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626552103, "uuid": "e6e315ff-8869-49d0-9b44-6ae3d7fff2c4", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746df1f3-e6d1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626507284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626507284, "uuid": "80117ec6-6ff8-467f-9988-718cdbe8f233", "comment": "Malware payload (Loki)", "value": "bc9f0c07dfe0016049662acbafe3c96f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626507284, "uuid": "c771588b-3330-4a1b-9c11-8671d77a9efd", "comment": "Malware payload (Loki)", "value": "d37960f9e2d09d1ee2bdc16ad0d29692d68da15fbc4e708455ec30ea6700315c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626507284, "uuid": "8da004dc-7844-4ff3-b1b5-9a2165915015", "comment": "Malware payload (Loki)", "value": "70516f665c3f145cd8bccb499b03d22ee66a9e42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626507284, "uuid": "884c85ef-df68-4c2e-ba39-b61bc877ae4a", "comment": "Malware payload (Loki)", "value": "53fdbe1be839242ee5102bae029b0ead52ef558d4c22c69ab4e7dd75f8a660dac4f8042a015ca67626fcf268abb4d08f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626507284, "uuid": "7a38ed10-8545-413e-80b9-8d016b4ac8cc", "value": "T19115DD3E6AA42A27B777D2644681C015F9BC81DB36395DD742C7698C390E8027EE7F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626507284, "uuid": "49346cc5-186a-4349-bf54-455daa778e8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626507284, "uuid": "ee284fc1-a19b-40c8-bea3-a3b7c68910cc", "value": "12288:I1fpgHxZ0EG3KQyTs4XlhyI/vbULOpsmMZm1/OG6hRkE9ULbYgoEsT/u7+ten:qfpZO5MAkP5UHY3/M+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626507284, "uuid": "9c022deb-640a-4118-8166-e533dd5f0038", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626507284, "uuid": "7bd9312e-a0dd-420a-a094-52bae8150bb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626507284, "uuid": "1bc154cd-76dc-4cdd-87e7-90073e5d477f", "value": "slip_17072021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9233c668-e6a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626488865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488865, "uuid": "7bb56b06-5c66-4bcf-ab30-99ce4ed56f34", "comment": "Malware payload (Mirai)", "value": "52d3d903e3fd524cf0c7c0c3923fed36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488865, "uuid": "81c38b79-85ce-4cc1-805a-7e32e9f79d07", "comment": "Malware payload (Mirai)", "value": "d3a1e56b8fc7c3784a7c72f3acdd74fbf5f0148e9d10554b0798a9c310dd5866", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488865, "uuid": "b6c7005d-8f26-42e5-97c1-d95f7e4fa91c", "comment": "Malware payload (Mirai)", "value": "6edd3e02ea43c3aad78664db06700beb56a775d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488865, "uuid": "65c935f7-154c-45a8-aa83-6d5c6596ad0f", "comment": "Malware payload (Mirai)", "value": "8a8fa6d65da307d3d981698e5e4b957605b8b4e8a1975b32f2d05adaa1320c3ce88779e28f23c7a319a2c8f5ee88a7c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488865, "uuid": "4a0c34fd-af05-4c39-9895-0683b3d27024", "value": "T19F93800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488865, "uuid": "889f47c4-a7e9-4607-ae03-64d8e5aad1a0", "value": "1536:NYCYxrXP40ODVPwHRQ9PlzTRfyToNoZqQi:qCYxrKDV46Nt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626488865, "uuid": "139f15c5-c4bf-4bc6-bcf7-7c41e8d4db87", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626488865, "uuid": "924fe35e-a964-4621-989c-a8a3ffb0e6f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488865, "uuid": "e0f1b3e1-d8f2-4a47-89d5-e53d3ac7fe42", "value": "52d3d903e3fd524cf0c7c0c3923fed36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfa1a1b-e703-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626528825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626528825, "uuid": "8cb5dbf0-05ad-46f7-90ac-7e8043d4159e", "comment": "Malware payload", "value": "dea4208b83b131ae5323edabd2e89b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626528825, "uuid": "45814e7d-e0d3-4977-a583-a296d43d2fa2", "comment": "Malware payload", "value": "d4697a1405909fe49427650f49fad9137576a39f1e44defec8ab7c9cf9d9809a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626528825, "uuid": "a428fac4-7a03-4e5e-adb7-c84f2f45e85a", "comment": "Malware payload", "value": "863e99edef23db8a2fa00e40a75fc195e0f23ea9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626528825, "uuid": "083dcbee-d22c-4676-b6f0-b7ea154dc472", "comment": "Malware payload", "value": "29931504b25d0b47d89c51f29a7737ab183a27f3795f927601d6047c0f19c0f3353d32151ac66017458611e3ee3130ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626528825, "uuid": "de0b7f00-b322-4e50-87c0-2b095fd5dc67", "value": "T1A23512A13170D57BC9D747B0A4308758167BFC926E557C8E3EA33B1E6D322E17AA0392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626528825, "uuid": "679ff44d-da7b-4dfc-8518-99046abe6a98", "value": "42a91e68a543cab2e800e3107645dc57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626528825, "uuid": "95e6fcad-e58e-4870-b12f-c454f0a998d7", "value": "24576:ucpnDRkkrCJw0ruCmyYIL4bsrjThYxLrOmJ8/WD2Ka54m3BJ:xDrCKwuCMIp3QWJ/WCKcJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626528825, "uuid": "7029b63a-7e61-45cd-8ab9-4d25d6247769", "value": 1131520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626528825, "uuid": "b673abf1-51a7-437c-a4e4-ee4183a22e0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626528825, "uuid": "44286015-91e1-49a8-b927-4238ee574c25", "value": "SecuriteInfo.com.W32.AIDetect.malware1.17232.19260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ff50ec-e73e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626554157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626554157, "uuid": "4d654f1a-111f-435a-b787-b557fed6bdbb", "comment": "Malware payload", "value": "dbbb611daf3abd47972ae4faf5d54c95", "object_relation": "md5", "Tag": [ { "name": "Async", "colour": "#2A4BF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626554157, "uuid": "4de416df-0f35-4c75-9ddb-31288b116ae6", "comment": "Malware payload", "value": "d5a8b6cb7b39d6f71ce67c6c8e17030079f2778087ee12c0ad45bd823f7bd53c", "object_relation": "sha256", "Tag": [ { "name": "Async", "colour": "#2A4BF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626554157, "uuid": "e56cd483-0d0b-47b2-ba54-85c9dc721c16", "comment": "Malware payload", "value": "1b33772f2acc9e6673a2922587b00db86f5fba01", "object_relation": "sha1", "Tag": [ { "name": "Async", "colour": "#2A4BF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626554157, "uuid": "36b7a6c5-2824-4b1a-9560-748f46a97533", "comment": "Malware payload", "value": "18b266e7af42270bbf1a78ea761db840f948534867288adc0b2c861bd14ee536f41eeaf66be6010cb94cab2006e86377", "object_relation": "sha3-384", "Tag": [ { "name": "Async", "colour": "#2A4BF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626554157, "uuid": "98839d23-ec73-4d54-b636-e0184cf6a409", "value": "T19F35221173D1C137C27A16B05DF176B2863BF6261721E7872B844A3FAE226D18F613DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626554157, "uuid": "3eb413f0-2206-4655-860e-f6d314ab39e1", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626554157, "uuid": "c3cf9347-4f62-4a35-95ac-a053a1007768", "value": "24576:jmclmMhCG3sDOdqnRrLVvjD9puJ7li2OLUC0Dc/rP0flxwy:jmzG3sJpRvjhU7I2OLZD/LUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626554157, "uuid": "bf619741-7ecf-456c-8368-9c51e44febea", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626554157, "uuid": "d42f0072-a38a-4c92-b3dd-c892dfd590eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626554157, "uuid": "713ad272-1472-4954-8d6c-d33fdb0020a7", "value": "ms.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f663a140-e741-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626555605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626555605, "uuid": "d2bad1a2-c98f-4894-a547-4977f4fff83f", "comment": "Malware payload", "value": "4940a3a0e0d91370a438a6c04c9766a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626555605, "uuid": "d5d35561-acd2-47a3-b3d5-cc4ec95fb493", "comment": "Malware payload", "value": "db51696fef142c546828a7b2af712ed4c2aa98cf68410a36e01988aa3b504944", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626555605, "uuid": "ef6970f7-ba19-4fce-b4d0-7a01ed018885", "comment": "Malware payload", "value": "547b84e762c992ee447d350b421ac58b17d0e1b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626555605, "uuid": "ab143d70-64d6-4455-b502-ba15519f5665", "comment": "Malware payload", "value": "b19312559110176dd26beea954a0e6062afb617b6d827778dc8c3ecce76544e9fd5266ddc46199a8fa80addd09606f3a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626555605, "uuid": "e2b19c55-0abc-4d5e-92ed-175f3a30bc66", "value": "T111434A177680C0FCC8AEC2B45B7BAA35D533747D4239F26967D0FA266EA9F211E2C510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626555605, "uuid": "e140d26c-0eb0-4b52-8c98-9e7b5fb0c9da", "value": "768:OEFsJsbZcEFVsQAE055crkw7bPdMeckiyVMVuSjb8SN1yGG9njNv130klz6FIs8:jhbZiE08r7XckiyYuFSNc/jNd01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626555605, "uuid": "8ae4150c-dbd5-4f3f-9e53-1cb345bcf522", "value": 55336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626555605, "uuid": "5c0afa53-5b24-4ee3-8ca3-81c91ff45914", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626555605, "uuid": "ece0b3b2-46e2-413d-a35a-f3dfdbb12ff1", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1eb3fe-e736-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626550672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550672, "uuid": "66c844a8-91fb-453f-b99e-caaf273a6f3a", "comment": "Malware payload (Mirai)", "value": "99ece985121de589d9babf832439c940", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550672, "uuid": "a7485c71-d1ee-4681-a9a9-7f2d2d290f9b", "comment": "Malware payload (Mirai)", "value": "dc97ccd75519591cb8bc1ff4cf303e24227df189f240364ff75fc581e560e295", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550672, "uuid": "3437d21b-0c15-47bf-8c7e-83450a28846d", "comment": "Malware payload (Mirai)", "value": "f01c3d31c752519ab3f951aa1552173a85ac9d68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550672, "uuid": "61fbb355-e507-4252-9f23-f96837bf5f77", "comment": "Malware payload (Mirai)", "value": "9c36880aa8822c196b4a9a36a9860229ac698e983c8916aebb57420345b97a45a0f1421610ddd099835458f7274a8493", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550672, "uuid": "6aea2611-c10e-4b87-9293-b7a2ffcfadd1", "value": "T138F31A46E640DB13C5D21B76FBDF424533239B64E39B33065928ABF43F87B9A0E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550672, "uuid": "f6e99c6d-ae86-4c9f-84e1-e6874abae5c6", "value": "3072:Bgr50T4fWX9Uj0k/jAAZhwCT/bMBuiauGeaPEngF5LqcKM/9UP9vmnwjnDPsxq:K50T4fWX9Uj1HhwCT/bsuRuGeaiy5LqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626550672, "uuid": "970e8bb3-33f4-4728-9572-c3524160a04a", "value": 161894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626550672, "uuid": "6f6fac7a-e3df-4514-9772-0b08a1d5ceae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550672, "uuid": "3039dd65-b127-41e4-a2e7-fa8d421ac2cc", "value": "99ece985121de589d9babf832439c940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7a89d8-e71e-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626540454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626540454, "uuid": "11deab09-8f16-44e2-8055-743e82666bcc", "comment": "Malware payload (AveMariaRAT)", "value": "29d9976d73aabf191eafe0f8b045cc85", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626540454, "uuid": "46f3fbc2-e9d5-47fc-93bc-bdbf71a5789c", "comment": "Malware payload (AveMariaRAT)", "value": "dcf103b03ea1c41a8b40f788b2920177f0d39f27af47452b6a1b2c9fc345dd6a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626540454, "uuid": "93fb944e-38aa-471a-9ebb-9bfc5a8735f0", "comment": "Malware payload (AveMariaRAT)", "value": "8332c39e496873afdc4fd89210e293204b085a63", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626540454, "uuid": "f60a8f66-8cec-48f9-89e8-59d2a5e51fbb", "comment": "Malware payload (AveMariaRAT)", "value": "657dfbf38b64a7acab11530b63a7438d1707959c6f6349ffc1553261df9f07defa4da4330482cef2ab7084dbc24d6c66", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626540454, "uuid": "d4bc335a-e4a2-4b86-9034-4eac1febf89d", "value": "T1BA05BB3E6AA42A27B777D2644681C015F8BC91DB3A395DD742C7698C350E8027EE7F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626540454, "uuid": "c7e97db9-b42c-4ddf-aa0c-9f206a7cce23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626540454, "uuid": "48462d35-fd33-4905-9827-98057b09d41d", "value": "12288:5ShxZ0EG3KQyTs4XlhyI/vbU/BKWmmyg5dBPt/z4ER63k7gm:5SWBKlSBPtstk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626540454, "uuid": "49b6a324-c520-45b6-86ca-14d66a1f2853", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626540454, "uuid": "104a41d2-5de2-45dc-bc01-ef4426fb651e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626540454, "uuid": "c2851b79-436c-4519-9bc7-7cf9faa5e3b5", "value": "Q_007880.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b672c4-e737-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626550937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550937, "uuid": "34f80f30-2e69-4203-8328-fbd656bbea41", "comment": "Malware payload (Mirai)", "value": "8099f6aa4487c077a21fa3492f906aa3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550937, "uuid": "769b1cc9-1d39-40b8-a973-b4cc4535c304", "comment": "Malware payload (Mirai)", "value": "dd214bebd9e94c7dc02e5261c36a4fefe3645832738ca623f6ed851fe763d16a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550937, "uuid": "2cfe4609-eb1c-4100-bd32-c2f48c09c481", "comment": "Malware payload (Mirai)", "value": "6e3cefc7da15636345341b55a578365baf2fce70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550937, "uuid": "bd9eccc4-cfd4-406a-9f1d-7fdc4f8ef5c8", "comment": "Malware payload (Mirai)", "value": "885fb9a27af227c5ce3df9aac8fb63e40706700381d463b307d4c7822555a7eac048d9b6cd32e60a3b44b4ef83a3487e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550937, "uuid": "fbb04a6b-61a9-46d7-85b3-2d74bd300e07", "value": "T1D4333AC596C3EAF1EC22007C246B6B719F73E57AB436DADAD39A5832CC05506D2073AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550937, "uuid": "7cc6d773-922a-463c-9b85-0c5202cd016e", "value": "768:zNmORKn2Z080jbbC4eNn9yueoCoexAzjQeaNmSgBDmQHOg+iKmmwt:znk/8EE99eowxAzjQDNmSqmQugf9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626550937, "uuid": "54b83bf0-1f32-4db4-9e70-75d44e3e245d", "value": 54404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626550937, "uuid": "1117f16f-63bc-4bb9-931e-deaa501c8a3f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550937, "uuid": "98270e5a-ba60-4213-969e-6912bc4698ff", "value": "8099f6aa4487c077a21fa3492f906aa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11e5b1d-e6ca-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626504486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504486, "uuid": "30ee555a-18b6-42b3-a18c-9faf679091eb", "comment": "Malware payload", "value": "79ef2c88288886965d36f5dc836b1fb8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504486, "uuid": "5506ff84-d6a1-4c1a-bc9a-f32225252b2a", "comment": "Malware payload", "value": "e0455558f75f41d4822d07069c3d1fd161d52676c6e83f0b16b71ca2e6cb408e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504486, "uuid": "8d75da4d-5cee-4449-b690-df7b651f6a60", "comment": "Malware payload", "value": "d9cbf5f96044fedf472866a481aa1c920fa93186", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504486, "uuid": "a993b815-4d8c-4bac-959d-f6e076ce5855", "comment": "Malware payload", "value": "5b22fa33ab4db862d896dff4b5d027dfb860f6e15738b8c2dc454f004cdcd2f53e0b6a4bfb1be69a4fa547b2aff3c1ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504486, "uuid": "9daf7f4c-bc8b-4cd2-ad9f-1386db13688b", "value": "T16DE42912B791C074F4BF02F5597EA678983D79B1072484CBA2C06EED5E74AE4AE30B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504486, "uuid": "c00aa5cf-2167-4162-8253-142965782ecb", "value": "87c1d9d30ead4ece0f32465d2f72eab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504486, "uuid": "5d6f9501-431d-4f08-a30b-7d61facc9e67", "value": "12288:TWjVghwWb55l0J7KFsQHQObor3ocgdHxuH9k7LR/Yyf:U7Wb5IJm7bor3ocmV7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626504486, "uuid": "32507b7a-53be-4333-9746-d2a3686c2ee5", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626504486, "uuid": "3402af04-7675-4390-b9e9-ae622fbe7c38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504486, "uuid": "4926c6c7-1862-4346-93b8-21822200ec93", "value": "79ef2c88288886965d36f5dc836b1fb8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756b1288-e6dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626512439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626512439, "uuid": "c8e95907-10a6-4926-b26e-529d9fbf7270", "comment": "Malware payload", "value": "489b62f64a10029ebcc825701d499c8a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626512439, "uuid": "0c723a6b-4ef4-4213-827c-f89080c59931", "comment": "Malware payload", "value": "e1ca2ac1aa389170c0aa4d4f6801fb1be00a68a69c748653b865012261bcbfea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626512439, "uuid": "c4f2b962-967d-47e0-baf1-318c90e96b09", "comment": "Malware payload", "value": "5a054411f1e64d15ae25606287e21bedef8691ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626512439, "uuid": "3bfb4c59-5bab-4ad8-8a6f-dc3dcc8a5366", "comment": "Malware payload", "value": "ed00bd6fe17aad7768198413e158f909778ac334ec76f84b8b2f39525d586593e24325426bb1d72012dd66c79fefa6d4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626512439, "uuid": "7b7b8fde-1ce7-4398-a3cc-e1872bb8c544", "value": "T18564128BEB36BC1BCB001BF225DB4F9D996C675B42C7E0A1BAC0444F26E61C57AD1285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626512439, "uuid": "63759068-d913-4c55-801c-ca0e25c97eb0", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio:p3lOYoaja8xzx/0wsxzSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626512439, "uuid": "808606dc-bb60-4cb0-8ab0-99a905ed633f", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626512439, "uuid": "372c019c-68ea-4627-8585-a2b2eab1b8d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626512439, "uuid": "e0f7a865-4e3a-4991-bcb0-df4d132456c9", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35a874f-e6d1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626507416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626507416, "uuid": "4f958f83-d7f5-4a07-b077-3208548c9b28", "comment": "Malware payload (AgentTesla)", "value": "468b5bc072cf22cc120aa5b9cc3f0edd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626507416, "uuid": "1821e264-301f-4a84-bac0-72aceb216c4c", "comment": "Malware payload (AgentTesla)", "value": "e2ef4fe5603be4dee7d691583ddbafc5df26b120705c5315a3e7dd26060b3c28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626507416, "uuid": "9e642762-b37d-4696-8d6d-d613d757ba43", "comment": "Malware payload (AgentTesla)", "value": "7d45d0d97e813d413bf7a8c4d39f7609b1692c97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626507416, "uuid": "e015cbc9-467b-4562-b914-f026345df20f", "comment": "Malware payload (AgentTesla)", "value": "3e2ba71d37cee4695008b520b082e3b5c3e6fbe7330b76e75cec4b6141940d4fce8efb681ace22e7c2b9defbb9a8b825", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626507416, "uuid": "83f5cd12-bb0f-4f2a-9d93-d40f3da2efd0", "value": "T1D0E4F19932187A6FC5BF9B79C8900C2053B1EC33871BE34AA95335FC1D7E682DA56097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626507416, "uuid": "4c96f279-f721-4303-8476-d958176c185f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626507416, "uuid": "a03a555b-4ab3-4076-a93d-ab7ecfab51a8", "value": "12288:vSCSk+nlx5t8j28H/aQkLh4xbmq5//Dtwjo71n2jUy67Zug5q/9qyy2zPp:vvexYj28H/I4xyq5ztw+w6YJ/Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626507416, "uuid": "7de10088-25de-4757-bd7d-e321d8205981", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626507416, "uuid": "b8fd3a1d-1bb3-42ac-9c32-d37fa5194126", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626507416, "uuid": "64474c49-5a03-4ce8-bddf-e56ea71cabf4", "value": "IZikrB0LOItfOQt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5717f84-e743-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626556328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626556328, "uuid": "cad4d40a-8604-48a5-be06-04c43889dd42", "comment": "Malware payload", "value": "adb3583322707f507bb3cc523ff32878", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626556328, "uuid": "939d2e4d-f9f4-44ca-9f8b-7b4fe0da6b49", "comment": "Malware payload", "value": "e4ee88d7b180c5aff6c5cc32df55aa596c8a9825954a60fdb2c1fea2ebcd496c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626556328, "uuid": "45aca33d-4057-4864-9cd8-a00fb96fd057", "comment": "Malware payload", "value": "15a3e85c8090b39a90d6f664e16d947d98fb9f07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626556328, "uuid": "3d88d8f3-f4ec-407b-9256-2dea41ea3445", "comment": "Malware payload", "value": "39979ad040f43b707a5bf9461e13b7920b13df135e3b09ffa9676ffcd4a6264604bc14f0c5c07154c01adc8a5877d042", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626556328, "uuid": "c565aad8-2d46-4fcf-8735-0fb11a6a3dcd", "value": "T1AD63D70A2E218FBDFB6D863447B75A30A79833D527E1D685E19CDA001F7034E685FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626556328, "uuid": "bb5dd127-7f19-4ba7-9c16-05cb5f1835ed", "value": "1536:g1cx1FG3UteCcuq9/Dj0eY7iB25ZYL+5KeCwS7:g6GkteCW0R025ZYL+5vS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626556328, "uuid": "a0281c7f-f07a-43db-9280-051d797cad85", "value": 72824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626556328, "uuid": "e1bac398-b728-4565-9328-235fda5eafc8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626556328, "uuid": "3b18e981-937d-4051-bbbd-386cf7c7f590", "value": "adb3583322707f507bb3cc523ff32878", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed3f50d-e6a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626488860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488860, "uuid": "ec28166c-1558-44f3-b684-f71dde232873", "comment": "Malware payload (Mirai)", "value": "e3d03c87f464429b1b6bd696373ba280", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488860, "uuid": "619c3843-9c06-429f-862f-5392d8af9bfe", "comment": "Malware payload (Mirai)", "value": "e6434cbb791bfb580119bd442b8f510166325fed6786b27c70e89fc79680a83b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488860, "uuid": "c8b1ddd4-6266-4f4a-ab8e-b096a6d65214", "comment": "Malware payload (Mirai)", "value": "8fe3363a7ba24a5c6a533568752dcb2e1eca9800", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488860, "uuid": "8ff984f5-66d2-400a-86b9-2dde8c79fb2b", "comment": "Malware payload (Mirai)", "value": "9ae15e40535ea8b98bf9d51d622719c4ab4435f34047f6545d94016e3f1e8268114d28a93042de51d8f7ba196c24be3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488860, "uuid": "089579fa-51d2-4923-aa6b-dfc3217b3a9f", "value": "T10AE34B46EA408A13C0D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E63A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488860, "uuid": "a2791d0c-1169-4fa0-bf51-c893bdd92b40", "value": "3072:3o2gE6xp200mRTbIpm79mrsplDKZUIQBKXAVanyX+F8Jyvw4hL6AhIg+ER6yol8J:3o2gE6xp200mRTbIs79mrsplDKZUIQBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626488860, "uuid": "0cf6e0cb-4de0-474d-971f-c7e33a952cae", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626488860, "uuid": "21ea873f-1105-4ffb-948e-977b8029f945", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488860, "uuid": "3dacb4d4-cefd-4438-b179-502dfdae5805", "value": "e3d03c87f464429b1b6bd696373ba280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adae41e3-e6ca-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626504373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504373, "uuid": "b5834b13-42b1-4b90-9e84-c1a7b1450fed", "comment": "Malware payload (Mirai)", "value": "60dc5a9ea9c34034d457c02605c4c89a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504373, "uuid": "b3971f9a-4563-4d46-9967-b086b3569262", "comment": "Malware payload (Mirai)", "value": "e86e53994e28f948ac58e562738db79ee66b70e8fe30b0dd4ae29290a4b2e6f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504373, "uuid": "e6c45577-c1c8-44e9-a863-3095f4f3ee92", "comment": "Malware payload (Mirai)", "value": "5e8e4e7d0556fabac3c76fc138cf7ee4dc29fbee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626504373, "uuid": "e53d04d8-c2a8-4ab8-8001-2a3313111dce", "comment": "Malware payload (Mirai)", "value": "a1d2af6d6d14aa655c93f1f9720f0ffa9238ece98d6458859a2eda4ff47c3f75b97d51b19f76fda68dfd497fe9bdd708", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504373, "uuid": "45163cfb-cef2-45a7-8e46-d9e7c15bc3da", "value": "T1C043E991B8815A39C6D557BBEA7F018E3354A7D8D1DA7313C8240BA47ECA90F0D17F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504373, "uuid": "3a542d31-fc62-407e-87e7-b3849ae07bee", "value": "1536:BDmYZRg6WLgdCKZaa6/QzZ0//HHV46+TAMC1JJmBUS:BzZRg5LYCXaX10//HCfTXCxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626504373, "uuid": "30325de0-c61d-475b-99ea-d21a54abe65d", "value": 57128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626504373, "uuid": "e3ad6a1e-c7cf-4555-8b95-9176322c7119", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626504373, "uuid": "e2bdbc5a-5e9f-442e-9159-b1f69dba3742", "value": "60dc5a9ea9c34034d457c02605c4c89a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd830c3f-e71b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626539296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539296, "uuid": "b30c7265-3b4e-40a8-b1be-253338fbcac5", "comment": "Malware payload (Mirai)", "value": "147e772b45b852d8a3a916152f94ef22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539296, "uuid": "1b4226c6-94fb-4a73-979c-a87c4838c9ea", "comment": "Malware payload (Mirai)", "value": "e8cf648eb5d006d0d1ab0a5f1465dc61d8da1bedaccea50f1a886942c440553f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539296, "uuid": "5fce7623-dd7e-4b22-99e3-e7ba8d84ef88", "comment": "Malware payload (Mirai)", "value": "a8df9eef6cd886fd8a73a02e535a00acefea9351", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539296, "uuid": "0dc8341b-e682-4e4a-8254-c1b629c3fe6b", "comment": "Malware payload (Mirai)", "value": "4412ff4fb9643d49fa9cbdebff5894ada2a48b03da848111c200dd46c144acc9b7f4b5828df77a2d7e61cbe1c43a8afe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539296, "uuid": "c62cc040-751b-46ef-a0dc-1866dd70ec28", "value": "T13E634A1172180E17E5921EB0393F1BF093BEE9D029E0F686261FDB5A8A35F371585F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539296, "uuid": "7ba8a3ff-3694-40ab-92c8-bf9dc5e5bd76", "value": "1536:9b4n1XcGmht9dC49wdU2e/1wuF5peIzzF+xEI496sz:h77wdUuQeIzzIEI0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626539296, "uuid": "0e176a82-3939-49d6-aa33-923775b30563", "value": 72888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626539296, "uuid": "77892f0b-da32-4837-aaa2-be6b3973080b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539296, "uuid": "69b3321e-30cd-441f-9d93-997218e0e670", "value": "147e772b45b852d8a3a916152f94ef22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c879bcc3-e6e5-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626516015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626516015, "uuid": "db5d94f1-a3ad-4ad9-b503-cd68a9f72a23", "comment": "Malware payload (DanaBot)", "value": "7df35e27a773dd213905659061609af3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626516015, "uuid": "b61feae0-4938-4a65-ae24-473840bd3a9f", "comment": "Malware payload (DanaBot)", "value": "e94bc4b9b7fc5813237818bc03a68b8b9060362d46ae1723e9216ce80ddbc864", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626516015, "uuid": "a4cd82b2-7a0e-4351-b222-a01635d153b3", "comment": "Malware payload (DanaBot)", "value": "5faee436b6edd7aa7059b55f78ad641cb6660026", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626516015, "uuid": "0a9cbe72-3639-4fe0-ad3b-fdacddaf25de", "comment": "Malware payload (DanaBot)", "value": "c3d9f251fc71c5831f901ccfbcaa2c144bec2e329485a388bdac2c5c575b99be735b1bafe9336eb999e641e8f40c6247", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626516015, "uuid": "3b66dc3c-9fee-44ac-ab5e-9c3ccd5e8dfa", "value": "T16A5523937B82C83EE7D1087258B10BF0997AFF201AD9E71E6708B9CD6670451E938B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626516015, "uuid": "bbbc48c7-aa26-4228-b1f5-b8ed11cdfa29", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626516015, "uuid": "4175a87a-5d8b-4ee1-950f-2e786770a9da", "value": "24576:PNxTwUib01ZGw4T2Upx4j6Y3bGF88R3sB56zlX4rgEBpXuKwhTs8Uj3U7C:cb01ZxY2UKaer6aEEBpzm48E3U7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626516015, "uuid": "2167ad38-f478-4dd6-8aed-2911357593fe", "value": 1328994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626516015, "uuid": "305c56b2-89d0-45ab-8e76-939ee99edfb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626516015, "uuid": "e9cf33ff-ae07-4bab-8f7c-8c8bc1f90a09", "value": "7df35e27a773dd213905659061609af3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1f3b5c-e6ce-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626506005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626506005, "uuid": "39e3c4ec-b2ad-4bee-9889-3f2835599d7e", "comment": "Malware payload (SnakeKeylogger)", "value": "6361eb6eaf389ab2334031608287cd0d", "object_relation": "md5", "Tag": [ { "name": "pw 7vLHRD4IdanbLrE", "colour": "#FECD56", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626506005, "uuid": "e80d394e-9bf2-4d48-95f3-045867c872bf", "comment": "Malware payload (SnakeKeylogger)", "value": "eafd47b57c1f6d7b77a521b9049e5ef3673eab4f4a54b4fbbd85666f623f402b", "object_relation": "sha256", "Tag": [ { "name": "pw 7vLHRD4IdanbLrE", "colour": "#FECD56", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626506005, "uuid": "dd2ec820-7cdb-4fde-ae20-c1eeb6e79779", "comment": "Malware payload (SnakeKeylogger)", "value": "c94f53e3f0bab4d1665f91785a778151e257e994", "object_relation": "sha1", "Tag": [ { "name": "pw 7vLHRD4IdanbLrE", "colour": "#FECD56", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626506005, "uuid": "018b1b82-02aa-4696-83a7-5b5edf57145f", "comment": "Malware payload (SnakeKeylogger)", "value": "71d99267c7da4a08bb6b0c97d355e97ee55e042f99825c2ddea3efa5784e3936600fdb3b8752cea3a24d514d4f559bd0", "object_relation": "sha3-384", "Tag": [ { "name": "pw 7vLHRD4IdanbLrE", "colour": "#FECD56", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626506005, "uuid": "b492ae2b-0c49-4ca2-9ddd-ae9c9784b9d3", "value": "T1D4A4230B65DA935D52B95C51A6EB54092F306E50EC2FCF63A36A38FADC139C330E2346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626506005, "uuid": "12efacee-1743-4f79-bd70-f4a52eb01e45", "value": "12288:305sUeMDOgJNIsuv2S6PufdceLUJ3l133ofjGDezRr69rTPJl:305iMOPskf62SEUJ/HWGDWx69rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626506005, "uuid": "5b288a0e-a0f7-4456-9d8c-3c44c3390a60", "value": 489427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626506005, "uuid": "8808819e-25ab-4619-b3a2-1efbef299d12", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626506005, "uuid": "53663df0-9f7f-4b43-b757-4cff0156127d", "value": "Payment Details.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bdf32e-e71b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626539282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539282, "uuid": "40c8ec2f-561e-491d-86c3-f5672d3efd77", "comment": "Malware payload (Mirai)", "value": "cb40049485a5613c91d66ebe51941907", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539282, "uuid": "5f5f9361-67f0-4795-a9f9-b134cfc6f7a9", "comment": "Malware payload (Mirai)", "value": "ebb07f3cebf3145444c8e830ceb05ea687b29112119713331cb02eed0b5a89a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539282, "uuid": "36b249c5-dbb5-418f-bbac-ce4984091833", "comment": "Malware payload (Mirai)", "value": "6d8aca6d8513200d6e5ccd09acd695d08e612c97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626539282, "uuid": "d19dc89d-e26e-4a43-bf2b-00e2171f6ddd", "comment": "Malware payload (Mirai)", "value": "923ade5b0e7aa1a84a4092a78dfe73fa4f4e30d78fbbcf33ef8e51a33680d49e04e874799f35c82b27e33df176b0ae8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539282, "uuid": "848913f8-bde1-4da3-bf50-0b5cea1b7ee4", "value": "T10B631851B8925B2AD1D053BAFAAD66CD333063E8D2DB7117CD204B6177D620F0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539282, "uuid": "5e40a5fa-c10a-4c89-a4af-597907fc7a96", "value": "1536:pMtyiTQtGB7ZCpHiS9Fk571xvsweilSERKdLQLyp6:pMAinvreSoLQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626539282, "uuid": "fe033189-aea2-42e2-bffe-c7cc3748b6c0", "value": 67268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626539282, "uuid": "00f32b15-37b6-429d-a411-c4a55feafe9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626539282, "uuid": "bbeea946-a1d5-4cc5-8b68-cc5014c6ce56", "value": "cb40049485a5613c91d66ebe51941907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8381ed-e6d9-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626510676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626510676, "uuid": "73d4e596-2c11-4353-b49e-992e6daa2ac7", "comment": "Malware payload (CryptBot)", "value": "ea601d01196c0b92b71bb0b9062ab436", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626510676, "uuid": "81184f82-ce8e-4043-a2ad-7750db58444d", "comment": "Malware payload (CryptBot)", "value": "ebc481038bcd4c6f9fb1e636fb74da578ee7e1dca710369b3ef01f421032e89d", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626510676, "uuid": "978e0524-7636-47ff-96b0-20f159bdd871", "comment": "Malware payload (CryptBot)", "value": "9695ed9b318748c42b3fc33cf92dcfe5959a7f5d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626510676, "uuid": "17eb1516-9185-4a37-a19d-375be27072be", "comment": "Malware payload (CryptBot)", "value": "c462140ef924e589dd8df769cd1f641e70d153734b65f43a89863bd478998a1a42a73c6e731f676375e7ac807abe2332", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626510676, "uuid": "23b7e369-f071-4a23-9195-26edff4c7d76", "value": "T135E4015171F2C03BE5F207744039D6A0677BBEA26930714E72933F0A6D726D4BB663A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626510676, "uuid": "4b921b28-37ee-4d62-b26e-96b8a8c474bd", "value": "97bf1f0575aad20ea6d291ede0d6d0ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626510676, "uuid": "b61bd3d1-4315-4721-9c02-28db3e5f4f71", "value": "12288:njWwF2sErFSwiwmmJSzQ6ldgyjtkIr1oxmSwBQMIEOg4S0zeWb:jWwsrFMwmT9X3jaIG8SwGMIM4/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626510676, "uuid": "ea56a3cb-cdcb-4dfd-80da-4e04a4493286", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626510676, "uuid": "176faa33-06f2-4d50-953c-14790cdef37d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626510676, "uuid": "4b522f42-ea7c-4de1-9fe1-57d3221ced72", "value": "ea601d01196c0b92b71bb0b9062ab436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a066dd00-e6a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626488889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488889, "uuid": "3bde7cee-e05e-40c7-ae06-b17920a2f5a6", "comment": "Malware payload (Mirai)", "value": "2b4a140d49fd42fa32c5891c9b57d30a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488889, "uuid": "5b3e4492-e32a-4ee3-95b7-3b845e8fe8cd", "comment": "Malware payload (Mirai)", "value": "eef911f8a847eb95f79a3691c1bec8807ce1cee554ef55ebe5388663bbb1cafa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488889, "uuid": "61af813f-7f17-4065-8b43-c6416c095c8f", "comment": "Malware payload (Mirai)", "value": "c2234e43e0b0c86c0ca83ac8044b5ae9ceda1a62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488889, "uuid": "d8d3160b-bdc5-4dda-bea3-ca55e7334942", "comment": "Malware payload (Mirai)", "value": "cfc900f5c40a88763084cd81717c8f1ec0cd9c07334a6fec34e54e5ffcc636a5b2ff6e55f6576462bd63acf697b4a2be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488889, "uuid": "f891c074-66dd-40f2-9970-c8f521b01756", "value": "T1CD530A827C816A39C7D0177BEA9F108E3354A7D9D1DB7347CC444B917ACA90B0D6BB8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488889, "uuid": "f0baa045-c95e-45db-849e-18fa00d08880", "value": "1536:5mNjY++BP1NfeCLDHS8neTC68ttHsilvltc0Eup2ypYceZWcU4cM:5mNE++BP9tC0f2yScwLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626488889, "uuid": "49790af9-5581-44e0-b3a9-725c16f4b499", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626488889, "uuid": "0a4e142e-0b99-4e6c-b9da-c5564e90c3f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488889, "uuid": "871b7766-85c3-4954-bd54-616d258cb717", "value": "2b4a140d49fd42fa32c5891c9b57d30a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82354e43-e736-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626550686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550686, "uuid": "45d41440-e559-4dc4-96c8-7c024652cd8d", "comment": "Malware payload (Mirai)", "value": "a47ca588240c02218175b323cbb22e8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550686, "uuid": "ac87855a-4e4f-4950-a029-166966921dae", "comment": "Malware payload (Mirai)", "value": "f042256f055da0f8bc565dad962f3eea8d29d8b32950f71f1ed35b02d9ffd5d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550686, "uuid": "d2b2eb31-cdb4-4536-a2ca-6a82398a7dc8", "comment": "Malware payload (Mirai)", "value": "715424726adddb7dae01afdb7c0b41e1439bf49f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626550686, "uuid": "2638b38c-6cbc-4b19-91bd-dfc062c8f347", "comment": "Malware payload (Mirai)", "value": "3e747d7b86f7354a639ea8d2d13925688ce7ad62d531e3e5eeecd49750ce96a39db090969da6e1c3ebecea5f63cb6cdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550686, "uuid": "6fc3a16e-6f7d-4398-a754-69ddfe74a91b", "value": "T11493B50D7E219FBEF6ACC23847B75A20965933D613F1D6C4D2ACDA051E6038D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550686, "uuid": "19332a2d-6c18-4f1e-a02a-ab2e53476a7a", "value": "1536:yJf3T5Ks8vrJNUSN1XPdMaU8Y5BoL/8JIKYe5DFh7:CL8DJNB1ZU8KBoL0JIKpDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626550686, "uuid": "bb866973-ecc4-4773-9f59-f4fccfcd8361", "value": 97160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626550686, "uuid": "0b726077-1eaa-48bc-a402-fb555847379b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626550686, "uuid": "927921c9-b6b4-4fa2-9201-a61d01df71d1", "value": "a47ca588240c02218175b323cbb22e8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bef4f4f-e733-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626549387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626549387, "uuid": "c5d1fa05-8481-4a96-a3e3-ad058a93bdf6", "comment": "Malware payload", "value": "6941cce26c58b37968c191d366cba43e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626549387, "uuid": "8bfd3ba4-693f-45f2-8eb0-b83c88c58c9f", "comment": "Malware payload", "value": "f0e5c021e3f6947d9c1f71e55db1b084dd24adea7593938a7e7e70c0bfb1b613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626549387, "uuid": "a634ccd9-7a12-4f21-86a3-e026d6ae87ba", "comment": "Malware payload", "value": "4381e7b9cc1a29cc1656873f90b155ccfb726d8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626549387, "uuid": "54fc880d-b58f-479f-adb4-998aa1059525", "comment": "Malware payload", "value": "d5a40806bd395b5299ae2a400a3a8b0acf8cbe57e884c1f02519787b8bbd8651ce4ee7c295c9c00a33d383c84d1dfb31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626549387, "uuid": "29de51e2-a4f0-41b9-876f-16cccfd4a938", "value": "T17B13D78CB784E175D5FF8BF1B4A2B2890B71A017A902D30F99F154D94BB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626549387, "uuid": "057448d2-1abc-4e52-ab70-dbe3c601ea8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626549387, "uuid": "75ddf9e5-196b-4ca4-b180-b5fcfefc70cf", "value": "384:4Zyc4FgpWoy7SN/LdKe6M1I3AkHC9D9O5UE5QzwBlpJNakkjh/TzF7pWn0greT0s:OQWol7U/LdZUwcvQO+r+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626549387, "uuid": "f10343da-3df6-4e4c-a0b8-85a6a4a56d10", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626549387, "uuid": "3d1c97f3-afe4-43ba-bede-8eaf22566d4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626549387, "uuid": "bd848d64-00eb-49ee-98bf-dc6631edcca2", "value": "PMZvqJrr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9770ccde-e6a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626488874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488874, "uuid": "0a539e6e-0c61-4ee8-b8f8-f48f24bddf49", "comment": "Malware payload (Mirai)", "value": "55fe8c5503747b95a09b963f552aa0a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488874, "uuid": "8472c908-533d-4d0b-a9d8-870cf23fc160", "comment": "Malware payload (Mirai)", "value": "f2869eb7044ac08860907bebb3b416144414e6400182a7cd3650c5d49b9669bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488874, "uuid": "1456c826-c217-4fbd-880a-7624baeb1853", "comment": "Malware payload (Mirai)", "value": "f0dcb0220433836e77efcca16400975ec0f96705", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626488874, "uuid": "d9d0b74a-51b2-4729-9093-fa629fe15a3b", "comment": "Malware payload (Mirai)", "value": "aed6c3ef7253ea9d3991e9b75d18279fa8c7148960c25f88087c404619b62ba1691d9125a9eb3992ac018fa15cc6269c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488874, "uuid": "0ee5c833-1b5c-4fed-8b89-9cf9be6d90a4", "value": "T119831981B9809E15C6C517BBFA6F108D335247ADE2DEB353CD145B6077CA81B0E3768A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488874, "uuid": "0b8c8646-32fa-403e-b598-66c0932c51fe", "value": "1536:29nCjGw+78yHykwstad+ro4CojYcubFcWiW9mrsplDKZUWQBKXAVanIX+F8JyvST:NjzySkhtu+c4DjBu2Wb9mrsplDKZUWQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626488874, "uuid": "9e7cb422-d44d-472f-8391-bd7806086289", "value": 83072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626488874, "uuid": "f9c72c78-d013-44a4-8a4a-ef4a2fbbe4e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626488874, "uuid": "6cec03ed-34c9-41ff-81f7-f3cad9900e9e", "value": "55fe8c5503747b95a09b963f552aa0a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a803c1a8-e6c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626502646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626502646, "uuid": "11a5c531-c8c5-40b2-9aa2-317c1d4f39ec", "comment": "Malware payload", "value": "c219509f3c95287a6b9900138628e5e1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Oscorp", "colour": "#F21584", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626502646, "uuid": "6e9b4d73-d533-4e7d-883e-67cd51f01f99", "comment": "Malware payload", "value": "f2af79157b65d1091020fe5db8f8a403758f7fbc4007e0f4b9b0b78cb9862ad4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Oscorp", "colour": "#F21584", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626502646, "uuid": "97577cc5-3608-4602-bf73-728e7a26af33", "comment": "Malware payload", "value": "1b405cd50549754c21f4a433459dcc26e87c0d23", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Oscorp", "colour": "#F21584", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626502646, "uuid": "f27091b8-44cc-421a-8f5c-0c030e767b1e", "comment": "Malware payload", "value": "8e75be07082146592d96be16a97edba83c67d07f58554d5bb65bb8ee0364e4fdd5fab74a0cf1c046a12ebc4efa3f8a32", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Oscorp", "colour": "#F21584", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626502646, "uuid": "e7a9aac7-3e0f-491e-ab82-fffc66dd921a", "value": "T1AE557C06D6424E27C5ED4735A4B30F10A331B985BB9387572A1EF1B8BCA73C16BC968D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626502646, "uuid": "e5a81972-6783-4b4e-955c-4fdb251e6d70", "value": "12288:tTX/R0EI6X9H2vKzSu8f1FDpCZkNRiRy4yMzafXyoJlunL3Az+ahr39iGfazNoH2:BRNI6MvASj7+kRMQyoeLQ7irnfjdWCaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626502646, "uuid": "33269f4a-b4e9-49aa-8efe-c1789f0993eb", "value": 1346156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626502646, "uuid": "b0484174-92c2-4257-a9c7-a83f12a76753", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626502646, "uuid": "b7db5366-49d2-446c-8c77-b80d24f822d9", "value": "Oscorp_classes.dex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b1438e-e696-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626481967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626481967, "uuid": "0b4f0ce8-7667-4f6e-b7d5-6511928c3034", "comment": "Malware payload (SnakeKeylogger)", "value": "92d9a31ddb94f23e10afca5c91b200c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626481967, "uuid": "29485f92-def0-404a-9ef4-376e6d52c3f4", "comment": "Malware payload (SnakeKeylogger)", "value": "f3a7377c1e5dd97ef16579c3484ce2ddf781fcc25d8ceb87ba9518a4e4f7caa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626481967, "uuid": "6a4e67aa-dc0d-4cd1-ad9a-1c04587518f6", "comment": "Malware payload (SnakeKeylogger)", "value": "8a34e47a343a45a8c3109e08a5ba72f69ae46e73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626481967, "uuid": "baad6a6d-e717-4491-a618-1cc92c33ffb9", "comment": "Malware payload (SnakeKeylogger)", "value": "bd8cabd77ed776072dd72633cfd5477d0fad8ba59c679e29b482820ec7dca9693a1672e54aa3362447283438d76780a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626481967, "uuid": "43f877f6-651e-4581-8b65-a58efd1bd704", "value": "T10215CD3E6AA42A27B777D2644681C015F9BC81DB36395DD742C7698C390E8027EE7F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626481967, "uuid": "c390c6a4-565b-4a28-aaf6-94cbc48304a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626481967, "uuid": "e7b03d02-0f5f-4351-9527-791da7055485", "value": "12288:9lUiu0xZ0EG3KQyTs4XlhyI/vbUBPNmMKboFeZ6BnojJIgP8D5U5+Pw:TUiWPNAboF9AJIgP8DW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626481967, "uuid": "aa96d441-286a-4261-8e92-339e51db6ad0", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626481967, "uuid": "57b1e2c3-0cb4-4257-8dbe-e78c9a763cdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626481967, "uuid": "5c444aab-73d5-47de-9885-1b5cfcc5da27", "value": "P.O 16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755f8f31-e6f9-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626524465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626524465, "uuid": "babbfe0a-bdd6-4afe-82fb-676adb0e0c37", "comment": "Malware payload (DCRat)", "value": "ade2c9a6a55df66e1d0245f6a29f8766", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626524465, "uuid": "7d699da2-9067-4366-9dab-cd0bd3765880", "comment": "Malware payload (DCRat)", "value": "f7c32157917b29e1ae8a009c4dfd7091cadb727b0c848357aa5fef2e652d5bb1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626524465, "uuid": "bcbb734a-5b8c-4c81-a740-330ea4741999", "comment": "Malware payload (DCRat)", "value": "bacb03c04509149614014fd98d7435bc46422c21", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626524465, "uuid": "0c5a6d70-98ea-45af-930c-d923e995920b", "comment": "Malware payload (DCRat)", "value": "57a031bd93e07a963882a17ad99814aad2d79737542a1c03755a4ae0370707cc119f0ee890dd8b931672928a290ccdf8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626524465, "uuid": "f6b4c78d-4808-4678-9270-7fb5da496d9c", "value": "T1FF0612806F8C89B3E23F0B7494E825D0977ED4679B52CB7B1F9815E87B123019E252DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626524465, "uuid": "fdd65767-f1ee-4a66-ad40-d2974f02cbd9", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626524465, "uuid": "ade03c43-f4c9-40d0-862e-daf9e9b2dfa5", "value": "98304:ubiayNN5Ppy/1k6wyNSF5Jv5NLlUuWKUS5+Z/ELZqeRfBcL69:u+ayNNNE/1kukF5Jv5NLlUwb+aL/7cLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626524465, "uuid": "d7124a8f-2df0-4b9e-a9d3-52f97b81d2e9", "value": 3679900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626524465, "uuid": "a986d638-acae-4992-91ac-ec46252bee80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626524465, "uuid": "4003aabb-e41e-43b3-8d12-818ab3b16742", "value": "F7C32157917B29E1AE8A009C4DFD7091CADB727B0C848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5725a09-e6d3-11eb-875b-42010a9c0053", "comment": "Malware payload (OrcusRAT)", "timestamp": 1626508305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626508305, "uuid": "3250c569-f43a-4706-92ab-0a3d3b663d46", "comment": "Malware payload (OrcusRAT)", "value": "a71f91351dc1bb57f0426080f2c03854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626508305, "uuid": "a48534d4-1a37-4e9b-9d59-43f2c114b4d0", "comment": "Malware payload (OrcusRAT)", "value": "f95e19a66cb1e3a612f2c07380376196e856dfefbe1038c4e6fd7d6a03388b5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626508305, "uuid": "bf5d297f-7488-47cc-b946-6be762c91d92", "comment": "Malware payload (OrcusRAT)", "value": "a336bd9298b0772f4d5764f695335fc7ef99755b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626508305, "uuid": "f166e2ec-68a9-4ee8-bc96-af020b6ae8c8", "comment": "Malware payload (OrcusRAT)", "value": "22025c13c7e2171b88f3e9b5463b015ca33069a375eb4131a093a10710d2d909a4a43ff30ae95b3657dfea4c2cacf2a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626508305, "uuid": "9267d1cc-630d-4a26-8a5d-5feda3715be8", "value": "T1209612883658B98FC4BFD972DAB41CA8A770786A4707E307541711ED6D4F683EF242E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626508305, "uuid": "e7e003ba-2017-4ac1-b7ab-e78eabfb6446", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626508305, "uuid": "b41beff5-00f1-478e-a78b-fec46a0a3870", "value": "98304:UCpuWzk89PQezhQupzgb+sX1ZvbeAyJZgh4Z0FGRABTgtse6vzovk1bcWb5/XHcr:XXkqVhQWUCsXDjDyfGZkJMbfR0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626508305, "uuid": "82ef4681-d320-44a9-8a7a-dd0f9ef1b925", "value": 8822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626508305, "uuid": "b27743a7-649e-4273-b586-013b8a8362a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626508305, "uuid": "2cf50e08-cc80-428b-908e-20f62841564b", "value": "a71f91351dc1bb57f0426080f2c03854.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b160e4b2-e70f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626534015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626534015, "uuid": "96c79770-0faf-4483-b303-d100685d03a0", "comment": "Malware payload", "value": "7c59143554a520325f548c80e7d4c856", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626534015, "uuid": "550ced96-b138-4621-90f0-f42c464112dc", "comment": "Malware payload", "value": "f99b63a158a7f58684d472db61093a60103f472e4e50d01f19bc1d4405e2f359", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626534015, "uuid": "f1e94ba9-1cd1-4ae4-a059-4bd9c78aa280", "comment": "Malware payload", "value": "4c90e4745dcd17ac437632b990ea38367d6e4371", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626534015, "uuid": "d58a0feb-764a-42bf-a16d-beddbd81803c", "comment": "Malware payload", "value": "64254ea7af886a4c8e3adc8215a171df345c3e158e6884b550efec4a0567fefa3b1b4140f4bb3650fac9f0d12036fdd4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626534015, "uuid": "95747cec-e5b1-4bce-aaec-77e6d4f58323", "value": "T1B524198AFC81AF6595C526BBFE2E418A331317B8E2EB71129D145F2473CA94F0F3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626534015, "uuid": "fe886d5b-0210-4b69-bfeb-d9cfb93e70ec", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqZ:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626534015, "uuid": "d7bf72ba-e356-4304-82f0-9f08a10e70a2", "value": 221544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626534015, "uuid": "702843ec-56e9-49e9-b864-9127fecf39be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626534015, "uuid": "918c9138-88c1-417d-bf01-e6482f338fa3", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c1c581-e6a2-11eb-875b-42010a9c0053", "comment": "Malware payload (ElysiumStealer)", "timestamp": 1626486915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626486915, "uuid": "431234f5-2b02-4d84-9642-c0578bf33b16", "comment": "Malware payload (ElysiumStealer)", "value": "b3102c8ff03714b22e9408fcf3d63ade", "object_relation": "md5", "Tag": [ { "name": "ElysiumStealer", "colour": "#0ADD99", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626486915, "uuid": "918840c5-095d-4404-b4d7-6408c2045ff9", "comment": "Malware payload (ElysiumStealer)", "value": "fd492b317c4004ce5046da22cbd0f14a698dec548eff87eee4f062284bf41505", "object_relation": "sha256", "Tag": [ { "name": "ElysiumStealer", "colour": "#0ADD99", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626486915, "uuid": "8f1fa0ed-8d02-488a-8136-58ac28623f18", "comment": "Malware payload (ElysiumStealer)", "value": "22da268e12c894698d4cf7cd6c4f69762ff68c4a", "object_relation": "sha1", "Tag": [ { "name": "ElysiumStealer", "colour": "#0ADD99", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626486915, "uuid": "3f22eb7e-ec2a-4662-9751-42909929b5b8", "comment": "Malware payload (ElysiumStealer)", "value": "0550d9beea0006c74ed62b9e5925157217d9f41f19d111ee5286806470fb0b74ec8f2419fab1499841bb75ed8f88480e", "object_relation": "sha3-384", "Tag": [ { "name": "ElysiumStealer", "colour": "#0ADD99", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626486915, "uuid": "21c487bb-b8c7-43a8-80e1-56f81bd8854c", "value": "T13EA4D73036A3915DDC2A47710C3A92C227B67A697F14CBDE359D171CDE225238B32BB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626486915, "uuid": "b6660324-9b0d-4254-ab51-8c2d9c55ed67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626486915, "uuid": "642e21ce-a643-4f79-8a24-b1affcb96323", "value": "3072:iOdVUbzCTdsyTW2NIH8XnqOFq47Fk3mYRJJFSnPlD6SdfZFsWe/refv69zeTZ1Ou:iGhe/Kn698sLMJstdXuvNbOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626486915, "uuid": "0798b364-382b-4f08-9360-70bcd2df95a6", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626486915, "uuid": "7982cb5e-5738-43a6-bbcd-1736b019d647", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626486915, "uuid": "8b97eae6-32f4-4ed4-acf1-cbab303e9eff", "value": "AntiPublic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58f769b-e6e5-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626516010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626516010, "uuid": "0ded3192-d088-4e79-a831-726965a82583", "comment": "Malware payload (DanaBot)", "value": "c20052c62c744a40e0278bece4e27be0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626516010, "uuid": "17554e51-28bf-4280-991f-eb228116b58c", "comment": "Malware payload (DanaBot)", "value": "fdd1a0c90b7b2bbe5ad7e385a2f3242ea42b5e73775f579458368748589ed56c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626516010, "uuid": "fcd5d50d-a2ed-4cb9-b08b-a96f6dfba9c6", "comment": "Malware payload (DanaBot)", "value": "3661393b286bfa2bd0ace43d7c8901b3fd9e6353", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626516010, "uuid": "e8401ed3-bdce-48fb-aa02-367ec683f91f", "comment": "Malware payload (DanaBot)", "value": "807fcc4eff9eac9a399ab60ed769fe827263a19ae86e1411d57294b2a64bbe6748af85d59c4ab69777e81285729eac46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626516010, "uuid": "36e2137a-282a-4271-9fc8-b9525ff36891", "value": "T1B1352241B5B1C437D2AA0A31513493A05B2E7E532B71754FB8933B0E9D733B2BAE5392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626516010, "uuid": "639f9c56-6e73-42d9-98db-18e71d2b84fb", "value": "169d152bc3371452dbec26f63a5e0c58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626516010, "uuid": "111a1e9e-3aa8-442d-8808-ac20ff7c3c93", "value": "24576:k+wbm0aVDHqPydAk+SfK07irnkON65+r12bayx1RdRa8PSKBJ:qbuKPydAkfKNrndyTmkR6GSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626516010, "uuid": "339573ca-e6c7-4740-af51-0dc7489bfa8b", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626516010, "uuid": "b1319a13-ef26-4f0e-844d-173e14fa46f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626516010, "uuid": "57295fae-c912-483d-aa30-842ec1b204c9", "value": "c20052c62c744a40e0278bece4e27be0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }