{ "Event": { "published": true, "date": "2023-01-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-01-28", "timestamp": 1674950581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3db35f86-a3f0-460d-99be-37f0c6f76168", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcfd46c-9f42-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674934267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934267, "uuid": "f9371e15-5763-4436-aa85-2235fe32b9c3", "comment": "Malware payload", "value": "c92eaf21bb8f94bfc441ee701f6b6da0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934267, "uuid": "5057b6fc-5d78-46d0-9fff-9c4caa36d6d8", "comment": "Malware payload", "value": "00cce7fa0594cd932c5c4036bbde4be21cc3fe7eefb74712b99dd0b97dd71597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934267, "uuid": "2af8fe2f-827b-4ed3-8ccc-95519a71e76b", "comment": "Malware payload", "value": "37133e2a0970c9470e3352c074d505f5bee638ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934267, "uuid": "ca358e91-0bd3-4537-89e2-090b61d285df", "comment": "Malware payload", "value": "545266d017b39ff71c4f199e44ea64cdeddb1e9df6ea7bb01b941951c8b1e4f22ad33bfa7002e2c12d2b283ec5d4ac18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934267, "uuid": "86f66d6e-8149-4468-b29e-efe79c0891a0", "value": "T18684CF1267E2BC70D527CA729E2EE6F4771EF4508E05772E2A146B3F19F1173C9A2218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934267, "uuid": "fb7b9238-844c-4dae-a77b-2823dffe1467", "value": "a5cda000ff4d200b1a7c245df76a958a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934267, "uuid": "472af530-85ac-4197-9e18-35e38f8b14e6", "value": "6144:vVLNCZxoD/JtR7tlKh2u8xLZskF1EHMluT/XqSwzIDMNsP:dhIi/Z7tfAkHIHT/XqSAeMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674934267, "uuid": "27a5ba2c-c8fd-42b5-b413-df146e73afe0", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674934267, "uuid": "aa931760-e986-436d-9560-750e5fe5252b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934267, "uuid": "1682d17e-dc85-48c4-bd00-cfd02435aa48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703fe6ab-9f18-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674916282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916282, "uuid": "89bb3727-9e84-480c-a13a-5a0ac5621a9a", "comment": "Malware payload (RedLineStealer)", "value": "59fd4d2e6ca98585c6c4b203d1435968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916282, "uuid": "f7c363c0-4823-4214-905e-24d5b3e02e51", "comment": "Malware payload (RedLineStealer)", "value": "02302e2e4f865c61fc2464dc26f04843f24a465698792d5cdc76820a4e04178f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916282, "uuid": "b92a94c7-f2bb-419e-b33a-f0b0857e5015", "comment": "Malware payload (RedLineStealer)", "value": "957c62af41128609c76dca2ca6982659117e295f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916282, "uuid": "52f0ac56-3611-4391-b385-0452f67d7cc7", "comment": "Malware payload (RedLineStealer)", "value": "a5aac05172b3c898f8940ef11a71154da7db216c30fadc4650ea7e765aa9fca14b534df2ecc3ad47c629e80757505b24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916282, "uuid": "b81a8221-44a0-42d2-b2fe-5ea07a4d5461", "value": "T11E84CF81AF92BC60E925CA758E2EE6F4772EF8508D15736D1A18DB3F18F1173C5A221C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916282, "uuid": "cb8b2dda-17e9-4cb7-bb5b-3ea7280353dd", "value": "d191080c270d3118935d8b6a682d2ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916282, "uuid": "d91d94be-1ef7-42c3-a33e-fd49122a212a", "value": "6144:yOvLyLflukZm7cgGXwBVffcszKU2EuqSwzIDMaP:yOv+h1k5BVHZzKU2nqSAeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674916282, "uuid": "5827e6d7-2bfe-4ec3-84ce-6107c61f3676", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674916282, "uuid": "30a21f12-2748-40b3-90a0-e5e88626673c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916282, "uuid": "f5c1431b-3c0c-480b-ad41-07d6ec20ecd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbf0dfe-9f16-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1674915443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674915443, "uuid": "0be520b9-aa4c-4a57-929b-862320b10697", "comment": "Malware payload (AsyncRAT)", "value": "5766cb7fde4550d5b22abc76368cd73c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674915443, "uuid": "22af9b44-0ca8-4f86-851b-5b8beab6f571", "comment": "Malware payload (AsyncRAT)", "value": "041201ea61adce22ef2f36f64f9ccac66d638bffcb043e48f53d33cc7d8692a6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674915443, "uuid": "76b8dbc3-e214-4c2f-81fb-eb8ee7f55caf", "comment": "Malware payload (AsyncRAT)", "value": "de945f448741fd7f9130ba366e82f24fbff8b882", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674915443, "uuid": "5f1ebf2f-88b0-4883-9b5e-f935d9022d11", "comment": "Malware payload (AsyncRAT)", "value": "2f27830f6c451c11fec5abf1108a9d61f5d4944b36bbc0fb725b4fdf898ac79e21a42632f12d3e833f3264e52f42c54b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674915443, "uuid": "6360f6a0-e269-4064-b702-d14b0ab36487", "value": "T1B033E0F38B8A09FCD6A0DD8D768D8419E3CDD49D86014DECA60EC49E5FDD2721E88E08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674915443, "uuid": "52c914e8-0fc8-4741-8ec1-aa20ec15d3fe", "value": "1536:/jNbaYAiCAIpcC4HLSDq9/yamFjr6lI5ZiMWcFq:/iZKqTjkImCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674915443, "uuid": "36c8c956-db60-49ba-9eeb-c7ef108bf7fa", "value": 50582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674915443, "uuid": "95cfb760-e544-4985-9f00-6acc5d5dc00d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674915443, "uuid": "b887cab5-89ec-478a-8db8-49b6b1e363c1", "value": "Shipping_Document-one__rw.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0792513a-9efd-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674904510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674904510, "uuid": "cb240d29-91f3-4bca-81c9-1029bd385b49", "comment": "Malware payload (GCleaner)", "value": "1817228efe6d85409a5488edd554927a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674904510, "uuid": "ee5b9faf-f66a-4364-b77e-06a16fce9e22", "comment": "Malware payload (GCleaner)", "value": "04fe91ef025d7a09e6fbe2ea37557982a3642e33ac1dfc97dad51391b604703b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674904510, "uuid": "22566884-563d-43b4-8cd0-4316cafbafa8", "comment": "Malware payload (GCleaner)", "value": "79bcdbf68af4dc7439ab92fd0ae7388b79507777", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674904510, "uuid": "ad9e8deb-2253-4d42-93c8-89809787800c", "comment": "Malware payload (GCleaner)", "value": "fafa73c7ee1f12f91b1d90ac5da45338b308bb52eb717de33f02c894a31ba4067d50b7bd9b86f850294813427f625c28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674904510, "uuid": "a0685c9f-b592-41be-95b4-1db660cbddff", "value": "T132B5330660D455BEE52B4BF63A307180EFB7BE5B603E3542746513DC2F2A3A14EA4B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674904510, "uuid": "c3ae2a33-c432-4708-bddc-c8414550e638", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674904510, "uuid": "14005546-513d-4544-a85b-a3694e2d843d", "value": "49152:okug+Rku6FDCD/CW0pArM6XUMAeG65nTbkdb0IiKf8TOoNLCgv2MR:hug+kmLBrM6EHexnkaw8TOoRv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674904510, "uuid": "48033e14-9d62-4946-99d2-268fce412d26", "value": 2334604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674904510, "uuid": "f7529300-4aa1-4fd8-b7ea-6fcc7734b9bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674904510, "uuid": "84760af7-9073-40b1-8867-7fd25adf13cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff572e8e-9f63-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674948735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674948735, "uuid": "8f48096e-bce4-4b62-88cd-21d04ec06b4e", "comment": "Malware payload", "value": "e1274483cabe66661e45f079640adde6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674948735, "uuid": "5810d959-671e-425b-ab0e-31b91c27b5ed", "comment": "Malware payload", "value": "05fb6d3f785788096fa4205498086c6642f11a45cb9638a850ef59a34f227600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674948735, "uuid": "1153a9b4-0d49-49fc-8daa-d50e7b1429ae", "comment": "Malware payload", "value": "abd395b43b215db8dc2043fb869cce97a5fd5fe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674948735, "uuid": "6b57943a-a483-4b56-b1e1-0689f95bfe1b", "comment": "Malware payload", "value": "a14c816b695ce2873851d49e16fccc683af29ce9cd34ebd8b62736d10cd462e5562d4335b84f4e84f4921fcb202c4935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674948735, "uuid": "45a015d1-d199-486a-a426-7e11284b1e89", "value": "T1AC76337A7CC4C4BED249AC760A005C556CE8E391DE23CAB3F13AC64DAA2EEC2C517575", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674948735, "uuid": "48b9c703-7aef-47cc-9672-c090e4c33c4c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674948735, "uuid": "b3a3f890-fd22-45cf-8af1-1c5a65ee305c", "value": "98304:91OX2HRrlfcNPy2fW0tYElfQ5lZLRPtsQqOYYNS2OjXpLvHYwuA9tf73OrEgyZ0p:91OcrV5ElfQlL49jXd5zf60ZZLUxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674948735, "uuid": "fa6e3e37-4651-45af-91ee-4ef5ec39502c", "value": 7647224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674948735, "uuid": "487c5d5d-2d5e-44c3-aaff-ab36f46af9cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674948735, "uuid": "5839e814-ef4a-4106-bc49-3efba980fd15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e59144-9f3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674932927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932927, "uuid": "fe7496cc-b124-40a0-8f1e-b44fe2558e10", "comment": "Malware payload", "value": "dd4428a252dd716e5f380b33f74fe68e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932927, "uuid": "ef3a458e-d7bb-49f4-b31e-a7f0a29f5d60", "comment": "Malware payload", "value": "0775f6c00ce22c822bb56ed45d658af3647e522d0e462d505e31dfc0f343adde", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932927, "uuid": "102e28aa-d355-41de-ac9d-d562cf50bc89", "comment": "Malware payload", "value": "22284e5227c4b8fffe3d2ac3b197c23f720b03fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932927, "uuid": "16dc4ea9-7c3e-4983-b782-57806055e4e8", "comment": "Malware payload", "value": "62c14837f7c1f2819f95139d5aed61577b0353a4da2530e542e4fd756234206e3715ae5b2f6d18795d8d243b666b4243", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932927, "uuid": "ee20d027-e83b-4a60-a7d5-e5c44cb551dc", "value": "T16A939C29E931D035E8A250FECBFB96FDAD644B201307D0C797C02D49A7869E5FD32626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932927, "uuid": "f3779a7e-e414-4d7c-940b-e097bb71371a", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932927, "uuid": "f2928602-0792-4c3f-a368-57bd0f370581", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4Avz/ZCd0S5n2F/N5kz+rwTSEd9:Hw+asqN5aW/hLpz/cWS5n2F/N+zewmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674932927, "uuid": "feb8e303-13de-4106-800b-9c26e77660db", "value": 94724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674932927, "uuid": "72a86ce3-3bde-42b8-b6bc-04897a54f95f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932927, "uuid": "951a3f15-cb4f-4405-a6b3-4ae937722d7a", "value": "2023-01-25_dd4428a252dd716e5f380b33f74fe68e_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c4d78e-9f56-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674943113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943113, "uuid": "fae93935-9458-4750-bcc2-de72b36ef3bf", "comment": "Malware payload (Mirai)", "value": "e17903fe1c40d5d1622d8c44366dfe5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943113, "uuid": "c3dba590-287d-411d-9c92-9631560eea3e", "comment": "Malware payload (Mirai)", "value": "08390b135a7ed69621738b08df86123d4fc32506072d32342a0f0359dd23dea3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943113, "uuid": "3f3b2413-bd4a-4d65-8e46-a9a4ae1fe986", "comment": "Malware payload (Mirai)", "value": "6260b82eb7317c892ab2cdc28bb95b0352b1fc8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943113, "uuid": "bd1ea6a9-cf74-4e28-860d-1e598bf52f01", "comment": "Malware payload (Mirai)", "value": "da9951dc23d5bf3263b2604a1fb68f341a24a20675cd73579f78ef3a502a6885f5e5685c0f167ed32578d581eec8081d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943113, "uuid": "6eada2d1-4c05-4e08-b0ad-eae1019bda9a", "value": "T1C823735D2E329FEDFBAE823447B74E20665A339523E0D684D29CED014E7030D645F7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943113, "uuid": "edc52425-0782-4dfb-90c7-19881878a9f8", "value": "768:0mr9MenYSME0/oM8VyDCIezMv1i6xvlmJWmFW0WflW5WJlWo9lWikf0usC6pz7J4:0Y9MirgjLtMjU93kffsC6pheYTNrimrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674943113, "uuid": "68332052-78e1-477a-8658-3956919667c9", "value": 48764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674943113, "uuid": "3c1965fd-f3f8-47d5-abd4-327bfa7e5e5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943113, "uuid": "54b5a44a-6886-41d9-a5b0-3fe0d0038668", "value": "e17903fe1c40d5d1622d8c44366dfe5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd614a90-9f4a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674937940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937940, "uuid": "dcc6574a-d0ce-4e91-959a-2ea0e8520439", "comment": "Malware payload", "value": "4063b7b2eb149acac69917f91cd0c902", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937940, "uuid": "981a8aee-6600-4d94-8987-b7f5f6ca923a", "comment": "Malware payload", "value": "0b5dc252f59e4602c815289edc7f9c6ed6aefa677a58ddadaeeec4f133a1714b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937940, "uuid": "a1bd633f-3bb7-45d7-9073-0e800c7bece0", "comment": "Malware payload", "value": "ca4572c93a9d0a5d82f5df05626107cc23fb4d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937940, "uuid": "188b688a-47c2-4b1c-ac64-ba997fc150cd", "comment": "Malware payload", "value": "b528ddd46162df016aacfac719be0eb3a8b796f95b58fff6c1c15203007114e3e0c33853886cf7c18c15fd777fa83620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937940, "uuid": "338f5d0a-3081-4103-9e96-7b0acc0ed905", "value": "T11884C012A7D2B8A0D925CE759E1EE6F4232EF4418D15736D1A08ABBF05F11B3C5B22DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937940, "uuid": "fcf9be22-e4be-4211-bd34-be84e54c8e5c", "value": "a5cda000ff4d200b1a7c245df76a958a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937940, "uuid": "037d9c01-5b55-4f01-9edf-6baf4a4d1c5f", "value": "6144:8zLPQA2zPL5qqHys5zRIfa/DcnvyUvktsYQbtwESNsxm7qSwzIDM9P:yTMT9qSN5Wy/QnnRmsI7qSAeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674937940, "uuid": "2bd1741d-1dee-4db2-9602-46cbb490f820", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674937940, "uuid": "074974fa-e78d-4271-8f24-079bb29c061c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937940, "uuid": "a0048c9c-716d-47f4-87aa-dff028efcb9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0273b992-9f3a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674930701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674930701, "uuid": "88464d7a-5608-4f94-bbca-6af7ecc2e12b", "comment": "Malware payload", "value": "74f2ca0117c13e12e4d25cdf1311eaa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674930701, "uuid": "08192f06-e79b-4dd8-943c-fec852428dc6", "comment": "Malware payload", "value": "106c34117a7d5e4928d81685628856320c51fd9e02c217951060c3ead1da69b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674930701, "uuid": "f17d1b13-e633-4512-8f77-de62ad721942", "comment": "Malware payload", "value": "1eaac9948282e3cba3bd5407adc821bd42d709ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674930701, "uuid": "74f7934c-0455-428e-abf7-f0f16ec9df85", "comment": "Malware payload", "value": "962dd13af75837d8f95a939b2e102e0c44b79183761d811962b9df73fa6ae48d760388cc2d9a65dae70793c00839419c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674930701, "uuid": "59e7b322-8600-4c32-a8b6-6ca7c1295a99", "value": "T1C684AE0267A2BC70D925CE36CE1AE6F8671DF8508E35776D3A14AB3F18F1177C5A2218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674930701, "uuid": "c430a370-28f0-4399-ad91-7333e793d4ac", "value": "a5cda000ff4d200b1a7c245df76a958a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674930701, "uuid": "63cbc833-da28-4924-817d-31605d494f12", "value": "6144:bL+rMf2eQsrbqNd50mHpRVFDdhzLcqSwzIDMsQP:bCu9QsfqW0RLN4qSAeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674930701, "uuid": "e765eb27-cfb0-4c55-8c29-f93090856248", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674930701, "uuid": "1d33e21d-d08d-4070-b851-2a3a4cc1c273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674930701, "uuid": "c2cecc97-eaf1-4b61-b99d-1715a1005a29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa64ee2e-9f09-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674909938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674909938, "uuid": "755e33a3-67bf-4f64-85fb-d21135fc407a", "comment": "Malware payload (GCleaner)", "value": "5423d065a3786e05fadf872e593693f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674909938, "uuid": "394b6a63-df9f-452f-94f5-ad62e511ac27", "comment": "Malware payload (GCleaner)", "value": "115cea346f161663dd65fdb691331ef99b4d8ad6717cf32a4f929a37ffb73930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674909938, "uuid": "8045126b-62b9-41fc-afed-e8a3a4797866", "comment": "Malware payload (GCleaner)", "value": "a21333b545cfbd8eb3ac82ae052db4d55c889ff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674909938, "uuid": "9fc0196a-d3f1-4415-9bbd-0a6c6a44d553", "comment": "Malware payload (GCleaner)", "value": "ea6d5398378ae67bcbb6668d4220aa42f4bcee91e10b8aa2d19066fe61c2182716b9c8db0c9ac8f4588ac2b62516c15a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674909938, "uuid": "90e01f98-eec9-4cf5-bf4f-14eb4110d7f7", "value": "T16CB53387DCC181BDCD734BBE173015042FB6BE4F443D11323A9AA38D2A756B249BAB95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674909938, "uuid": "c052ef3f-ee8f-46af-ad1d-05d0900d2f4e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674909938, "uuid": "a44801a6-da70-4401-816c-a4c63b173c4a", "value": "49152:okug+WEDvD1sLpxVgEcAOCDr5RSlI0j2JL0e6M+OYJkqJlLCgv2MR:hug+WEDR+xgjCDr3SlI0jORD+7xv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674909938, "uuid": "b6860da3-699b-4301-b045-eeea46a521a2", "value": 2339960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674909938, "uuid": "67a20cfe-965e-427d-b649-4bea1f4e5505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674909938, "uuid": "050e8dc1-bebe-42fb-b906-098bcda1d7b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4f94cf-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674894883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894883, "uuid": "e330c686-c13d-4a52-be11-83f96f2900fb", "comment": "Malware payload (ArkeiStealer)", "value": "79ac85621ec14785aa141640da23da23", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894883, "uuid": "6641950c-4cb7-4e71-afb7-e28af0a167d8", "comment": "Malware payload (ArkeiStealer)", "value": "129dbb8135f9c5d6757b49f666259df1b6e7aa4009b8debe18667d64ae5ea7e6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894883, "uuid": "5a3c2ecf-f710-466a-bc8a-e381ad7867cd", "comment": "Malware payload (ArkeiStealer)", "value": "7264d5ce22b16e68811724570ce31530372375c1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894883, "uuid": "76bc5e3f-034d-45c3-937c-fd67ccbbe918", "comment": "Malware payload (ArkeiStealer)", "value": "85b2c5462306b4d2f854450d7c3ab70d6dc548caf9c8fb990b3fba5266ed25913d4e094ce3601eaa436efdc03a3a103e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894883, "uuid": "70b3b21e-194d-4e5c-9695-fbd2450c8a95", "value": "T154548E2267E27C60D926CA758E2EA6F4631EF8409E54337D1A159B3F58F11BFC5E220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894883, "uuid": "c585483d-a54b-4f9c-8c7c-e4042d8514ef", "value": "4bc9925dd568c221c7d9868dfc769dfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894883, "uuid": "80e92e80-640a-4b48-bd79-4a059c1d25a1", "value": "6144:MpQL3OpX5MB7qjxPoOAFFXqSwzIDMNn8P:MKLOBe0VPeqSAeMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894883, "uuid": "9a53071f-1b73-4667-9d10-8b306fc17aea", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894883, "uuid": "fc123f00-dbba-40b4-ab4a-5d5f2689d42c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894883, "uuid": "e78cc3df-bdd2-444e-bcc5-07a89521bfc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cf7a90-9f0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1674910700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674910700, "uuid": "8f6c3186-dda1-4d32-81a3-a9835d6f14d5", "comment": "Malware payload (Rhadamanthys)", "value": "1ff3ff9a1bda19b4e385f84967b3fb28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674910700, "uuid": "71df3d4d-210c-4e11-b748-aa4a47813953", "comment": "Malware payload (Rhadamanthys)", "value": "129e4bbbb2295d04fc9e580698fc3fdfcb0de73269ec940d217260b7c44455f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674910700, "uuid": "4bc3cbcd-3868-4c5d-8b78-b70d86b92bb4", "comment": "Malware payload (Rhadamanthys)", "value": "6d124e56f76e1a6b08ca636f2718cb1c710fb787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674910700, "uuid": "1af0b4b6-72bd-43a3-ae0d-e31ff3faeaf8", "comment": "Malware payload (Rhadamanthys)", "value": "fe779f9d034fbb7e4bf4c1d5c48f9f7a1812fee66b046b16321962a77ed8cde83618cea3b8259b41f9f214a6e0be3a7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674910700, "uuid": "664ebdcd-6b28-40a5-89d1-6de195337efe", "value": "T117D4D01276F1A032D4A23C300B25D674967DB93C0A2275FB67DF26EE8F316D19631B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674910700, "uuid": "e4f5b64f-c75d-4913-911f-282df2e511b8", "value": "d0e2aba6d49a23d36c86b8a97b358e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674910700, "uuid": "926d39e4-99d0-4e4b-805c-f5be356ed0c5", "value": "12288:VaFD8LPFwxpaarjRNESVCq3QwKw9FAx1YYSFoJiSPc2uhvBNEj+:VaFD8LtwxpaarjzCqgenAEvqiSPWZBNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674910700, "uuid": "0c65490a-1ead-4fc3-90af-7566596c2d74", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674910700, "uuid": "59e7c119-692e-47bf-9257-05e170fd22a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674910700, "uuid": "2b1f657c-b082-404e-a28c-556fe07088dc", "value": "CARGO-proformanumber-22300040732_cln.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8515cc7e-9f17-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674915888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674915888, "uuid": "3fef39cd-abff-45e5-9858-d65814184756", "comment": "Malware payload", "value": "da8628b2d32ebd9efe020282ed561503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674915888, "uuid": "1e54713d-9662-4b69-99bd-63ff7da9d7b9", "comment": "Malware payload", "value": "12d2748a0ce978d67e1dca6e3c3e1bfe4aed67b05747038706e2120169cc151d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674915888, "uuid": "2bb1c345-30ed-4deb-b6bf-917f5453e8ce", "comment": "Malware payload", "value": "ed591b8b7f90f3f35616c584fd06c1812d729023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674915888, "uuid": "b50c1900-6ddf-4372-9bf4-c5155df5229a", "comment": "Malware payload", "value": "72c75c64942d827bd45d3ad0e1b61a991e29dc833e6b6be257f249f378de12d8101300885497cbcff1a5b3898a7d4bee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674915888, "uuid": "f7b67ac0-29da-420d-835a-d1db2d391e82", "value": "T17A7633A076C148B7C9423973C6708DF1E9635AAE4C24CA3B774B531A6B3D791C427E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674915888, "uuid": "de077395-19bc-4a53-b95d-733725a0b990", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674915888, "uuid": "6c134c3c-6dd4-4878-812c-05e7ffb7a29c", "value": "196608:91OU2tIDiZwvJg95/8HJkg/q96uGE7hPcuGbL:3OUCIDVvm5UpVC9BNGbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674915888, "uuid": "1860aabe-57d7-4cd2-90a6-a77422bc23cc", "value": 7585289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674915888, "uuid": "0b227b34-bd28-4ed5-9f8b-745ab5a831f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674915888, "uuid": "5281e8ac-facf-43b2-937d-f1909b16bc5d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572d2579-9ed5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674887464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674887464, "uuid": "051ab072-084e-4182-b968-362f85ba6acc", "comment": "Malware payload (GCleaner)", "value": "d4d4a2391d365f2cb6a31ff3454d2738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674887464, "uuid": "4a118682-1add-4c0a-949e-0504579b17e1", "comment": "Malware payload (GCleaner)", "value": "131989726b184b953fdbde087a3515243622fa17e9d50cfb7d93add1f9514829", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674887464, "uuid": "0bdaff31-0420-4e63-bfa8-ca77cdbf9e25", "comment": "Malware payload (GCleaner)", "value": "ed6ae30dfaa64e986e9391d706b9dd432003a690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674887464, "uuid": "b36bca69-15b2-45f7-aad2-4b8b5407f28a", "comment": "Malware payload (GCleaner)", "value": "c4d98836c9da0873694887c3939a47a91c0d713216d9e40d1b1f0b24af6d320152f7e6750cd7ed91ce7c8fb2b3089b03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674887464, "uuid": "748caec7-14c4-4988-86d5-ed4e8b3eb771", "value": "T173B53307A1D09A76C8B689B69A225B94AF37FE87507D71013386335F3C676F094B32D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674887464, "uuid": "34aaacaa-245b-45d0-a073-9d05d23ebb45", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674887464, "uuid": "5fec038c-8562-4682-8a49-bc20cb0f381f", "value": "49152:okug++cXnrwjgbH4U1oQN5uBcKJSrIDdRDzz420jXByLCgv2MR:hug++ckPUPTXKUIDdQzBav2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674887464, "uuid": "ac313653-3454-4638-899d-42b859c6dfeb", "value": 2333740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674887464, "uuid": "704cae00-9a32-4ed6-873c-c36979d04ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674887464, "uuid": "5ec12a84-f7fd-4740-93db-3cbcc4c5b1f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be68335-9f32-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674927308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927308, "uuid": "0342dee9-5046-40d7-ae44-cd0d96d5e577", "comment": "Malware payload", "value": "1ce6f9703d37cf236ae7a752055622b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927308, "uuid": "f112f652-1929-4584-9336-294374c7bfa6", "comment": "Malware payload", "value": "134e1f5257f3f73d5f83575a42e64e8d0943e1455f0f77089af63df06b6bb8f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927308, "uuid": "b366e68c-cef2-456b-9451-a2a0b137ac07", "comment": "Malware payload", "value": "948b4a1c4e21935561e0fe0bb6f15569c376f447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927308, "uuid": "71836222-4466-42bb-a95b-8cc5a500662e", "comment": "Malware payload", "value": "e802401f5b102259e2b8c15bdbef0af78d9a16278a2b29191d4d7b1b9ce11165f757519e7ee59f98103c627558de7264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927308, "uuid": "28020042-5cd7-4434-ab26-65de0eda0121", "value": "T14015018C726472CFD85BD475AD996D68EB00287B971B5203901765EEAE0CADBCF210F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927308, "uuid": "d3192224-7224-4df5-b787-aa9ab01d289f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927308, "uuid": "0b157388-b2d8-4ea1-bb4d-67679159574a", "value": "24576:qqY/ansJEDxKsxRrY9nGstgOiJA8XiG1:qqY/aGA10G3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927308, "uuid": "a777a93a-8f1b-4eec-84f7-5c27d30fe495", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927308, "uuid": "22e9005d-7932-44fb-83b5-54c544e1d086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927308, "uuid": "a882dafe-05a4-46da-81fa-5f0d76b21710", "value": "1ce6f9703d37cf236ae7a752055622b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e4972c-9ecd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674884138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674884138, "uuid": "00183668-3c3a-4de3-a633-0b8e8cc6645f", "comment": "Malware payload", "value": "fc5084bb1ecf387e6b54913ed72838bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674884138, "uuid": "7849acf0-3f73-4fbd-8f68-c7f8c4b1bc28", "comment": "Malware payload", "value": "1399eb8820f9fa11ed25da25f99a25c67dc2d9fcf9220f6c85b62e66091c2da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674884138, "uuid": "3e240c47-70b6-4294-98f2-dea5c75f182b", "comment": "Malware payload", "value": "3f62a27a887d1b9c3cbf1f6481b21431dc9059b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674884138, "uuid": "c6e3b3e9-25b8-45e5-988e-b0c88e0517d1", "comment": "Malware payload", "value": "d19a7cbfd923d5fcbaab8cc566adcd80982547d23e65f44f44836668103cfdd7dec2c252b67073b207d0dc00bcddad01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674884138, "uuid": "7e3f5a32-cf1c-4eac-a990-c064bc93f6aa", "value": "T19976338179D6C47BD6179435C4742FCA79A3E3BB4BA2041F63B444271E2D88B622F62F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674884138, "uuid": "ac393871-d6e2-4c21-bd55-1d5a5fce50fe", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674884138, "uuid": "f2d907a8-8fe3-4750-8dff-528e09805027", "value": "196608:91OyyVtwnTPcKcltJqBe+Ru+oo3CpztQ2tqDMRcJWCCc1EBZkWQKPL:3OyyVan4KM2BvR8oypztQ2pyC6EYyPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674884138, "uuid": "5341c4ec-49df-4e3d-bb06-a0b2552f9021", "value": 7640098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674884138, "uuid": "91ada9c2-5f88-448e-a238-d6f38254583e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674884138, "uuid": "46b1b22e-50d8-456f-9519-3b0f4b3c5803", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8b0827-9f30-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674926536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926536, "uuid": "c035a443-08ef-44ff-b1f5-79d67ed25324", "comment": "Malware payload (SnakeKeylogger)", "value": "24690cba4301fe57d54b99a23baa5cca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926536, "uuid": "4fcce53f-a198-4c85-a629-a483465d5393", "comment": "Malware payload (SnakeKeylogger)", "value": "13b7007f4c163ebf9f97e33187e44cef00110c610b0fe4d25c4bb10a5a51b706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926536, "uuid": "17170f21-bf0b-430f-83d3-446382dc1b47", "comment": "Malware payload (SnakeKeylogger)", "value": "45301b0dca6044085695830ad6fdf6344169fbee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926536, "uuid": "611f109b-19d1-4b95-90a0-f50bcddd489c", "comment": "Malware payload (SnakeKeylogger)", "value": "3ea5a56684f2cc8daf4a556bd2ec504e45d7c371dd84e0003d64125ac7df21c8ab34138e14d39bbc5ab085980ee22667", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926536, "uuid": "8a02be40-ed5d-4b92-9f86-13cb59490330", "value": "T154D4124432A4C719D9ED0FF726B9690523FA6D0CB68BD3484CC565E72E717E20B82E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926536, "uuid": "e307105f-dabd-4bdb-88c9-e7f9634765e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926536, "uuid": "48260957-0969-42ac-9f88-9af97cd8d4dd", "value": "12288:BZ02iNqWgMlSYtz8L6gu5sq1Y3chUNCdLb5Syrd6tc5MI:BZ01tfoLrqG3AUAB/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674926536, "uuid": "436f8468-94b5-41dd-ae29-9fa8a11a1edf", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674926536, "uuid": "0577c9ab-f3f0-49a4-8823-dd6dcf06fba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926536, "uuid": "bf91359b-8dfe-46f6-9abc-b6af60ac1bbf", "value": "24690cba4301fe57d54b99a23baa5cca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586d5bcf-9f3e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674932563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932563, "uuid": "f8b4ff4a-73bc-4800-a5ca-332659cf70b1", "comment": "Malware payload", "value": "ed8ed832baf0feed4f345181d9a7c9a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932563, "uuid": "0190088d-4721-4bd2-bb4f-9b0ca96be3ad", "comment": "Malware payload", "value": "15354fb938f25d919b4565f696dfd72a22cad243ee762c0e90352feb85c7e3fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932563, "uuid": "06f4a95c-67a3-4f1a-a3af-018fa3a04b25", "comment": "Malware payload", "value": "4dd92d975c601961e0a9ba189592c78a69303fe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932563, "uuid": "4bb62462-0986-4e31-aa58-c768974c3d33", "comment": "Malware payload", "value": "4684ef3104bfccf39a1ade8a908cfef46f7081ec61b1f5d6368ea016e15955f1901e443b6637ae4fdc8cce944866970e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932563, "uuid": "2cf5ac8c-9be5-42b8-aabd-9f16737c0af4", "value": "T15BF52B6D7BB9DC30E40569BBC69185B2D506EC30E923CA5B3544FF99B836F9012F138A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932563, "uuid": "2cbb5473-6c08-4f04-9e47-79ac41442489", "value": "10902eddc81906c51a87c0aec40f3851", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932563, "uuid": "b2ae2165-f7b1-49a9-be1c-a44b172e5fdb", "value": "24576:PE3UEIY3GQgmQUnQQQQQQQQQQQQzl/ggJQI01A97dgMXd7d/1cJMsv3xafx0JcR5:PE3UqbrL5dfv/ufv3Ex9f8XnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674932563, "uuid": "43aeaea4-b037-4650-8115-24fea82a1264", "value": 3554816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674932563, "uuid": "0851f2f0-8496-40fe-9e5a-ff969a5884b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932563, "uuid": "dc7a8624-e6b3-4e39-bf35-1377591df5b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ddbb83-9ef6-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674901905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901905, "uuid": "4572ff80-2a3f-4f8f-9db1-f39234ba1f9b", "comment": "Malware payload (GCleaner)", "value": "2757f4f2add26b8caddf2bf5b81877c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901905, "uuid": "f1625824-64b4-49b4-87c3-701a83eb937b", "comment": "Malware payload (GCleaner)", "value": "160e2386b2824a054954fa7d6643451ae154f05f0780bd31ae495a83a32b0790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901905, "uuid": "dbe1963a-3228-446b-8328-d689b672525c", "comment": "Malware payload (GCleaner)", "value": "d46960ca5caa58f594bef3d4b684e5728dca88b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901905, "uuid": "ff01913e-92ea-44c4-9657-eb4a72c42d87", "comment": "Malware payload (GCleaner)", "value": "24771e764d5d7443f8f7529941fe023fe7081284b94c0076f2385106394dd09533aad3759c4058082d5be1daebf98c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901905, "uuid": "b7b1f3b3-5d06-4829-b000-7a8ddf766fd9", "value": "T1E2B5335ED5C3847DD0EA86B726306A00CF73FE97A03D049AB521139E2F3767026B6DA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901905, "uuid": "f78ba236-5386-4a2b-84cb-49867500665f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901905, "uuid": "6ae72c11-6b3b-477b-8138-9b129471bc3a", "value": "49152:okug+rOf2uZ1IdAOkOfMMn4i28a0fQcQ2yDejstpXXMBdYPBfLCgv2MR:hug+u2uZ116+i285jQ2w9BMQPB7v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674901905, "uuid": "762626fd-2fdf-4377-8086-a441a9e74de2", "value": 2386475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674901905, "uuid": "21fa8796-8b53-4978-beaf-06a9c8ccad63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901905, "uuid": "6fc1354c-f960-4b99-8762-fae4a0b443c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234feec2-9ed1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674885659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674885659, "uuid": "84db3b65-ca56-4578-9f23-043acaaea32f", "comment": "Malware payload (GCleaner)", "value": "a8e0099e34a8c5c5af171202f5efc4f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674885659, "uuid": "9cdf2e89-b980-4f86-8fd6-b2f2cdd06a1f", "comment": "Malware payload (GCleaner)", "value": "16ed7b58007b9797878d45c0f178cc88adfe7f4cbd8d6033ad5caa48aa1e69bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674885659, "uuid": "a7bc0622-7493-4de4-bc07-9bb25dc3178e", "comment": "Malware payload (GCleaner)", "value": "820114952bb2c2247a6c68c2add0c604d5aedf6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674885659, "uuid": "6b2f1d4c-5769-4da5-85e2-bf80ba638b72", "comment": "Malware payload (GCleaner)", "value": "7bd3a946790435ec941abab3b8c856761d24c285b730ee27cdb84dbb204c39ce47e8151a77873f0bb5b7b00cf46fe5e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674885659, "uuid": "9ea07f92-ce2c-4b9d-91cd-ee4258debcb8", "value": "T134B5234361C5C57EDD2A8ABF266496815F32BC5BB0FF284AB258239C2B327705C35379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674885659, "uuid": "5c8a5b53-0a59-4afd-8197-89612e663b3d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674885659, "uuid": "69d65f21-0bd9-45ce-be21-cea61249a8df", "value": "49152:okug+BAwI5Z2ONaOLpZD5693K19jrbTkO7LYg38oiMCtLCgv2MR:hug+BAwIqOzh569a1xr7vsblxv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674885659, "uuid": "bb022c84-b888-4c86-94f6-017ab66c06f7", "value": 2351778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674885659, "uuid": "ebeae0f1-3d0c-4cd2-815a-519c54bf2268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674885659, "uuid": "7768c21e-5062-4522-bc73-0c2d55eb5942", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b28363f-9ef1-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1674899550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674899550, "uuid": "d39c95fe-b6e5-4e33-a052-39b5295b3456", "comment": "Malware payload (TeamBot)", "value": "df1326eaf7e8a69ceac4a1ce478d53f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674899550, "uuid": "b5b4037e-4e31-4711-aac5-5f2cb035c2ba", "comment": "Malware payload (TeamBot)", "value": "17cacc5981ef45415b8ef6adbfca0aa5143350d52158fff9180cd9c3af3f4488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674899550, "uuid": "c4cad917-5f06-481d-bed8-fc00b54fc0b3", "comment": "Malware payload (TeamBot)", "value": "3dc70b1e11e613ad5e92cf6e9187aad50195d993", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674899550, "uuid": "8f6e047f-a8f8-4179-8692-a2cdf25dfbef", "comment": "Malware payload (TeamBot)", "value": "1cbee142b99378041dbe368d3622248c6358df0ecc619c795be8033fdbcea9438bc99a6f4abc308526e6fa54b6a39b04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674899550, "uuid": "124860d2-8843-48f5-a1c7-a797ac303a13", "value": "T1AF547D0167E2B861D92ACA7E8E2AE6F4671EF450CE15F37D1A049B3F14F1177C9A221C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674899550, "uuid": "e5e532bd-e0c5-4460-9304-9e49d284b103", "value": "02e2a6cbf522a2149390d29c2ff67ff0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674899550, "uuid": "01f3b289-cad2-4aee-9ec7-bb1df2791a49", "value": "3072:73/oFLPDl952HbFzYY6u4nHqs1/eDQNB2gPKsJJnIyCSyxzID1C7hZWfM/N9siuY:r/OLPDgH1YY75sBecWk5TqSwzIDMYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674899550, "uuid": "87add34f-3ebd-4e22-9636-fd2db0905a4c", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674899550, "uuid": "856dfd32-6011-4fee-99a2-e27cd479b54a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674899550, "uuid": "5219a5cc-88b9-4dae-a79d-8beedacb2a12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355768ef-9f44-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674935081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935081, "uuid": "64b623d1-a0e6-4906-b8e4-3f34a12fa127", "comment": "Malware payload", "value": "8f3adb3381bb7988e2868263f95bf462", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935081, "uuid": "42744983-9fd3-4aaa-9773-572021591579", "comment": "Malware payload", "value": "18192d73262c70be2f06e722443bd7e234161f563329d2bd499d1ebfdf5447b6", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935081, "uuid": "263187bc-1f50-4de1-a075-662efec68e52", "comment": "Malware payload", "value": "4be476d77ac8b38a5c3547c891e1f79a71c0626d", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935081, "uuid": "ca1a8473-e79a-4978-b7a4-67f2a76bdb1c", "comment": "Malware payload", "value": "41916d51cae2cf8401956f56c2ab825f7719c2b74ff59f9fe61c282f3181911a0a90a64d3be91b4ec045c58709d90fa8", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935081, "uuid": "ce1d0ad3-11f3-4736-9e2d-b188aabf9b97", "value": "T155A2C038EE05F088C8B646BCF94E24FDE6D46517A32444B2041DC79EDE911676B2A1C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935081, "uuid": "445c1c91-f075-4a0d-bb65-0eb22d72126e", "value": "384:/i6AtzJ6EdD8EzSISGFDH6EGgNxt/ZtNNMNKE9l+30Onn/df:/7KzMEGCSISGFDHzxllNMTl+3B/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674935081, "uuid": "e48ad381-7830-45bd-bd05-283de7fe5695", "value": 23152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674935081, "uuid": "916d04eb-fe49-491e-b5ff-a58e3ec9af91", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935081, "uuid": "ac583389-a385-4c56-a055-aa96352086a2", "value": "normal.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a8f56c-9f32-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674927323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927323, "uuid": "0469bed2-9e17-4d2d-b1e3-a2bc3d75e2bb", "comment": "Malware payload", "value": "225df32045d29c29b60c0f8998a51402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927323, "uuid": "1da9da48-8b47-49db-a268-3f2bbd0cd937", "comment": "Malware payload", "value": "1b42f4d5b0db1d355bd373e980683be621e37a2929c7090c7bd82183cbe18d48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927323, "uuid": "2f02df82-d20e-4048-ba83-6e815ed9c998", "comment": "Malware payload", "value": "7f182bc8a6ad54963040999e8bd01a556fa95d80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927323, "uuid": "f0d03457-e503-41a3-ab4b-1b7e116d0d14", "comment": "Malware payload", "value": "0bc30b80f8c9aa757500505884f3f2bf0185aba9c1efad642ffad10403d2dc278f6e5fe55d627b1ad12610d1516492ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927323, "uuid": "9e04593e-e59e-424a-be8d-e3d72fc4f2bd", "value": "T10AA54A13E102C46AD53E1EF021B697392D79ABB9087CCD97E7D4DCB5AD1393287A260C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927323, "uuid": "1916e4c2-3587-48c5-b9fb-4346953846d8", "value": "9165ea3e914e03bda3346f13edbd6ccd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927323, "uuid": "32dae089-4d4a-4c31-a43c-6a7da796d75b", "value": "24576:JhJRLimQzSxJ8BHGD3xHQTAMCQe/XWmHJU6NkY+3o9OvK4noC+U58SCO+eCt6X/F:Jh3XqTkU62odSC/eu6vS3q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927323, "uuid": "33a0df28-cfbe-4a91-bae1-13f76d0d60b2", "value": 2164824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927323, "uuid": "b3644e34-0ea7-498a-8740-b48080c585a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927323, "uuid": "e6256335-30b2-4a4e-ab7e-f832d8bce1f4", "value": "225df32045d29c29b60c0f8998a51402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55566ed-9f58-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674943967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943967, "uuid": "c2637816-79fa-471f-8203-a6c74e6147c9", "comment": "Malware payload (Mirai)", "value": "c82c17c9d96650eec977c7dad69d7d9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943967, "uuid": "716f4a77-5378-4189-98c9-32f954a5b4c2", "comment": "Malware payload (Mirai)", "value": "1b83bf3f48604f30afcf976b45762ca0a229f225a899e4ad17499d6f4c599111", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943967, "uuid": "b1502613-778c-45f0-8d8d-17d5ec7d62e7", "comment": "Malware payload (Mirai)", "value": "27e8721ff2bc188d607ece6da58a54c83e84d171", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943967, "uuid": "1f62bfa4-8a6b-404c-8732-be3bb5f1163c", "comment": "Malware payload (Mirai)", "value": "86ff589e14989becf3357b6b52911c1a818de01dcecbad8aed72d754854ab43b058b275ccea98917b6329974ac41f16e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943967, "uuid": "d8b35641-1485-483b-815a-8e3a69e53ef2", "value": "T17733951AFFA14FB7E8AFDC3349A90B4230CDA51722A43B657974D428B25B64F05E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943967, "uuid": "ae02c28f-0a01-4cf4-8036-5ea03dac7ffd", "value": "1536:v/jMVhMQQZTBKNGOysC2NEC8i0FZZNz3DgZ:v/jMWYZXyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674943967, "uuid": "aa660d51-398c-4589-bc17-a54d0bd8bf01", "value": 51292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674943967, "uuid": "8e54e9aa-7296-47e4-b953-fcc6753cac3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943967, "uuid": "1bae5f75-611c-436c-96d7-5a5a4ee9a33f", "value": "c82c17c9d96650eec977c7dad69d7d9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c016ca64-9f4d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674939180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674939180, "uuid": "2a7a0704-f467-4f06-a96f-6710b0c6da87", "comment": "Malware payload", "value": "6367cde4b4d32d74d1e3b909c5c2b09b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674939180, "uuid": "bb1b2989-7c03-4716-a7b0-bfe7dd0c2656", "comment": "Malware payload", "value": "1c88acfa1fbf821575ef50accce2de9fb1221cec20ba238c802315b7cb5a5452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674939180, "uuid": "0ac9bb70-3902-4602-93d9-0b86e613fd6e", "comment": "Malware payload", "value": "e2ca61182ead93b17f7f3ec5b0ad52bd39f77ecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674939180, "uuid": "6f77f362-68a0-4e57-b70d-88610c5afa20", "comment": "Malware payload", "value": "7ef83cfab20159d77990a9b2b6fae068c8a732e22c0c9b07e581175bb9674e383eb5734e36d3641c86e6e57eacd252e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674939180, "uuid": "63d84e1a-168d-4602-9a7a-7d674d6339bb", "value": "T1C6A4CFD3775086EBEC391D3656A393261F362C57DA818F0302D4B1A27EF36903579A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674939180, "uuid": "25214386-0b68-4f30-8c25-160a7a585679", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674939180, "uuid": "a5b4861f-bae1-4e36-ae8c-6f9a811733ea", "value": "6144:KVGdx6xXC+OCQqddn5Vh2XJXdDAblEXiJy/6soFXE3p0TXutBtEr2OSQVS2Tj:e9Cbq7nh2ZCwiJyysoFU3AX0BtHOVS2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674939180, "uuid": "21d75abf-4c71-4736-b672-52e846746858", "value": 450440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674939180, "uuid": "46e3d9b5-0ad3-4ec3-bcef-7b44fd646ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674939180, "uuid": "237201c3-0724-4c6e-b492-98255ab3ec6b", "value": "PO228512238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fea554-9f4e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674939643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674939643, "uuid": "c9aa1cf0-eac0-4990-a5c1-755839788383", "comment": "Malware payload", "value": "6127313ce3145d52e28d04c01f5e2a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674939643, "uuid": "cdb91322-822a-4645-9f90-41e78d57f3ac", "comment": "Malware payload", "value": "1cb8fe41a869589b76c0c9f614003249fcf743fef9660132472d075abaef8e8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674939643, "uuid": "053e8658-1836-45cc-8686-7b60b1594e29", "comment": "Malware payload", "value": "86a8082e22e29e88171f7af06302b3ed98e5b24f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674939643, "uuid": "a4ffa1ac-1e2f-4877-bd84-8990a4606e62", "comment": "Malware payload", "value": "10d1bcabcb8d2c5c666e2214e65e4623597f757203ab02ed62b8809aae0e40665583dec448b15890e9d5c6b536931b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674939643, "uuid": "ec2ddd2b-1f70-4acf-b371-3ee166d457ef", "value": "T11BB53303C1F3B5BEEA02CA7B11355141DB33A94BA03E1163716D67EC2CE7E205AB76A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674939643, "uuid": "8e890738-906c-47fc-991f-e2f2ef818509", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674939643, "uuid": "c512c076-15b6-4476-ab1b-f6c430120e5c", "value": "49152:okug+7ebuwkDDTLcFVmLkYIuxZHkJXeALCnaN4CsIV3YxwNa5LCgv2MR:hug+71LcFMLkY9jweAmaNwIyxjVv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674939643, "uuid": "5b5652d5-9073-43dc-ac5f-87acc4d9101f", "value": 2379975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674939643, "uuid": "b9e905cb-3bb9-4675-a00a-754121e087e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674939643, "uuid": "9997aafb-406b-4eec-a101-ef3cd30e9c84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78245f83-9f24-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1674921450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921450, "uuid": "adf1ae01-691c-4e90-85a2-698989fdce2b", "comment": "Malware payload (Loki)", "value": "af1d82ddc77d092be0ce90590eeeec92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921450, "uuid": "fac05dc6-efdb-4c50-9eba-a1f7ab0a5adf", "comment": "Malware payload (Loki)", "value": "1cd771d7ce1ada72b26d9fba9b689c7847b1cc501fdb0b80ec97e7a9f7fadf0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921450, "uuid": "7ced3963-93d1-4809-aa99-3a4d8c98c0fe", "comment": "Malware payload (Loki)", "value": "8ddc25499d6e6bf6841a5494011a99480cebcf00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921450, "uuid": "6f34e04e-2b83-41fd-be04-47e3d8f185c5", "comment": "Malware payload (Loki)", "value": "c800f0e1a715b1ec101efad59b37a68d884481cb85caaf9d700f0e79fae2105a8e23c556b3298f489d2e1a03bdf2b93d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921450, "uuid": "ea97815e-530b-41ca-9577-96f2dd2367f5", "value": "T11F058C056E9B207DEC65BE3A91FEED27E62096C1075BE531D0E21EE48D9B281CC44FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921450, "uuid": "12bc04b1-4871-4ab3-baca-7a1575b2c346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921450, "uuid": "bce15726-3d8a-4674-808c-5f7323641569", "value": "12288:YE6GaMzrAP8Is5Zz4p71LN6V201Yc31MFhRTmZbk53jY08b9oO:YE64AP8Xkpx031Md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674921450, "uuid": "a83e0e10-b2ea-4558-86f7-1ab2f717e41d", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674921450, "uuid": "1fee4607-2bff-4c09-9bd0-e919d4d435a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921450, "uuid": "d540d585-0bef-4fa0-867e-26a1f297744a", "value": "1122200567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868ecc02-9f5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674946385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946385, "uuid": "ee134c7d-e548-43cc-a347-95e44a7aa14d", "comment": "Malware payload (Formbook)", "value": "546c750381af88cc827058c327f705e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946385, "uuid": "6b14a693-71d6-4d0b-8104-dd5e5a3be8cc", "comment": "Malware payload (Formbook)", "value": "1dccaaa88894b5ca21caab99c9cdf088dfe8e2d7bd1fcd0b133150a557b863c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946385, "uuid": "04fb3ce7-c5d8-4767-a4ee-1e29252716f1", "comment": "Malware payload (Formbook)", "value": "90e257845558e06089642a82b0c38d98c48f344a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946385, "uuid": "740addf1-8d3b-480a-ba24-7a8e6e459a93", "comment": "Malware payload (Formbook)", "value": "ba7eecb643c9b3aa6a4e95a8bca350579fdd8686ea3d471b074cec6a12e548d94db4725490d36f29740bd5390a5a5276", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946385, "uuid": "cd6933c8-d031-4c2e-9290-3a57e21abb56", "value": "T1E0E4E6B579B09E09D5010DFBEAB8E94462D33D2F75529908EAB37D0BE2678C17B4C123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946385, "uuid": "09e689b4-b949-4229-95f2-c223d24576b8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946385, "uuid": "daee74fd-0bab-4aa8-a58f-f3aaf0ccd5cb", "value": "6144:IYa6UaG+oyS2U2J0Nzt17RUiDWJizOoqIxPscvQ3xBFb9mj:IYuaGwXU2SNJNRUiDYwi6A3X6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674946385, "uuid": "b9e0fa0f-684c-4377-9247-9fb8193099cf", "value": 709018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674946385, "uuid": "01732326-f7db-44c1-9f15-c5750bc932bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946385, "uuid": "546f976c-c4df-4092-8adb-2182a4cff517", "value": "SKMBT_42323011112500_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31e5fdd-9f00-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674906060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674906060, "uuid": "69b67bc9-9c83-40b5-9400-78b7f3b2d47d", "comment": "Malware payload", "value": "e575f72511be992453dd092d23316edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674906060, "uuid": "1fd3651b-f2bc-48f4-9c99-ba7ec677ea95", "comment": "Malware payload", "value": "1fdd6d6bcf6bdbb1773d5106fc62b125d7add8f9fa41d4ff728499dfab960b83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674906060, "uuid": "e267f5fd-a0fc-4518-93df-cd550bb8a76a", "comment": "Malware payload", "value": "4049cf1aab183171726f897b062c61a1c3e7c392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674906060, "uuid": "46c88b87-6d87-4524-83fa-b5c2945417f2", "comment": "Malware payload", "value": "f9e2693fcf382e203b4f6ea0b7669b8f4c33bd7b765d907fabf5c9ff551feb35270df42a86b73f58798908fca14a97b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674906060, "uuid": "429281d0-01c2-4879-a33c-0dc7ef32d752", "value": "T195763B47F85190E4C1AED230C626D2A3BA717C894B3027D72B50FBB92F76BD46A79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674906060, "uuid": "96f80dc6-26fd-42bf-82b9-117455057105", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674906060, "uuid": "f2f9734e-4a9b-411b-beeb-5a99108d4b21", "value": "49152:F+ECt5J5v1wnrb/ThvO90d7HjmAFd4A64nsfJtpIClsfRuqYP7DKKaRMD4euJSEw:8jRIuTmS4piSyhEsAzk38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674906060, "uuid": "6dac86a3-d790-46c0-b834-8d2101ed1e21", "value": 7806976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674906060, "uuid": "831ddb3a-3338-49e5-9a20-102d07cc9481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674906060, "uuid": "ed20cfe8-a61c-4d29-b2d0-90e235bad1d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a6d2e5-9eb0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674871780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871780, "uuid": "2c0d2dfc-0f2d-4d52-b8d7-0071b0f65407", "comment": "Malware payload", "value": "80835f358fc78c40ef601c0c04aa1ef7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871780, "uuid": "836322ba-68a7-4eb9-ba06-2002770bad7a", "comment": "Malware payload", "value": "211d04bb0fe1ed1946e17d20a621be11ae90bf27bb2382c0b7ae2267ef1ed926", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871780, "uuid": "9587b81a-b364-45a5-adc3-c42e8904f80d", "comment": "Malware payload", "value": "d3c617354b18f4bc6afa0243aea4358a35292047", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871780, "uuid": "3dd612a0-4de5-418a-b4b8-be6db40adf6f", "comment": "Malware payload", "value": "09b39b34b78d0b15d0e399e4fdec1d3e8a92b52b163d444f45c68d93b0cb52550f8c382606d595aaf22fc590347c1fb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871780, "uuid": "1d45d82f-4ffd-4487-8c06-a84ad664c62f", "value": "T11595F31AB6015F3FCDD54872A51548846A232AE8C28F234EA4D6517B1ECE71FEFBC16C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871780, "uuid": "fbdd2710-477c-46e9-99eb-75f0dd54189f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871780, "uuid": "3686a90f-d6ae-4480-ac33-9f1fd0a1248e", "value": "49152:8oypzJb6s6Zj7SYNIGjcjUE1HEaZZLJTpEm3E:8jzoPF7SG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674871780, "uuid": "d72fae43-1e9f-4ccf-87da-a28c8677c7bc", "value": 2051240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674871780, "uuid": "2a5a7e78-3426-47b9-96c2-4481368fcd0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871780, "uuid": "2ffef13f-2de0-4e1c-973d-dd4764f3d246", "value": "80835f358fc78c40ef601c0c04aa1ef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1470a6f4-9f14-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674914410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674914410, "uuid": "45f00c04-3e02-471f-89e7-8438219da55a", "comment": "Malware payload (GCleaner)", "value": "a2062ea5263f20d7aba3020fcf54ee35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674914410, "uuid": "047873bf-2eae-492b-be31-f90eeb4b4dcb", "comment": "Malware payload (GCleaner)", "value": "22193c6038897ac92011b43cfef1ff45b4ec0fb3301bad25e9ddcee628e7cc30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674914410, "uuid": "b2485dc1-3e53-4458-8c77-3041b272d158", "comment": "Malware payload (GCleaner)", "value": "f16973a8f46be8be7417bbad95625c617c94e2cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674914410, "uuid": "a2c0c72e-4f41-4580-8e22-5f1483f7356d", "comment": "Malware payload (GCleaner)", "value": "17bed0a6878db75e96f0e3d0bc4747c4027e750ad64b827729acf3fb8d274e6d57f17fafddaafdf076aecab9bcb3869c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674914410, "uuid": "5de49fce-5825-4929-a047-66997028038d", "value": "T197B533A594E1C4BAD56357F617395201EBB3FFAE563E0006321A26CE0E522F035BADCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674914410, "uuid": "7069a509-2a45-44e4-971f-ef73f7d903e2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674914410, "uuid": "35ff6cf3-3967-4212-8b5f-f78450707619", "value": "49152:okug+q4m4DiUwqeh9MyvR4QjXwgDInAkctRrKBiqc8YMB4LCgv2MR:hug+q4mniehKyvOyXBInAHTOBiOYMKvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674914410, "uuid": "e653ee73-5993-415f-a598-244c2e4d8fa0", "value": 2381697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674914410, "uuid": "72832516-b5c5-4a38-bccb-acfd19b4010d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674914410, "uuid": "087660cb-ea2c-496b-b36a-5cb88b5893f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92bd89de-9ebe-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674877686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674877686, "uuid": "3a18de6a-9998-40e5-8bd2-76745ec2dbbd", "comment": "Malware payload (RemcosRAT)", "value": "0589dc264a57d833c4c0246dad8261a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674877686, "uuid": "6719793b-b33d-49e2-bea2-de246dc8defb", "comment": "Malware payload (RemcosRAT)", "value": "23dc5d937451c57dc7137a2c84ff7763822b5bf627fbd8ab6b5305e4f0a0bb13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674877686, "uuid": "3ffece5f-b441-403c-b7ab-afc0504e8532", "comment": "Malware payload (RemcosRAT)", "value": "03d2e4074ca20a9a96f4cf356bd3ba53fc38e343", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674877686, "uuid": "e6cd9007-4819-4c8c-b6e3-ad5db76eae5b", "comment": "Malware payload (RemcosRAT)", "value": "1c018c750b1c129ff4ff546754ef3a4465e91db41e06218855574c1b9ec7b8a027735daf67636eb71da4f60bf5ce33b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674877686, "uuid": "ff1dacaa-967a-4a2f-ae06-7a7475a6ea99", "value": "T12DF48E6E62B8C433E02707769DAB57E94836BD202925D44FBAD57DCCDE3A3813439293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674877686, "uuid": "6f950724-1792-4133-a2f9-592a6dd74a5e", "value": "f0165a9d7bcfb8fa29fd32e4d73bad5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674877686, "uuid": "e5acf0a5-31aa-465e-b4c3-b46dcef231ba", "value": "12288:nXCSJ638aXV+o1zl3qJVkdRTYJO8t8q0NVlstZo1PkB0lEKjh4jieNt:yUk+o10JVE+Jl8FNHkmPkBPKhheN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674877686, "uuid": "7803ce9d-3ffa-4333-983f-13b9943bd8e7", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674877686, "uuid": "eda0337f-caa1-4f1b-9f9e-2521d7cdb778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674877686, "uuid": "4ad87f09-1d5a-4094-8a34-9f8b44459765", "value": "0589dc264a57d833c4c0246dad8261a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd75afd-9ef6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674901518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901518, "uuid": "68ce1e34-9ccc-45c0-bd7e-2ae9df98a19c", "comment": "Malware payload", "value": "fef66efb3a08608ce0b215b1f5441eb6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "IKEEXT.DLL", "colour": "#78F22B", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901518, "uuid": "2b721107-b9d4-497f-ab6a-4807d8410eb8", "comment": "Malware payload", "value": "24e0c790fe25464d2ef6b4018b907ff9ba97cafddd1da305ab71ea0b4b2a13f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "IKEEXT.DLL", "colour": "#78F22B", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901518, "uuid": "ac1a482e-04d6-4770-b21c-76b0249b6fd5", "comment": "Malware payload", "value": "93e6d882ea3cf90159f7b7a1f36b6fb8b1b0912e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "IKEEXT.DLL", "colour": "#78F22B", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901518, "uuid": "f95b7f21-6173-48cd-b0a2-79ddf0ee8f08", "comment": "Malware payload", "value": "2bc4b7eb1191e58801f586a9050fc7b54e2bcc2aaf718cdaebae6e117cab020bc38cbf5affd9dcb05e0695701a5a54e9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "IKEEXT.DLL", "colour": "#78F22B", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901518, "uuid": "58b9cc39-01eb-4659-a84a-77f4a7bb6b4d", "value": "T124254AAD62F001A9E87AD178CA915707D6F2B828277096DF42B081782F53FD36A3DF54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901518, "uuid": "494bf065-938f-4d7a-975b-4677de857242", "value": "58c366547f57d097b2105719ecab56e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901518, "uuid": "7b2a3490-b295-47bc-8d08-96e70c60ef5d", "value": "24576:ZVKkHwZOqWfJtvhKrQb+9T9p3AobuPCkngnranPC8D2hNcNvfGqAp:vKkHwZNWfJtvhKrQb+9T9p3AobuP3ngp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674901518, "uuid": "3f4ef4d7-bad2-4680-9d3f-ea8da0537a7b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674901518, "uuid": "d12a2b38-646c-4b8c-9dc6-addea8e1cd30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901518, "uuid": "1b40e768-ceea-44d9-8075-60ef55fd2c4d", "value": "IKEEXT.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61b73b1-9f07-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674909152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674909152, "uuid": "8351f6b1-6150-435e-a0a3-370ae07f3170", "comment": "Malware payload (RedLineStealer)", "value": "7ec655a4423a1904b7a0d8a237076426", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674909152, "uuid": "2106c9c8-908f-49a9-b2a5-295032ea4b33", "comment": "Malware payload (RedLineStealer)", "value": "26c28e7aaa43a8f4210779b9c756390bd73f645c7b73fe1cc700fcec4454da9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674909152, "uuid": "9111b6ac-7272-40f2-b69a-76f57449a111", "comment": "Malware payload (RedLineStealer)", "value": "b7a92fbdcbfe555b2f7c1f8f3ab47bf720b20ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674909152, "uuid": "0c1637ad-bcdc-48ed-84b2-48431e41c477", "comment": "Malware payload (RedLineStealer)", "value": "135ca928281f09a065e22b12a2fdb6ed1adb103b764d877a563f37dc3bb98ae3fc613841b5dff5145699a3d187a7d4af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674909152, "uuid": "9544b8cb-3721-491d-862c-f9081e109a29", "value": "T16C84BF0167E2BC60E525CE7A9E1AA6F8772EB4508F3D736D2A045B3F19F3177C562208", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674909152, "uuid": "75372891-71a1-4662-a3a6-906ec460da2b", "value": "d191080c270d3118935d8b6a682d2ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674909152, "uuid": "05a89bc7-694a-4bab-aa77-c1b182214b23", "value": "6144:RL0wSGdbk40alHo/j1+PjEW2Y9cqSwzIDM7iP:RI1GFlhsMNwqSAeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674909152, "uuid": "f8c38137-706e-48f1-b139-09eee3ffdf7f", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674909152, "uuid": "717e2162-21ce-4c2d-b24f-06b152fe7b1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674909152, "uuid": "450b8cd0-7749-49dd-967a-bbafcb8e06b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c71811-9f32-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674927507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927507, "uuid": "2a094fc1-321c-47dd-864c-77981cca834b", "comment": "Malware payload", "value": "58583835dc3c2cad25d2eefec8f4aa7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927507, "uuid": "5fd8e056-ee91-47d7-9928-a1bebf5bd2bc", "comment": "Malware payload", "value": "27966f9978a1ed77868b2d7827ff6581d6da7110421bd6179fc5ccca21e65060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927507, "uuid": "005a214b-8e3a-4ffa-8cca-05fc6672e747", "comment": "Malware payload", "value": "eecbe1cafa697ed88c008f8a986bbf3f32172659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927507, "uuid": "951a59f2-e8de-4272-a204-4f3c4d732b13", "comment": "Malware payload", "value": "5fa5bbd108f8c94b403d381d193bf31e8dc20ecbecf19192d0e7d8cda7ec2b242085e654b71f65e03a8572d98d9eddfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927507, "uuid": "2ae3293b-f346-4874-8403-1f4cf3c82a67", "value": "T14174B00266F1BC84D953EA338D1EF7E8B52EF991FF5426F91208AA0F19B1DA1C563311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927507, "uuid": "819f2dae-09b7-4895-b83c-5b929346b97b", "value": "4bc9925dd568c221c7d9868dfc769dfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927507, "uuid": "307fcf90-3555-4c85-a0b3-0e6f0eede1d9", "value": "6144:LWZLftre/j9a/RM/FQSj/NtETGzxdak8rx9CEbnVnHkA8dV:aZ7tO9BRjFtETcjb8rLCWlHudV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927507, "uuid": "56f99956-d702-40e9-a146-d19e53a01435", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927507, "uuid": "30a89048-c8b9-4c7c-a3c1-1ae379fae326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927507, "uuid": "da4e5061-6731-47fa-833f-687d9a1c6d8c", "value": "58583835dc3c2cad25d2eefec8f4aa7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7015c1a4-9ef5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674901250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901250, "uuid": "bc1f5cf3-7d19-4d5e-a5c4-9508ca8c3f5c", "comment": "Malware payload", "value": "b5873c8b67e556261f335fc7cc70e32b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fntcache.dll", "colour": "#9402F7", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901250, "uuid": "601c75fe-bf6b-42c9-aedf-e857f42e53a8", "comment": "Malware payload", "value": "27e5394c46f50aab1bd7d50f636a59428071c773ae09e5e96503b1921e7a5c5f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fntcache.dll", "colour": "#9402F7", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901250, "uuid": "8c91323e-879c-4d30-b726-8cbc5469d04f", "comment": "Malware payload", "value": "eafc2a204e711b59e4cb5cd67d3c671a05967d35", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fntcache.dll", "colour": "#9402F7", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901250, "uuid": "2f62e3ac-9931-407b-bfdb-39073c68d6eb", "comment": "Malware payload", "value": "4971545686fa902cff4ad545cc51a1716d09adfd21ff62997b67abd965cac069d3a8ced1864cabb194e57b3562760ad9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fntcache.dll", "colour": "#9402F7", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901250, "uuid": "45cadfcd-efa6-41c2-b389-d187005f236a", "value": "T138657C55EB18C2A5D1A7C038C6C6864AEBB13031CB3246DB3DA1977DDE37AE21639F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901250, "uuid": "9f98ff16-9b7e-463e-a907-c8a8470b96f2", "value": "4d12136e5ffdb9004998db6b1e1a52c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901250, "uuid": "224903b8-a69f-45e9-950a-f89b0efbb5b6", "value": "24576:B9Yw9vCL5toKKce+2G23JmQbQPlgtXXeuMQA:BWuvCLgKKL3GAJmQbQK9uuMQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674901250, "uuid": "d169d229-e4db-410a-93c6-78b11604c9e4", "value": 1423872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674901250, "uuid": "78fdc9cc-5699-484a-b3bf-390e83f2d160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901250, "uuid": "f37d2b07-4d5a-4fc0-8400-2df5c6df9fbf", "value": "FntCache.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c818079-9ed0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674885379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674885379, "uuid": "5d64e99e-6856-4b4d-99db-65eee7370b65", "comment": "Malware payload (RemcosRAT)", "value": "4602a9cd04e5ea382b41b93132d9aefb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674885379, "uuid": "229556dd-1092-4a4a-ab4f-0523edca557e", "comment": "Malware payload (RemcosRAT)", "value": "282f91fa5f97cf075829ce5a82abfbd642939afd7d38046348f51d7e5643b97d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674885379, "uuid": "c0896b30-7cca-4080-93da-55d763acd793", "comment": "Malware payload (RemcosRAT)", "value": "deadedea6002401c71dec20f9117d3d813eb3c3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674885379, "uuid": "69e17c7f-443a-498a-9cd2-b31adaac112c", "comment": "Malware payload (RemcosRAT)", "value": "0485c80b3e7192cc9326ec3a1158706cc04a865821f64ea1efd54a74803d92e574640450d6c20a1f5a158d4006e8f246", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674885379, "uuid": "2d6ccf4e-aafb-47e3-b881-14022affaa62", "value": "T13225CF5023EC9B41F6BA4B7996B9405203F7BC827573E21D8ED130DE4EB2B04AB46767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674885379, "uuid": "97e97b62-80aa-4ab3-975c-621cbc48f5fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674885379, "uuid": "d7d9cb4d-dcf7-4c5d-97d3-8ddd9c6504d4", "value": "12288:zSkOvbnR8ey/ZhiWXD4zFqIGyi5Uv1ehKxHN14V8VuDkuldWEN6NtKfr78/5qimv:HvivXGvwehiHRIDkjEN2c78Q5h3y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674885379, "uuid": "7a44832e-9048-4c30-b79e-03b603993c78", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674885379, "uuid": "ef8549ea-fd81-4aa5-a83f-9c2b112b3f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674885379, "uuid": "c3ca1bd8-25ef-495b-9392-7efd1cf7406d", "value": "4602a9cd04e5ea382b41b93132d9aefb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80abb71-9f56-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674943085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943085, "uuid": "b20e472a-f1e9-4e36-ad77-11791118b3b1", "comment": "Malware payload (Mirai)", "value": "6f109e0392dc66aa701dc1af31c8c22a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943085, "uuid": "6dc6cedd-070c-4af4-96b1-87a08b592918", "comment": "Malware payload (Mirai)", "value": "29cbec81fed108b1f89112eb1e1076cefe71c60a9a43a0bcade1b9c56e5e0fb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943085, "uuid": "b062445f-acb5-4af5-ab55-03ed6e1b9a3c", "comment": "Malware payload (Mirai)", "value": "f436502a9da7e8e408e766b7792c25cc18b474a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943085, "uuid": "c151ad26-351e-47db-8652-ffe9a73f74e5", "comment": "Malware payload (Mirai)", "value": "0a4050d281c96a26f8c0cf69a63023a9cee54ca7df26ccab1d34da13eb72312cb796ac13f0dda2bf57faae3620f3a5c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943085, "uuid": "59738957-4075-4110-92b4-b1f78eed4df9", "value": "T1F8C2F7A9BCA58F59C6D1A176FE1F9AAD3301E3DCC3DE37038E181B112A4761D1E63940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943085, "uuid": "accd2351-8d93-444f-8fa2-a08047e576b7", "value": "768:iz7tU1uhiLpSgOGkJa1QPGs2vP5543qW3pxje4WKjNn1vwj:XpD1452v/nYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674943085, "uuid": "ab29528e-1099-4b2f-a09f-b656e75a256a", "value": 26264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674943085, "uuid": "8ef3fa40-e4fb-496f-9684-625263de840e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943085, "uuid": "8bf179e1-7c23-49d5-ae7c-962023131eb8", "value": "6f109e0392dc66aa701dc1af31c8c22a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf98a700-9efa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1674903558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903558, "uuid": "ff80f063-d748-4021-9a54-6c3e21e2dfde", "comment": "Malware payload (Amadey)", "value": "83baf716c50b90d398e1285d0c8c04c8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903558, "uuid": "5c4ef66a-0a64-4bfc-a559-c3c45706fb7b", "comment": "Malware payload (Amadey)", "value": "2c18cc487d7d1078460dce7e68108cb99eab6cb9ee1955ca4df3b2376f0a0e8b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903558, "uuid": "64749ed6-3e8a-4c15-91da-f869ada8aa97", "comment": "Malware payload (Amadey)", "value": "f3fcfe9bc9979ee7e3788507d10499d031df4c5c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903558, "uuid": "7b69b045-6da1-40f8-9c61-100f370d42ab", "comment": "Malware payload (Amadey)", "value": "d8853652002521564f26895e18ea6ff0b6d81053f51a40f7ddc78d576e1afd24a60a9074105087700e903da4e75f9b96", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903558, "uuid": "feb620a4-4ba0-4741-8d0f-84eb0e56e35d", "value": "T1772612641AA7805DF4B4CF7550B5BE5DCC0EE342BCFBBD2D2186800D9ED5EA1AA1218F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903558, "uuid": "66f0ca81-9dd2-4aef-94c9-c6f807be394d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903558, "uuid": "30298b92-0e06-4b68-ab02-f04429ca2f50", "value": "98304:XNuy0rzmaXuKBh0MiS+dOUOTvwuw8/VnZaSavvETlCC:duyGKZKBh0M6ObT19Z/u3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674903558, "uuid": "63d289ad-d78f-4880-a1e3-4bba706ff604", "value": 4759040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674903558, "uuid": "88f6d4d5-cedc-4990-be02-e3cc3896bcdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903558, "uuid": "118ac034-36af-4088-acf8-35e832006c52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5a53ea-9f3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1674931521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674931521, "uuid": "1f2710ce-0ad0-441a-8794-d654d00fe3bd", "comment": "Malware payload (AsyncRAT)", "value": "5aca87b329e510f9936fdf17da5e6978", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674931521, "uuid": "91c51919-e74e-4730-88dd-019a24838408", "comment": "Malware payload (AsyncRAT)", "value": "2d845a940455c2a76830271a2cb98389b2722d41c794a11cdef653029b301d99", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674931521, "uuid": "2ee454de-9476-4878-8a76-eefbb20e138f", "comment": "Malware payload (AsyncRAT)", "value": "c5d4931a1b6909447af2f245ac6d7398ab50163b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674931521, "uuid": "50693db6-2758-4647-8215-199af1d800fb", "comment": "Malware payload (AsyncRAT)", "value": "aa092031738c99b976626824da6dbce39c43d34458c907664c8c135b1f0abfc752dfc9dcba286140cccd5e6899a0b4ce", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674931521, "uuid": "fe347e81-0e02-4c5d-8299-4c45c0abc023", "value": "T10A232B003BE9822BF1BE4F78A9F26145867EF2633603D55E1CC441975613FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674931521, "uuid": "3e796eb1-27b2-4f77-9ea8-b19bcd6f7e25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674931521, "uuid": "365d580a-3493-40ea-80d7-daf437018073", "value": "768:Bu02VTBRlc6nWUbmelmo2qjrKjGKG6PIyzjbFgX3ibONY+djf0tqBDZlr:Bu02VTBnck26KYDy3bCXSbsHjfo0dlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674931521, "uuid": "f6cfbe7c-3fd0-4d88-8815-7bc83a88717c", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674931521, "uuid": "bff5b3da-9d33-4ca0-8482-205c4c8e86ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674931521, "uuid": "1adb9076-5d19-4e60-8210-bf47df5ffaad", "value": "5aca87b329e510f9936fdf17da5e6978.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57d0628-9f46-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674936263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674936263, "uuid": "95665b73-afe0-4975-9751-cb7de9e324b9", "comment": "Malware payload", "value": "1301c00414ffc24f04bffcd845bb23b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674936263, "uuid": "88459808-7c41-492f-ae52-0254e052931a", "comment": "Malware payload", "value": "3100fd652b0ff7c696ecb90bda4a3a067bad30db35e724a541647fb0abf8ea97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674936263, "uuid": "de6b1a6d-c0a7-41b3-a33a-3699a9b6ed6f", "comment": "Malware payload", "value": "487747a976284c1c4b4585dfa1cccc0527446a3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674936263, "uuid": "9b9193e8-dd60-464f-8d10-6334a3fda579", "comment": "Malware payload", "value": "fd0349820ceb5f91a447489a7cf59f18ee7a236ce43deefa2fca10fab5140f9ec89ec0aee7a35f9c401acf45273202b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674936263, "uuid": "4ee4d737-5328-4895-a6ca-f0f98f25a2fa", "value": "T1EF7633A238E0C176DCF08C37CF162B759AD2E6591F639623B366C31C262A2C55D91FB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674936263, "uuid": "a88c9408-63a1-4e4a-95cf-90e754be4fe3", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674936263, "uuid": "932bf2b6-0206-483d-b123-5a436b3cba6e", "value": "196608:91ONGh5DNYUUB7s69swNiNcSu3jUpNr//rYiKoe/519Ju:3ONGh5DuVhvpTTUDrr5Mh19o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674936263, "uuid": "c6906d70-89fd-4ce6-a77c-fc6a32be6436", "value": 7651974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674936263, "uuid": "b97d4b25-4827-4cb9-8b86-61591effc6b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674936263, "uuid": "fb95a33a-91a4-45e6-a31a-0a83c8e318c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a207d7-9f42-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674934298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934298, "uuid": "aa7a898c-80e7-4f6e-b9ca-06f1554e5195", "comment": "Malware payload", "value": "490a2af01b265b6249f8e119bf100a28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934298, "uuid": "37dc6815-1275-4074-9267-3cd12b426407", "comment": "Malware payload", "value": "31ed2809791230a779f6a9071bebf2e321e013b933eec77208944cfd46764578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934298, "uuid": "294dbf2b-952a-4bfb-8c35-d3c8dd8d3d35", "comment": "Malware payload", "value": "95e9a9ad8e27a561e6d9c77ea385381c5d351413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934298, "uuid": "aa88e46f-5573-4c09-9185-a88d8a35fb73", "comment": "Malware payload", "value": "463cefca166dc43120fb695e442dc93eb111747145aefdfca918e57fbf599e207eb8d62cbc41ffcfec93de10c5b003f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934298, "uuid": "6f853597-c351-440c-9f1e-6aaf8e96872d", "value": "T1EEB5234770A5857DD56A8BB329346141CB3AFEDB703E2144B288B7EC1F336B00DA5A9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934298, "uuid": "250c892e-b407-4e6a-8ffa-74d6e8d229a0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934298, "uuid": "1461ce85-c66c-47a1-98f6-41e280d77fb2", "value": "49152:okug+a3Jble1xx31Tn7NZAFeOINCihOA2FneZzjF6HBE/SbOutcByLCgv2MR:hug+mdlG31Tn0KCihSFn2zjCBEqilBat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674934298, "uuid": "c9e68b0a-911c-4437-a33a-30db287ba3ef", "value": 2364772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674934298, "uuid": "1db4c18a-7946-4a0c-9526-bf7106c8a7a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934298, "uuid": "f0aee2a1-d6e2-43e5-a692-13b3aaab4d24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4ebab7-9f5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674946800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946800, "uuid": "90eb6654-c5e6-4a0e-bc74-4fccb35fd3d0", "comment": "Malware payload (Mirai)", "value": "27c10f114995b96b09ed72db1e501f47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946800, "uuid": "65e1b001-8a12-4617-af3f-c54e8381fe7f", "comment": "Malware payload (Mirai)", "value": "3220dfc3bb22a1561d33f9f96db00fb4bd066c2c26500e083fd56899260033be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946800, "uuid": "38f4efaa-75ed-4a52-b5a5-b68bb0e9af36", "comment": "Malware payload (Mirai)", "value": "099fb75fdc5a39d5db632b02c0baebafba8e45ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946800, "uuid": "3be8d1bb-5673-45c5-9d8f-7e6d7f7fb6a9", "comment": "Malware payload (Mirai)", "value": "cc0ef6cf6cb95170e3e74f35c938c9388f72a6f7235853d6130c3940db5319c362bd1846de53b917654774ac837ee9a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946800, "uuid": "08e4ad0a-0a09-4e84-8059-9b099958997f", "value": "T115033A51335C0847E1672EB6353F1BE093AFED8011E4E5817A4EBF8A8136EB24346E6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946800, "uuid": "846be898-bbd3-4fb1-aa09-a23b65332b3c", "value": "384:a8oa9DkvqeS13DBMnoOtMpGQyUBVv+PfeK1LJMwHIG4HZO5nVREO3p6ZOj5aZg+Z:rXKQ14tFuym8JoOPRLpWCN9eMRL1vU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674946800, "uuid": "03d06fb4-77f0-446a-8e58-75cb3fb37aeb", "value": 37984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674946800, "uuid": "b7d3699e-2aef-4dd4-b0c5-e051ab34a767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946800, "uuid": "d96e2a39-359c-41d5-a2e6-0c49cbc5dd5a", "value": "27c10f114995b96b09ed72db1e501f47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d60d65-9f19-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1674916530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916530, "uuid": "a249c45c-5e95-401a-8d77-aae9e53120c5", "comment": "Malware payload (RecordBreaker)", "value": "fdf89cef00011f087f541cf26851ffcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916530, "uuid": "5914b356-201a-474c-9755-cc3cc8c1c259", "comment": "Malware payload (RecordBreaker)", "value": "338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916530, "uuid": "dc4109ea-0189-4264-b605-9403ce75affd", "comment": "Malware payload (RecordBreaker)", "value": "415c63fd0a62519ccdd761142baf052db0c9b148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916530, "uuid": "5a4a6866-6795-4dde-b3c1-944be118c4e7", "comment": "Malware payload (RecordBreaker)", "value": "411c5a6bf2255e968c553269c59e435c16922e5d8844789bd49d935d201cf63c15bb8c7ea10510765254666dd5b6ec5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916530, "uuid": "b3a36ae2-97d1-4b5f-be5d-5bb09b75e34f", "value": "T13676124252548220E8BF8D72A9E5EAB767773D56CD318C3C81D33A8625355D2EE32B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916530, "uuid": "ac15c506-e3e7-4fae-93dc-c64e63ab62e6", "value": "11ea24073ee65343ee563e3160c77fde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916530, "uuid": "0b76200f-36fe-4713-a31d-1a1d30700da1", "value": "196608:vWoKh6/86G8izj595XAp9irEsXUX+EKAq:sQwN2LiHX2+EK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674916530, "uuid": "2f6e2eb8-3126-43b6-8257-6f379f7fa3bf", "value": 7324160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674916530, "uuid": "b74021e8-1cac-487a-ae57-104064a11be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916530, "uuid": "74c1b879-e6bd-4bd4-a70b-b3bdc0dc7256", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d266c7-9eb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1674872705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872705, "uuid": "518716b8-d1e2-44b5-84b2-7ada8303d115", "comment": "Malware payload (AveMariaRAT)", "value": "0b932904e5022f47297b93180a31fb7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872705, "uuid": "d6842fd2-74c2-497f-a611-19cb94ee54b5", "comment": "Malware payload (AveMariaRAT)", "value": "33b1fec8b20ebd775dbe037a652b5002124a317b434208c400d5cf933b0e68ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872705, "uuid": "18a52984-f3b3-4a58-8ac9-323c1b546dc5", "comment": "Malware payload (AveMariaRAT)", "value": "f79c987e812baf80d4ef18db6abbff539e356a89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872705, "uuid": "5bd69c86-0253-4649-be2e-3deb573bb939", "comment": "Malware payload (AveMariaRAT)", "value": "b8f9539d6923f5f7bb40af25225addc14da7bb6dd4c6e4a3a38cd551aa70f812fc7a3d28087353d116028696fbb3ed59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872705, "uuid": "508c6f41-4c6d-413a-99ad-a3d4c34dcca2", "value": "T11ED38D13BBE64436E6F202B02DB97E7597BCF9341A25C58BA3945446AC32C44FE36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872705, "uuid": "ade588e7-d99c-446d-8364-0fce025716c0", "value": "56fc94e02d7bc310030753938e49a91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872705, "uuid": "7a57ba8d-5b2f-49ac-9cc4-bf056d5f7566", "value": "3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674872705, "uuid": "1aa24c87-112c-4573-9e61-8fa714919e4d", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674872705, "uuid": "8f0e0f5a-b626-4861-81cb-e280129efe57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872705, "uuid": "1014c16f-3cf1-4080-ac5d-364a4e039f26", "value": "0b932904e5022f47297b93180a31fb7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d969c2e5-9f43-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674934927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934927, "uuid": "a0d10324-0e72-4e17-ae44-c58db4bea7e4", "comment": "Malware payload", "value": "2b2e1356105a4e63fb5c5a4c01a9447a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934927, "uuid": "8d649d12-9f2c-49d1-bb34-e977716c5a65", "comment": "Malware payload", "value": "3445bf5c92f14d267f804a2bef25bf9fce38a86e3600bf8b283d3db2d3baf2b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934927, "uuid": "b85d5bb0-8d64-43c3-97c3-cefeb2389fe8", "comment": "Malware payload", "value": "55db238a2a2559fa6e491bd347ac364a4a28ed10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934927, "uuid": "cc5fe3eb-3a59-45ae-9ed1-0da114b362d6", "comment": "Malware payload", "value": "5e852f00c4f306bf778b69800c296a11bc1110a6d671993dcbc3ecfcf75ca6d7e6edd123b30f76946a1b88c3657602a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934927, "uuid": "f10a26fd-b3d4-43fe-95cd-b9cb49089e73", "value": "T19E159D056E9B207DEC69BE3A81FEED27D63096D1075BE531D0E21DE489AB281CC44FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934927, "uuid": "3f68534d-1015-4934-9323-33c67ec6c61f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934927, "uuid": "553aad94-f373-47a3-a011-ca3bbef0ed22", "value": "12288:k9/zkwBTGSndXGYgFQT/Qx/0FJK8yo2phz9Yc31MFhRTmBbk53j1kpA:kFzfwYgF4Qx/g6F31Md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674934927, "uuid": "ed955bb3-b1b2-4e56-8fe5-c9e401fbaa70", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674934927, "uuid": "03a2a97c-4cb1-49a3-b9ce-35dddf61443f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934927, "uuid": "f56ca737-6af3-446b-b6d4-5b8c4a5ebba1", "value": "cdfgretwrterfwederetrgwerfwed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33192977-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674894705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894705, "uuid": "322e58f6-16f7-4462-bc88-ab669632ecfc", "comment": "Malware payload (GCleaner)", "value": "bcdd36079ced09c54779cdcf76ebf532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894705, "uuid": "79a0810e-9266-4378-bc91-d7c4161e9ab6", "comment": "Malware payload (GCleaner)", "value": "359ba447372d1dbd5101b223c8933ae2cc07213da2a47bd4c61d311ed7f5e37b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894705, "uuid": "581dc166-9a1e-4dc9-ad3e-83ff8f44c7e2", "comment": "Malware payload (GCleaner)", "value": "728848cb212d3c46e6bf589b0674ca7f0668af4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894705, "uuid": "d0e5e855-c341-4180-954b-9547d91521d1", "comment": "Malware payload (GCleaner)", "value": "3cd6d4cbbff741fe2f04572d655911d845fa665c81bd2ef1908239792405a30ed43fae6f3854109749504fc68f71cf3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894705, "uuid": "24588466-7b7e-40cf-8636-cc7cda6766d9", "value": "T113B5332B36D268BEED2785FA2B245D405FB2FD49313C2215329A73CC2E7B6F41426791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894705, "uuid": "e2f8232d-1e06-400b-905b-ddc6ccc94f3e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894705, "uuid": "b97b3fe7-e942-4974-83a8-f932d7213464", "value": "49152:okug+vWXDoCaKnimH7Yufjfxr+9vwrYWr/BQqVTeEzCtWnCVgU9tdt3LCgv2MR:hug+OXDoCalmEeT9+9YrYUDNlCty2zpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894705, "uuid": "94dff8e8-538b-42e9-8b3d-368e8f2059c9", "value": 2327460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894705, "uuid": "30e9adc7-9132-4ccd-9a6e-ccbd89462770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894705, "uuid": "d889b04b-b4da-4870-8e96-c90598ac8276", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c931890-9ef2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1674899794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674899794, "uuid": "32651fa1-0819-427c-806d-2d951ce0adb8", "comment": "Malware payload (GuLoader)", "value": "4ad3737246c3cd680ec28e97723d9d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674899794, "uuid": "9d12db44-3031-41cd-9d61-dd1bb78250da", "comment": "Malware payload (GuLoader)", "value": "389859952d88f247ba8849181ec5993c8060b0447d3cece4cd688529bcb81bd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674899794, "uuid": "59962b75-0aeb-40f5-a82c-bec15c1c7056", "comment": "Malware payload (GuLoader)", "value": "522a48c0f32bd0a0390a4d208ebf2a845193cbc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674899794, "uuid": "61590c89-6801-4e79-a71d-5ed5c2d7becb", "comment": "Malware payload (GuLoader)", "value": "4c8778e607f16cd48154953aa1d8ccb98feae5cc50f67276279363df5e1224ba46e3382cbdd832cf64e3ec7292345628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674899794, "uuid": "43d0ac1d-edb4-4209-a315-0b81c0b3c480", "value": "T1D305D0C3FD1098D6F83C4F3211A79D764A7EBC7EBA8810AF7194736A19326031927D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674899794, "uuid": "04af4cca-30f5-4754-a8de-6cc452a83912", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674899794, "uuid": "f62d3fe8-ad32-4abd-b94a-d5e9171f7e8e", "value": "12288:aGdsmTeF5PY4Z9hvn1y4q0onHCl6Ka2YlHJR:aGemTeXPY4PBn80oni4dpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674899794, "uuid": "6bfa8d81-2a64-4f6d-acc0-88973dfe6fdf", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674899794, "uuid": "ebd12822-ba04-4b05-8e84-47b97b3b7d91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674899794, "uuid": "6a2976da-2a1f-4d9c-94f0-6991b047efa6", "value": "Besprinkling.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c807b60-9f4a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674937832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937832, "uuid": "b07dd57c-c560-4028-84e0-8806888c4a62", "comment": "Malware payload", "value": "459ddc8d439d21836772631195b1d8d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937832, "uuid": "3185a89e-0ef0-44f0-b3d0-76217c6efe8d", "comment": "Malware payload", "value": "39c0a53274d40909099c7b85b690f1d0631bf78c49bbfba00c2da7c969a57f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937832, "uuid": "6c886cbc-da8b-4ef8-a600-447ece1c5ed1", "comment": "Malware payload", "value": "38b6876ff050757473f05c4683352c277bdb9740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937832, "uuid": "71904cbe-3836-44f3-a50c-479fbe50ace2", "comment": "Malware payload", "value": "c38c121fcad905787b578ec40026d9cebebfb0b0ff9695f605a8b433a7304e938c5e01368f6bcd6396db0d657602811e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937832, "uuid": "2b377af5-417c-4e2b-b2d0-bbeafcf7ee92", "value": "T182B5334BE581DA3ED5134AF71C358A84EF16ADDB3C3D1411BB5A02CC2EF67B08A652A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937832, "uuid": "b2afb04b-62e9-47d6-a5d8-f683162fbf2e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937832, "uuid": "9eb7819f-c86b-44ba-987e-7fd0c531fd3b", "value": "49152:okug+4Pw4AqShXyf20B1VThB8HGzY51fK9w4SovyemoA2pXGSELCgv2MR:hug+4wNZ0fFQR7K9w4h9J70v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674937832, "uuid": "e186709e-18aa-49f3-9cb8-9d7853c8af7a", "value": 2321051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674937832, "uuid": "72091921-9307-4397-a514-66b0b162b4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937832, "uuid": "da44dc49-df7f-49ed-a2f1-782e8b730824", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c390686-9ef6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674901700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901700, "uuid": "9cf238dd-4de0-4825-94a1-8b417a9b0816", "comment": "Malware payload", "value": "fcc8437ee3696f3caf5ac9e59ed8772e", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "detect-debug-environment", "colour": "#8180AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idle", "colour": "#4BCDF5", "exportable": true, "hide_tag": false }, { "name": "long-sleeps", "colour": "#E092CA", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901700, "uuid": "ff3584db-13b0-4f0e-a455-b8b8757c58f1", "comment": "Malware payload", "value": "3bc15d25592861a8a64cabb13ce26289fd1d7b799496e9522c3e72c448cd396c", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "detect-debug-environment", "colour": "#8180AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idle", "colour": "#4BCDF5", "exportable": true, "hide_tag": false }, { "name": "long-sleeps", "colour": "#E092CA", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901700, "uuid": "9faff748-0461-416d-99f4-f130082ddcb6", "comment": "Malware payload", "value": "8333718b08e91907204b962d0d2f3db7445e65ff", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "detect-debug-environment", "colour": "#8180AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idle", "colour": "#4BCDF5", "exportable": true, "hide_tag": false }, { "name": "long-sleeps", "colour": "#E092CA", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901700, "uuid": "d1b7aeb5-829d-49c7-a529-32ee8850ab41", "comment": "Malware payload", "value": "d3e7c1d4d8ea036802312fb236cb59651a81966f5d6dd2a50c7defe7da28dde6d15cff39251731cc3416f5ff7c8e3233", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "detect-debug-environment", "colour": "#8180AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idle", "colour": "#4BCDF5", "exportable": true, "hide_tag": false }, { "name": "long-sleeps", "colour": "#E092CA", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901700, "uuid": "bfe7d19d-c21d-4105-be59-c28df3cc1ca8", "value": "T1DB053A2E67E800A5D43BC13985670252FBB27021277296DF2195857E9F3FBE42A3EF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901700, "uuid": "dde1fde7-d6f8-4260-a54c-138432cdf566", "value": "252e70d273be6508ce5fb7bc3ab729c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901700, "uuid": "c256c0ec-4cbd-41fd-8de5-5ec839bb4520", "value": "12288:bsD9gRi8RbeQCO7p7T9sR6ZNFv2QCbFL1gklbj3qKPkb6xD:09SVbeQC2T9O+Nd2D2klHaKPkbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674901700, "uuid": "78630ed9-dff3-4c98-9c17-c72d1afab7e9", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674901700, "uuid": "e32d3ef1-0893-40e9-a240-e24a80cf9a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901700, "uuid": "c7b566eb-468d-446e-9160-09707bd73108", "value": "lsm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da0424f-9f31-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674926989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926989, "uuid": "94cf783b-1784-4d7a-8f82-bf361dad35ba", "comment": "Malware payload (AgentTesla)", "value": "e5a0c37fe9e4810e6f3807e82c2c96d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926989, "uuid": "d405302b-a56d-4f2c-9f48-86555a0a81d6", "comment": "Malware payload (AgentTesla)", "value": "3e174e76ca2e33599682d12eb13cf2168e0ccb694b3b63158e0c44b064b1831b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926989, "uuid": "94490d66-b293-415f-a6a0-78e484f3976a", "comment": "Malware payload (AgentTesla)", "value": "374999ae62e8852f2d01839f33fc831226108ee1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926989, "uuid": "6926ad51-689d-450e-9780-fbf1c2b2193a", "comment": "Malware payload (AgentTesla)", "value": "022d4bc6f896ce6b3691f7a407806af8ade19b6eb6d06b447cf77a41716b256fd4d0bf07aa14432acdcaa6b26e506794", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926989, "uuid": "6321159d-114d-4c59-92c3-e8ffaa920ee6", "value": "T1FAE4230875B0DF12DDBE5BBB1AB4280157BA2E297983E34C1CD2A5D705337E24616EE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926989, "uuid": "e2f2dbbd-d71f-4a56-97e7-9385d2c2004e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926989, "uuid": "d4d2fc7c-0a20-411b-b80b-2f268ea4899e", "value": "12288:8er2iNAWgMlSYtz8L6gu0X8cNGevoeGW2YoskcXI2Hfg7t0QbNZ+lcaXIW/4XMI:8er1/foLrvasrY2HAt0QbDVW/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674926989, "uuid": "05fb6186-84f4-4cee-925b-5b5221617664", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674926989, "uuid": "6d56c573-54fa-4e09-b73b-230f083eef3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926989, "uuid": "6f9d2132-407c-4094-885a-c4bb57ebee1e", "value": "DHL _589330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9b74f3-9eb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674874887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674874887, "uuid": "97418132-364d-44ef-b276-3792c5651996", "comment": "Malware payload (RedLineStealer)", "value": "137c9739df17cc0df34d97957877acb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674874887, "uuid": "81900520-babe-4512-b789-60c75685fabf", "comment": "Malware payload (RedLineStealer)", "value": "3f44de70d288e5ed65d0df34c567833dd51b93494b81d5d54457b8fc4e22244f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674874887, "uuid": "c778765e-4274-42c4-8273-971c9b7c0296", "comment": "Malware payload (RedLineStealer)", "value": "9102c2483a0254155e37e9eb7db8937796329d51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674874887, "uuid": "1dcb9221-2287-42dc-b003-fbff1e1ffba1", "comment": "Malware payload (RedLineStealer)", "value": "78fa287ea2bb77fa14af8dfe0f6eabd8a55bc0fa0ef8d40d106755727e43303c40cdebdb2396bfe92580a3fdcfa630e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674874887, "uuid": "92205867-f3c9-47fc-8c05-0854312455a2", "value": "T1CB84CF0376E1BC4BD953EA734E1AFBF8B11EF998DE5467DA13086A0F29B15A1C163301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674874887, "uuid": "2fab7292-8c0c-417b-9aa0-805811488cd1", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674874887, "uuid": "89b65f73-3408-4e1b-b81e-4e7c2394eb6f", "value": "6144:oLLWgS6tKSk+eKy3WndcXBipwGuzcubFYS4v8gfx9CEbnVnd8dV:onWiKSoKPmUpe5bDU8YLCWledV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674874887, "uuid": "a84bb468-b111-4353-b0c6-c1adb9f6c247", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674874887, "uuid": "297d75cb-b34a-43bf-b508-f9af0b7a3ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674874887, "uuid": "f7c312fe-a48d-4f9e-b503-282405eec577", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87eb4b4-9e9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674864059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864059, "uuid": "2ef13f8b-bc6f-409b-9bdd-7bda1a9e284e", "comment": "Malware payload (RedLineStealer)", "value": "ec0e14dbb7716772b73c2b807ed37095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864059, "uuid": "51842a6f-97b9-4b5d-ab7b-95c7370dd1f5", "comment": "Malware payload (RedLineStealer)", "value": "40475b336734942ac348138096688dee7cf46c4b956f1fe063639eb75c874a4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864059, "uuid": "3c3e2d48-eeef-4ac6-bf9b-24d7010e8e0a", "comment": "Malware payload (RedLineStealer)", "value": "d099829e6d81cf5bf339a6c0f57403458efde549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864059, "uuid": "8106a7b2-147d-4045-ae45-2c624f32dfa4", "comment": "Malware payload (RedLineStealer)", "value": "5d0790b30bfd0d44b74593c6ae1fd15a92e0489e02d4903c4b6caba981bc172b0e208e7d594a893613ce143b7d92b6df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864059, "uuid": "6c9fa2e1-5899-408e-a0d7-ed3ae3e28a8e", "value": "T1D534D8DBBFA86942D5138D3E9373C7129B18E6800E12AB47661D127DCEE16C15E9F2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864059, "uuid": "9960435d-a784-4bab-8d39-f2ddc9f9507f", "value": "7d51a0fa85348bca6694d055fb9a732d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864059, "uuid": "04ac7c07-f0a3-4243-82a0-d0db9c6173d4", "value": "3072:Q5P83S7w7wvWl78Cf+wWKp7A+aGAQszmi17j9dd/wvJqx/Qj9lf:Q5k3gwYWl4k+wW+LAQ4/9dd/wvJqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674864059, "uuid": "32076a49-503c-412e-9338-8bc29f1c8b04", "value": 242714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674864059, "uuid": "dc1114f3-5bff-410e-8486-f6e22b034c79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864059, "uuid": "8e2e72c6-eda8-4678-8a72-e53d8db7f4d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63980ad-9f20-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674919890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674919890, "uuid": "9f415a52-a4ed-4824-ac76-4b132833efbf", "comment": "Malware payload (GCleaner)", "value": "13c86873e34cdef174a16e92a74504c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674919890, "uuid": "cb85714c-211f-4b35-8d1f-9e458eae33c3", "comment": "Malware payload (GCleaner)", "value": "426646b20e8e2f6bd3122a6314f2c87c47a6a703ec810fb4061590b851f9f9b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674919890, "uuid": "87e9f624-6fc7-47ed-b593-913ed6115075", "comment": "Malware payload (GCleaner)", "value": "42c855434fcbfc60e97bb7cde8e447ce40d3ae16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674919890, "uuid": "3e03d0ec-9b74-4550-8a43-846e616cdd7a", "comment": "Malware payload (GCleaner)", "value": "0a298252c73ca8ce7cc4260a36c07ce0168894fa5faabd13d791532f11d693410e882eef28423d234783fa151fdb4572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674919890, "uuid": "d7ac684b-c543-431e-b3ce-5a288d05a71c", "value": "T140B5330BF452AA7DD50B9BB736749344F937BE2B717E1254320922EC2E326101CB5BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674919890, "uuid": "e18e64dc-1a03-4bb7-99de-164965485251", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674919890, "uuid": "3adaaea9-b7c1-4720-985b-ff6c2ee4c2bb", "value": "49152:okug+G69spHlWPiABv3aIlLWUdpsaXjpUnU3YhBO0fLCgv2MR:hug+G69spHw3t4EsmjqU8BOSv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674919890, "uuid": "687e479a-b77e-422b-8f6a-9a8d17eb1706", "value": 2371355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674919890, "uuid": "4c4ef514-99af-4cd2-9919-b9f9ba69c5df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674919890, "uuid": "56769151-adaf-4bc2-9ceb-068a12d4f2d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb19d08e-9f3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674933185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933185, "uuid": "2b699c51-b0b3-482b-bfce-01f219805bbe", "comment": "Malware payload", "value": "c452fca7f6295e02d6add6391b447be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933185, "uuid": "c7dedbf8-ad12-44f4-85ab-ca9441028490", "comment": "Malware payload", "value": "439c1f13ae877ab9da0818cec93eeb379c367bf9795be32ea769f6d3b6d11835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933185, "uuid": "7cd8a0c5-1af6-4e1e-aab9-4330204efbf7", "comment": "Malware payload", "value": "fa1a24f91552f38246a3948cf2639a7aa8b86a26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933185, "uuid": "2cd2451d-0678-4ac0-8cc2-b5cd5479742d", "comment": "Malware payload", "value": "6974b3678364dd73f5b1fb21fcf376ab750d2c276f21d71a3357d129b0684bbab1e923b27b0b68f19735d0e25a0fc92b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933185, "uuid": "b2030d84-2138-4ef8-b4d3-20406dfc7411", "value": "T1A1C58C58DA4390BEE82704F0067BF6FF9520563548B08D5BEB8CCDB4AE729A2531971F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933185, "uuid": "e1f7c915-9483-41b1-a97d-357c4a1d65b3", "value": "0e504ec9659601103bf3eb149ebb6cf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933185, "uuid": "e15862ab-a3f1-4e8d-bb30-2b4801ccf6f1", "value": "49152:wanoymf6jcNI3AX2d3c8uCS2hQSXhnxOt/zF5fUPAXWCNxFcKSVJvgN:Eymf6opU3ciSQ/AzF5fUPABNxFcKSVJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674933185, "uuid": "df5eee9d-7889-42cc-885c-bf5b687b6b94", "value": 2664664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674933185, "uuid": "e6bc41bf-3243-4479-b460-4817b61c66bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933185, "uuid": "72464280-d9d1-4f33-8d99-28b225fc9027", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caee007d-9f45-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674935762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935762, "uuid": "c8b3604d-8daa-4ee3-8594-5fbb0bda5664", "comment": "Malware payload", "value": "0cf52ab5ec6a96c856f27a8069a67711", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935762, "uuid": "a9ac238c-bab7-4901-8df0-1ea13521ee75", "comment": "Malware payload", "value": "45e28232fe7dd982261d22cf3e91a7de00316ee6350b2ae513c16cf3977b390a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935762, "uuid": "71256dbd-2031-4fd6-8e67-7baeed62ceb9", "comment": "Malware payload", "value": "561edcbce92456d2037ab4bd41a96e17c73e361b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935762, "uuid": "81b85f68-b835-4ca8-9443-36864f8f4216", "comment": "Malware payload", "value": "cc3c7eaaed8df025d6a0d939ad11630b8a4749d0a09bea371b138bb9407428e0c1b0c701031ab331dde32a8b275658f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935762, "uuid": "c2b89daf-8a8a-4f80-9fe9-8b373dc1ac1f", "value": "T156549D0157E2BC60D929CA768E2EE7F47F1EF8508E1477AD1A149B7F18F11B7C562208", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935762, "uuid": "b0de5378-5b1e-4d75-a319-eaa85d7efc30", "value": "a5cda000ff4d200b1a7c245df76a958a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935762, "uuid": "c27dcf9c-10bb-4d41-badf-1386b1850d92", "value": "3072:/C6ALHq54BQGXvkbYZuZLsgjQOj19sKwbAVwBnIyCSyxzID1C7hZWiClGsiuNZ:aLHHBQGcEAZLbk32AqSwzIDM7ClFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674935762, "uuid": "82b1526b-8941-4333-9335-2115515f747d", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674935762, "uuid": "d148edb5-9607-4739-95ef-e38c92a20868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935762, "uuid": "ad9e7765-e6c2-43b2-a906-e4c3d62f3f6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8cf73c-9ebc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674876655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674876655, "uuid": "60d86cea-8536-4bb0-abe1-aa1c22c5b985", "comment": "Malware payload (RedLineStealer)", "value": "57f6f3515da9a0ece1f384c291de81d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674876655, "uuid": "76e82649-56c7-4ea0-ae77-432ac429d792", "comment": "Malware payload (RedLineStealer)", "value": "476a465112e4918e48b0c51242a88c77e45426a3408037d25b1ca5cb05de1a77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674876655, "uuid": "e8ad6533-c4d4-49b4-a6ab-b9405e03c3b4", "comment": "Malware payload (RedLineStealer)", "value": "6415f2cc0b3cf52d9ce9f9ff425eab65e513b715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674876655, "uuid": "3523695b-a610-4a1c-a98f-7cada91f8038", "comment": "Malware payload (RedLineStealer)", "value": "eb4131ece95fae7784cb3c3f4930930d223d2d824eae378ab46b3385829255970538cf62bcc5dcf41da8cdace3776e0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674876655, "uuid": "ad271b49-cf8f-4b3e-9161-36b1bad08959", "value": "T1BC84D04276E47C68E967F6334E1EF7E8741EB991DE6563D9321CAB0F28B15E1C522300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674876655, "uuid": "d279b677-8fd1-40e7-8ec6-f9d0cd10574d", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674876655, "uuid": "f7fb91b8-dff5-464d-b47b-094f92b4cf9f", "value": "6144:oLVed4lY5670KR9M6keSV3k76DnZx9CEbnVno38dV:oBes795knqeLCWlosdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674876655, "uuid": "2e5aa1d4-cfc6-4e6f-8cfd-1c5d15c0f0ad", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674876655, "uuid": "4abfdbb6-f39f-4233-a606-ab42c6f7b4e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674876655, "uuid": "a6ba0dfb-bca0-4616-b1c1-53eb2bb3ef66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8a273e-9f59-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674944145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674944145, "uuid": "221d5a60-ed0e-4769-baab-ea3fa82bd87b", "comment": "Malware payload", "value": "9d61db8448307ce1d4849611df307490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674944145, "uuid": "0b3471bc-bd3c-4cea-8bf3-d25a27fdc3af", "comment": "Malware payload", "value": "48b1227a18bf082956a59df82f515cb2da1b967cc3df298491229d1b7915fab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674944145, "uuid": "0d8ae348-145b-41c6-a4c8-559610232265", "comment": "Malware payload", "value": "9c0a7c0e1d410cacf3c2ceb72c71473884ace2a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674944145, "uuid": "d7400770-5d2e-45f5-b140-242efbcdc942", "comment": "Malware payload", "value": "962e3fde48f6a7c626ec6f2368bd261ca76a43555ba79ee87d61cf94bac0eda25f73ad897d734ed624f9dba1cb9e4164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674944145, "uuid": "10f7ccee-24c7-4b89-b41b-4fd98426222c", "value": "T111B5330A3195D2BFE0198AFB1D325285EF7BEC4B107E9421751E13CC2DB72E08DA57A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674944145, "uuid": "3bb64eb9-117a-48f7-bceb-5dfe264d67b1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674944145, "uuid": "0055549c-4a90-4b10-8589-95e3b725217c", "value": "49152:okug+exIqb/c94f2LeLzZZpbE58NFP7lsb5bvt2xRLCgv2MR:hug+ub/cG2KREmHjlsFbvQx9v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674944145, "uuid": "066908fa-e8b3-4856-ae27-eebd6c285175", "value": 2364802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674944145, "uuid": "5c291d85-b814-4fbb-94cc-551cdfbd2805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674944145, "uuid": "0a0ede3d-5c5d-41ed-b6ce-43fbaff67d0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f2cde5-9ee1-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1674892690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892690, "uuid": "0b1a1e09-41b4-4128-bd85-36bd8b9f32e9", "comment": "Malware payload (TeamBot)", "value": "b6c0d595cac107abe818fe80f9b39684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892690, "uuid": "1642fa2e-47fe-4c52-86fb-6dd18ff483e3", "comment": "Malware payload (TeamBot)", "value": "4ad43f4ed508e1ffa83958f4f2fd052f9ee7f1953ca9cc50294b224e7214034d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892690, "uuid": "6ec1d6c3-fdd5-4f6e-af7e-9a6e528cbff3", "comment": "Malware payload (TeamBot)", "value": "4bf72dfc967825033ea9a00591e334188e0565b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892690, "uuid": "bf30a5a8-980b-45c6-a215-b08edd0ff5ff", "comment": "Malware payload (TeamBot)", "value": "76c739ff688ddf601c1ab0e3cffbe569f08f338b4bdf888d3e48c2c103c03699ee14093d90b14b1e571ca20d13b4d52a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892690, "uuid": "49fb7316-7cbd-4813-aaa9-de11e864de30", "value": "T17B54AE0236E1BC48F957E6338D1AFBE8B52EF9C3DF5427E61308A61F29B15A1C162311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892690, "uuid": "da28bbba-45bc-42db-9de3-a56990b82232", "value": "4bc9925dd568c221c7d9868dfc769dfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892690, "uuid": "4674f5da-0fac-42aa-a0b2-3f4fe4e11ab4", "value": "3072:kZPLQsun5jIiNumAN4dG08fjMckadKZ3u9NskL2BfweF1go9ClANbFrZVngcuWUi:eLTu1ISELMckZZ+9py9x9CEbnVnm8dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674892690, "uuid": "8f131803-f6a8-4b5e-a317-064f48c048d0", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674892690, "uuid": "8871409d-6dfe-43d7-86ca-9f7c6e456cf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892690, "uuid": "59a53a75-ac78-41ee-861f-abb5693c4808", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342b5e78-9f5b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674944958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674944958, "uuid": "6de8cf9b-50e0-47c8-97fa-590bf727b062", "comment": "Malware payload", "value": "292c2041324167f161a057a980b1e6d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674944958, "uuid": "0cfa435d-be46-4ef2-929b-925f921e2552", "comment": "Malware payload", "value": "4bfb5dd76f4e1623261839c62c056fa1d91f7d2f7a8426100c661718d655abb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674944958, "uuid": "65e6edfe-daea-430a-90e5-87b6f2ecaaff", "comment": "Malware payload", "value": "78fb694be9dc448909344f6aebd0e2f69b95b920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674944958, "uuid": "e9a57842-6968-40c4-9583-0cf0b8a143c1", "comment": "Malware payload", "value": "3928f375802ece00d1ddb700bfa62771c627f53de0f393a1f020ac6ef24806197373c95257b4baef407f9d13de550244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674944958, "uuid": "4c43fb1f-5d3a-4689-8942-242b333f2b88", "value": "T1EF548DC1A6B1BCB7E6374B728D2EDAE4751EB453CE54671A3238AA3F1870361C623315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674944958, "uuid": "15af00d4-f073-46fc-8928-24d6c5a4969f", "value": "dc3a0c75117ce1f8b0d73167dcb17e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674944958, "uuid": "c7afdae3-4f34-4ccf-9d36-42a443f06248", "value": "3072:l3LJKRFCACiZRVJ9qV3Rl5+Csc8dGU31bZG2TT3mYlNvy4k95sR/g8R8BM2FlT/m:1LJCF1075Bru31Lm0E954MlFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674944958, "uuid": "beb35f79-45ca-4e61-b8f4-b9e5dc8f77e8", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674944958, "uuid": "063858b2-7af3-4bf3-90ef-4191eacdbc80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674944958, "uuid": "5b1163ef-80dc-4c3d-98a4-86016408097d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90370893-9f30-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1674926644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926644, "uuid": "78f43840-f37b-4696-8025-1127c150b9e4", "comment": "Malware payload (Nitol)", "value": "77f8a3988922f8fbdad0399a2c4c0ff0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926644, "uuid": "61aab0b7-333d-4571-a315-9917460cafc5", "comment": "Malware payload (Nitol)", "value": "4c62442c0bdbf40835499b6fc32444c81d3708336371c382cee27be17c8f69aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926644, "uuid": "d6a05183-7e4d-4673-b75d-b73d5a20f364", "comment": "Malware payload (Nitol)", "value": "5bc740e317e5a5fba14ea0d79f4a8103d2ee8ad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926644, "uuid": "12c847ce-cde6-4c2b-af78-131831a322dc", "comment": "Malware payload (Nitol)", "value": "17a6176ce5dca3b5c3d60c51746e74dcd26e5c57b3a3f52f53f292d319f662410261c9e614a52198fe044589f32d9eab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926644, "uuid": "b50267a4-2fd6-48d9-bac7-ace3428364c2", "value": "T12C053385A88930F0D014D6F39ADFD74E2F5C3C34A70902C3D9996B7A3D7A147A6B84AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926644, "uuid": "2a9653df-315f-463d-86d9-4e5e3e581cab", "value": "2298d52a04c68d24a4da1ec2067eb4d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926644, "uuid": "09d21851-bb94-40ac-986a-3f6d66dc3309", "value": "24576:YaEwbGosZsCsufNqe7gTdFqCLmggCS8FmAzP:Y1wyo0suZ7H8FmGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674926644, "uuid": "5394601e-dda5-4dea-8400-8c4d9a413c5f", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674926644, "uuid": "052bf33e-c7e5-4fff-b862-7b39a17228c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926644, "uuid": "3f85dd58-9c8b-40cb-8d64-7fe0f4f02811", "value": "77f8a3988922f8fbdad0399a2c4c0ff0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b51ad35-9ea5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674866802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674866802, "uuid": "5d620b21-64bc-4fef-9839-cc1f8a0dc77a", "comment": "Malware payload (GCleaner)", "value": "9404873f8cc56396902453740846887f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674866802, "uuid": "83b42627-f333-4d26-b2a9-df75b4c4ff9f", "comment": "Malware payload (GCleaner)", "value": "4d2cc22f724c51abcf4fd55c484b8bd2cfdc5b6c368398e1a0f0a4993f4a1cb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674866802, "uuid": "5a99a847-3eb4-4003-b3b2-88c1211b2d14", "comment": "Malware payload (GCleaner)", "value": "af106f958a77ec52346fc19c7ad07ca3a0f955de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674866802, "uuid": "b700dcfb-d8f3-4c6d-b84d-922b1ec57e9d", "comment": "Malware payload (GCleaner)", "value": "066d6b37e19d19700befebf9d25935cca0be9a625213b27cf6f0e232b37df4af4b08a994ce49ef94cda257c9f38c303b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674866802, "uuid": "4ed76c03-120c-45f6-84e5-72f901177977", "value": "T1AD952346611AC2BCD1164FF77D35C880ABB36DCB242D0200766A6ADE697B1F014F5BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674866802, "uuid": "08a5f3dc-cf77-41d7-bfd3-08cc1b67079a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674866802, "uuid": "6f1df3e8-de8f-4016-9b88-a240891f98bb", "value": "49152:okug+GsxgNkmwnd8zsxkyz5EUnh6eagoA6M9wLCgv2MR:hug+Gsgyd2yzVdYv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674866802, "uuid": "2cfcde2d-bc48-4237-83a7-61f587c6b437", "value": 2008664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674866802, "uuid": "3a1b198b-637b-4aee-93d9-5d6b880563dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674866802, "uuid": "7c2dcafe-07da-492f-b86f-fe64f340619a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c9d912-9f51-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674940723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674940723, "uuid": "ece5a536-76d1-4ded-a685-ce50b794b427", "comment": "Malware payload", "value": "709b707c79f958f9ca12521f55873427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674940723, "uuid": "657d3f04-6b56-47f2-bb56-84a0bd66ed63", "comment": "Malware payload", "value": "4d9623ff4aead238779db7f038f63e714b4708a58708020af3429f84162bd853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674940723, "uuid": "eec4a839-6bbe-4662-b3c4-631db8b45004", "comment": "Malware payload", "value": "18ef387ebf2e5ec35d1d5c91afcce52090439a84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674940723, "uuid": "8ff52a4e-e8b4-4184-a217-e1708cb8c834", "comment": "Malware payload", "value": "06cdc0c28b09def35f9b0a77d6915b4f5f50320f513ff0464e0010c72766aacce7bf63b0619b9174b170c270cc62538a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674940723, "uuid": "6fd00c5e-c2a8-40f7-9b6c-486043eef182", "value": "T100B4D077919AE023F6508F74ACC4A81DE4BA5E34C84517F0B475CDB5AEB80CBA09DBC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674940723, "uuid": "9d102a5f-0705-4a37-8d44-65ed207725e3", "value": "90deff4640e080d86d1554b071266683", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674940723, "uuid": "7b30aa3c-8003-4417-b02d-23f456469f45", "value": "12288:SiNqX30/mK5Ylt3VsQbji7jTT42bMCQk9hmtatdVsIpHVP:xNAEsX54z4AMCX9NdVvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674940723, "uuid": "5edac135-225b-4a88-810c-e20237d5219d", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674940723, "uuid": "01e31c48-bdf8-4580-ba98-2664ec9a4564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674940723, "uuid": "d6c5144c-6f15-4516-86a7-ddaf24ed043e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52cd346-9f33-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674927968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927968, "uuid": "f6fcd895-80fd-42c5-aa50-864ca4c88020", "comment": "Malware payload (GCleaner)", "value": "617a1f9a486acac830539c93a73338d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927968, "uuid": "43140715-6ca1-49b0-95af-12b317a5a324", "comment": "Malware payload (GCleaner)", "value": "4fe7ef88c01a7271b02b96363e19a3d4169ca21ab0254fb487e64354609bb82b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927968, "uuid": "0135af3b-d518-40ad-8c74-d656f86a8cfe", "comment": "Malware payload (GCleaner)", "value": "25ab6c7a0ffe71d10716e07b5ba154394e13c661", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927968, "uuid": "95baba43-2c0e-4f30-9f6c-3d2d04556ece", "comment": "Malware payload (GCleaner)", "value": "5eebaf85de69df793b421e4f474f3f7015511f7d114d95717bfcbb84742f5c22f6392753eb8fc2a6a786c4233e31fcb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927968, "uuid": "6dc9f52b-fa70-4349-824d-6a16a8128ded", "value": "T165B5338BD183D07DC547C7BA393082885F77FE53A03D1452B3A5278E3D792E12DA1AA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927968, "uuid": "7aa04309-a71d-4624-a8e4-27c38b089150", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927968, "uuid": "1f2d0461-a347-43a7-a86c-e875b8cb46a8", "value": "49152:okug+X2zZb1TbVQg4giz3JvPqiz1iG9GMQmCcVZHTkKbLCgv2MR:hug+X2zZb1Hji5vPqacQZpCSHTkKPv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927968, "uuid": "ddaa156d-b1eb-40b0-9506-d5a1f0ade9c1", "value": 2346447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927968, "uuid": "1f075c83-b7e3-4a3d-b4dc-8962bfba1e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927968, "uuid": "6355f3cc-6e55-4a33-9725-64bc819d749c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72dc8a2-9eb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674874391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674874391, "uuid": "cd9dff79-fe51-44a5-ba41-c7db61d66443", "comment": "Malware payload (SnakeKeylogger)", "value": "a76593a6840d0e50c27b4f9a55c51fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674874391, "uuid": "672eb5b0-165a-432a-917b-a60b8ca4d288", "comment": "Malware payload (SnakeKeylogger)", "value": "5048f6db0c69eaa85f025ca74357b4b6d1cc5e325b8a39b3b1545026bf5b1469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674874391, "uuid": "4a97d19a-5f35-4ed6-8b00-90458c6fed4a", "comment": "Malware payload (SnakeKeylogger)", "value": "a882916032d7f61d2c728005d70f8eb1765a3958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674874391, "uuid": "4b292dd2-cdbd-4f60-8e3e-20a9f1a2ea2c", "comment": "Malware payload (SnakeKeylogger)", "value": "c575b2ac53bc9b1a4b9f7461efc17a67755d75427c0bc6f9969d2cdeb0d701e469aea5abd2ccf32de26dca6061df0e58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674874391, "uuid": "201c333a-dfba-4e6c-bb23-5d68697fb9c8", "value": "T15805C32D9A7A93F2C1B4B5315AC1D4B4B69F4882671BC998D9DA4FC33F469C32CCA10D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674874391, "uuid": "8d593a6e-5917-46ee-83a0-38c1a58e37d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674874391, "uuid": "921891ce-3296-466b-81ee-b069d428c0c0", "value": "24576:2ZT8irmdjXHNOrAe/IuGmBDCzwrqhTPVc+FaLnEtTx61ee:2OODewrCPVcl2Tx61ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674874391, "uuid": "55ebfc54-2ac6-4779-bbce-0d8cab758972", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674874391, "uuid": "c0f6deee-4032-467c-b35d-fd0aa0806041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674874391, "uuid": "0b821913-b7f5-4034-864b-eafcb4b7c6f5", "value": "VSL PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bf5d00-9f61-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674947746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674947746, "uuid": "45d575ec-975f-4e16-9a0e-85f3e5666058", "comment": "Malware payload", "value": "d1ff11b7bb41f97e4c573867ca25e16b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674947746, "uuid": "0b674484-3b06-4d08-9e8c-55c55de2d949", "comment": "Malware payload", "value": "54a6e7a958b49138950d219ee8c17ba44a9ee265be24d4e12fc9014119b9bff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674947746, "uuid": "acde3eff-7d2b-41aa-b628-fc19b284cd3c", "comment": "Malware payload", "value": "0983a887b6c844f208f9a3ce848e8a34ff02a901", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674947746, "uuid": "00a7c891-bf0b-4939-8a50-85f3cc47f6ca", "comment": "Malware payload", "value": "0ef3fcfbc7bad4ed7dc459712e32c18ad98c14f5700a8f3092834c1a6886c968c33c76e7c1122c16277d18cf2603978b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674947746, "uuid": "e086a0c0-7672-4890-ba93-95260a3c35e4", "value": "T10BB53340D082953DE541CFF21A3095447F37FF8B20FE2559A39836AE5CA61F16C25BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674947746, "uuid": "32973560-2a28-4a60-be4e-6d17bf2542de", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674947746, "uuid": "179ba100-4c3c-41d2-9e67-5bf5b2580560", "value": "49152:okug+HIgCb9SHRSLoRoaA37LmkSPTCwzurliv2cIjJSBLCgv2MR:hug+HIQxSL+2ekSbCwyMtIotv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674947746, "uuid": "126db41e-89d2-4c6a-9054-80e1f60eff0d", "value": 2363323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674947746, "uuid": "ed7d26a8-1f24-4dac-836a-44811d95650d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674947746, "uuid": "244f119f-814b-4874-aa13-d92037cdcd38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697cd32f-9f5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674946765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946765, "uuid": "a58e4f6c-def4-42fd-a133-0fc546be75a4", "comment": "Malware payload (Mirai)", "value": "7e0e2a7c64eaf7850ddfd67f3051c80b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946765, "uuid": "6b0c6c73-f300-4e9d-a511-3a671e943ba1", "comment": "Malware payload (Mirai)", "value": "54ab58fff27d6cff0c6e09f01d0c2a11219e6358a01cee1a9b0ff50b02cde992", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946765, "uuid": "c8938bf5-547b-43c8-b8b1-386f3dd85f9e", "comment": "Malware payload (Mirai)", "value": "9d49bb151d6e113afbd46e66bd7a67b4e9da894a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946765, "uuid": "bdd09c94-7683-4385-8000-2d2fba033171", "comment": "Malware payload (Mirai)", "value": "851fb24327364d4214a6f28d68c0f50a41e6e965f9b8fecc90ebb890050a23bfb3a80d4b7a15d0e14672eda90bb63b6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946765, "uuid": "d552bed3-675c-45d0-8a29-93a7ffacc0c8", "value": "T10F03E6E6B800ED7DFC1EE77A8453090DB231766541A30B7363B3BCA7DD721A4192AE46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946765, "uuid": "c919bd1b-4dc2-417e-9a18-d33f8ef68043", "value": "768:ExhPz95UtNZGaV77It3CGDSZnQoaEMst1tIK4BSy8aP3:IL95oIaBKlSFcEb1tR4BV843", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674946765, "uuid": "7b395edb-489b-4f42-a9cf-9e2eeb839323", "value": 40312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674946765, "uuid": "6422fe5a-39af-4db5-9cc0-551bb512c1aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946765, "uuid": "dce8c377-8076-468b-a588-03ca5ec41f4a", "value": "7e0e2a7c64eaf7850ddfd67f3051c80b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7d140c-9f10-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674912760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674912760, "uuid": "792e61af-643f-49cb-a71c-a053ae35ca4d", "comment": "Malware payload (GCleaner)", "value": "96ce40cb85ec4397ecbe0d49ace04a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674912760, "uuid": "b79bb8ae-b084-480b-b9e1-38bd7b248c97", "comment": "Malware payload (GCleaner)", "value": "5535668d524d7392339d4b9857be524d407d8d6621d500f07e9cae99a37b2541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674912760, "uuid": "ca566ca7-73ff-44cb-b365-cba2b18dceb9", "comment": "Malware payload (GCleaner)", "value": "df502de6258c13575b33f4d0de5d2d3cf25428fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674912760, "uuid": "d1d4e880-8b40-423f-a719-a417ed5cfbd3", "comment": "Malware payload (GCleaner)", "value": "86a67f88403f1bcb3e4b55b2512cdba03a3b8897c5bebb53e7ab0c8269f0e3569e86c67f65dfa1d17318282449743513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674912760, "uuid": "dcfea19a-a476-4277-8de1-3fcdb378c63c", "value": "T11EC5334BAEA1D2BEE69246F50AB1D1C49F329D8F203D1652394F339C1B706F095727CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674912760, "uuid": "f24946e3-b7a4-4e06-8076-8222ca4cf45c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674912760, "uuid": "27cb455a-ad38-47ed-91cc-0a31bb7c95cf", "value": "49152:okug+WmvHSvz+4uM+BGXxNXHooE+lOUZuDa/Ra5GNwmUxCJXuLCgv2MR:hug+Wm+zmMsGXHoMNIDeRa5Y6+Ov2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674912760, "uuid": "c5ca31bc-66b2-4b99-9e91-c8027e7bd0ae", "value": 2510153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674912760, "uuid": "03ccfcfa-06d5-44af-8971-ae99daf5446e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674912760, "uuid": "6f1e0c81-702d-4b3c-8551-8a2ccd792bfc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bdda63-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674894902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894902, "uuid": "23c90d08-eac4-4cae-b7b1-e68e6dd8e3e5", "comment": "Malware payload (Mirai)", "value": "6169469168d3cd6be1d8b712f86e96f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894902, "uuid": "80e00feb-227a-44c5-9340-da3d4ba3465c", "comment": "Malware payload (Mirai)", "value": "577e4acee15145b4ad8f9f4427f5e144b2e57a519c8f61eb72624352d85db9f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894902, "uuid": "fcedd61a-8eb8-4da1-942f-71e968d9a89b", "comment": "Malware payload (Mirai)", "value": "b1b5ff54ee0179325fd3a794ef70ae352b21d77a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894902, "uuid": "0ebc23a3-785c-4649-9ce9-d54043c52a4a", "comment": "Malware payload (Mirai)", "value": "a4dd1dba397bad41201f39a3727b35d4c33e35affd3eb1634b5d1f11adae9a4bbd81c091d646afcdaf2589582863190b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894902, "uuid": "504b8a95-6781-46e4-abaa-7a75d5902462", "value": "T19B835A3AED3A3A13C1E0653F12B70760B3E6534E65E8861E7D620E6CFF41994222757B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894902, "uuid": "42bdc221-9339-4d6e-b101-ddd3afee47ba", "value": "1536:CY0P5Ut8s6mtvUQ4MxnkTtvqh+dmOeoiWJI0wuOSWE4gx/aG/8yamhqXi:rtx5vPuO+peoiWJI0wuOSWE4gxX/Api", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894902, "uuid": "104a6eb5-d984-4049-8d43-bb08310d9710", "value": 84748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894902, "uuid": "10e47a9f-7f78-4ebf-8610-e123faa1374f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894902, "uuid": "d7950529-5138-4b7b-8471-438c55f205d8", "value": "6169469168d3cd6be1d8b712f86e96f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f2fc16-9f31-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1674926902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926902, "uuid": "33c8081a-9ac5-47d5-9a6f-95e387c16a51", "comment": "Malware payload (DCRat)", "value": "4fca3aebc40a63337761457761fd1439", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926902, "uuid": "5523351a-ad52-4a1d-9e1f-c903a8bb9497", "comment": "Malware payload (DCRat)", "value": "590c43d90ee3e09c68cf68892a17d6a5a41cbe322f541b2b8d95327bde97d500", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926902, "uuid": "8f04793d-0c9c-41b7-b3a5-c975802bc0d3", "comment": "Malware payload (DCRat)", "value": "63be46e8bc700ada2642497e20cd865ec0ad76ef", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926902, "uuid": "1f1ffd4e-56e4-4a60-9372-97c3c7fdb4e0", "comment": "Malware payload (DCRat)", "value": "5deee5a9e020a94686bd5026ef0519de57b2d23b9d2095e2bf47291c2bd7388c2e37ddbe316c60fbb0a943db134fd42c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926902, "uuid": "eda283d7-cadd-4d37-b5df-7f01d724744f", "value": "T1ADA53308323D6558D0F4AABD47FD7FF29639828845890AF8554DEE4D8CF63DE2C7A092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926902, "uuid": "f7ef6d9a-7873-4b66-a1ae-49596637618c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926902, "uuid": "91792207-790e-44a1-8960-8d2686e62149", "value": "49152:hziWaVaMD/CChcWGu9HaAhWqdCLOziyaK2muevro:jfMDrhcWTBxR3ziyapmueM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674926902, "uuid": "8dc45238-cfb4-4547-bfc3-189350c81fa1", "value": 2114048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674926902, "uuid": "e91e5859-59f8-4ad4-8ead-13fe76f74701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926902, "uuid": "baefe22f-8681-426e-bea6-3ad7e3767c9e", "value": "4fca3aebc40a63337761457761fd1439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003c6a72-9f53-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674941435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674941435, "uuid": "7a618419-297f-4114-8a93-b9b7ebb9e08e", "comment": "Malware payload", "value": "ddb64996fd4f793079ade2d263c90a16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674941435, "uuid": "f29b9ef5-aa2a-49bd-9e44-f192cf7b9cd2", "comment": "Malware payload", "value": "59d3f1a5837f1626fdec6b18c0c4919da1ecd68417bea9cdf467e95366b85957", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674941435, "uuid": "39450030-729f-43d5-ad0b-d3035f25fb1f", "comment": "Malware payload", "value": "28dfdbf6858f0fadca0b407711b72cd3a274b8d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674941435, "uuid": "f0194f1b-1f3d-4c9b-9b1c-7291437ed721", "comment": "Malware payload", "value": "abfa6da5def6ad8c0acc817cb74a5fefd18fcb2575d077e1d3d910d0a84099fad4cda67f2cb1443c4f6ce70af8215718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674941435, "uuid": "7fa98acb-b9af-43f3-8f4b-03fb236461ec", "value": "T17F84BF82A6E27CB5E5338B728E2A9AD4351DF493CF7C275A23387A1F18733618563315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674941435, "uuid": "a9671355-7b58-4b32-b7b0-d452607af54a", "value": "dc3a0c75117ce1f8b0d73167dcb17e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674941435, "uuid": "9f76e4d3-7b0e-4961-9ff6-8f7b29848bae", "value": "12288:2i4kfo1Ev1MVLwMmVcSNbBqIQmRz4qlFZ:skfo1Ev+cMFSNb2mRz4qlFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674941435, "uuid": "b3b6fd81-d83a-48cd-b3b2-4d10d5a4505e", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674941435, "uuid": "7d507434-a429-43c1-a6e1-c91b41925c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674941435, "uuid": "f147833a-3838-4ef7-a304-a28053f4cec9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d1d011-9ebf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1674878062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674878062, "uuid": "78b1a390-1970-471d-98b1-c99e04dafb88", "comment": "Malware payload (Loki)", "value": "3c7d7791f1deba22d2c94e6d07d730cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674878062, "uuid": "14cb526a-7552-42f6-9ed4-fb8a5bdfdbbf", "comment": "Malware payload (Loki)", "value": "5b08466cd86a0361398d34b9dfb5acd06834b59d4fc44d15b087be88596f63ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674878062, "uuid": "4924d133-fb54-4c68-9fe9-42194b74f723", "comment": "Malware payload (Loki)", "value": "fee1ab09784f3ba1570dbe22f37330202710f303", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674878062, "uuid": "774d1d54-1f44-48a9-ab3d-5ac66cb8d0e7", "comment": "Malware payload (Loki)", "value": "25e3d42c871ef12be06216c1713a07571f010e8fa1ad70c8c3f0a1cd6fc52d5a288ebc10ed41944071d469ffd04a60c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674878062, "uuid": "f53bf4fa-6448-489e-b9f2-e0451bf45aff", "value": "T1B6D48C1023E99E44F6BE4BB886B9405113B77C977533E21D8ED130DE4EB2B14AB46B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674878062, "uuid": "a9749e90-58ae-4070-afd0-ce8fbb9ed60a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674878062, "uuid": "18c8c578-85b0-45a3-9882-7686697cb0dc", "value": "12288:mSkOvbnR8ey/ZhgLXDjzFqIGiYs3gY/FqYUQOpkVDASsgRC0d:Yv2XGiBgmFaOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674878062, "uuid": "ad14fabc-b544-4927-8055-dea2a79161fa", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674878062, "uuid": "05e335de-4b9c-4c25-93ea-34eebb441fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674878062, "uuid": "06f200a5-4798-4de5-8258-0d252aff6d41", "value": "Rfq_V-23-9721-025-E_05_Domar_S_r_l__pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcda5d1-9f3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674932918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932918, "uuid": "476f2ec7-2be3-465c-a250-25d1f28a2371", "comment": "Malware payload", "value": "3ae89767052994b4bbf9968e7b3b8547", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932918, "uuid": "6e34534d-80e6-43bf-acfa-bcd551513546", "comment": "Malware payload", "value": "5c57baa8a5c31d138e3d3d325cdb70a3d851061586d4a8ab961b123c357cc64a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932918, "uuid": "aa5990cc-9229-4909-9745-ca19ce9bf0a3", "comment": "Malware payload", "value": "02d9452620363e21a8cd81038d36409537454647", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932918, "uuid": "d1e03ac0-2be4-4daa-a4cd-72cfdcf59a93", "comment": "Malware payload", "value": "aefbe9d39d77cbcdce982394356c399e78e6139da88e504ebf901b3f9289f7f48c3a9317f6c48d394ec763a3a1fe0c9e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932918, "uuid": "206cc040-98ef-4791-a412-34cc2978cc4f", "value": "T17F938E18D932D139F4A210FFCBF796BD9D684B202307D4D7A7C01D89A7869D5F832A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932918, "uuid": "f42f0417-a3b0-45f6-ba31-d360b177d24c", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932918, "uuid": "a96ddadd-98d0-4fb7-a7a0-a16a829fab48", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4APwSzJVOOQScg40sVYLtslXch:Hw+asqN5aW/hL9F6Bb0sU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674932918, "uuid": "05fe47c0-484a-47f3-b68d-c92b2cba8f04", "value": 94704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674932918, "uuid": "f25b6ce0-6740-4f60-a624-35fb87c1c14b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932918, "uuid": "d3672c42-699b-4ec7-b153-04d153b92af4", "value": "2023-01-26_3ae89767052994b4bbf9968e7b3b8547_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935705df-9f03-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674907322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674907322, "uuid": "90e3dd04-6c10-46fb-ac65-4cf3056da25f", "comment": "Malware payload (RedLineStealer)", "value": "c06aa3ef465583d25fb07168561ae455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674907322, "uuid": "17126cc5-bf48-4eb2-a7eb-60b35ebe15ef", "comment": "Malware payload (RedLineStealer)", "value": "5c6e349b08b9a42497bddbebbe2923f62bb2cfb07d773551114d1dfd7ecf2350", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674907322, "uuid": "dbd79a8e-8156-4af7-8fa6-d0a479b884ab", "comment": "Malware payload (RedLineStealer)", "value": "32c941cdfddee15690ad398cd2cc72142300fdb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674907322, "uuid": "46f27b87-3b5e-4eb5-ab56-a0ae07e03757", "comment": "Malware payload (RedLineStealer)", "value": "a88b12350138ef9ae4adc7ad274f12a4c9b4fca87063838af8c1a0f52134827e51097f2f3a5db95958652a39bcd4f90b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674907322, "uuid": "7857fff1-d399-4358-92dc-26568efe6ef9", "value": "T14184CF0157E2BCA3D916CA369E1EE6F4632EF8508E15736E2B045B7F18F1173C9A225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674907322, "uuid": "b10575d0-39ae-4118-878d-79e44974abb4", "value": "02e2a6cbf522a2149390d29c2ff67ff0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674907322, "uuid": "f47063a8-5e43-4d74-aa0f-4de05e2c6e98", "value": "6144:JOLSMB/RgRBbLrez+/JFLWWDwjIVsjpSbqSwzIDMtDP:JOWeGB6a/3Q/pSbqSAeMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674907322, "uuid": "b4127476-1e4c-4614-abd5-8258ab726ad2", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674907322, "uuid": "1768470d-6bc7-4302-ba4b-55e48721b782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674907322, "uuid": "35dc44f7-7b44-4ad9-9001-7955a42f676d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2620a6da-9f3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674932908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932908, "uuid": "1059e52e-a1e1-4080-a6ff-4caeee349af7", "comment": "Malware payload", "value": "f74feeb0d962353e9b6657757f269638", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932908, "uuid": "62ba4f9d-1748-4b1b-8f78-48ab65be6a23", "comment": "Malware payload", "value": "5cca39e72a29f10aea0a60c2464259ca4d05534be1fc02ce6841f2d42d797a87", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932908, "uuid": "141dbc6a-9557-47de-b899-cfccaab4c2ff", "comment": "Malware payload", "value": "5dead7f0ab89b6ede8975e836e98bfdab05e452b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932908, "uuid": "ed33d323-ae98-4462-90d4-0628d35d3357", "comment": "Malware payload", "value": "ef33aefa4549a8e681ea4db104eee5410816a00e86bc5f2066b9845b7a04ad4429b2ed1bc093ff4b6471a7cd9a668eb9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932908, "uuid": "cd413933-c664-45cf-881b-a0c774133256", "value": "T19F177C02AB924073E0B22970C57AB7655760BF742E32D29FBE44715AFE727C14D3236A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932908, "uuid": "900f8a24-7fe7-4bdb-a8d8-135046d2e6fa", "value": "53780ed3bbe2f39874fb0f51abdcdde5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932908, "uuid": "d55b9c6e-42e4-4684-930b-7ec7eb052fb4", "value": "196608:ymKxuWuZUblOa9+6Y7SOEibgRXmKxuWuZUblnqrKryIHTlHKE2kNT:VKelFgR2Ke8qrIvHTlHKmNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674932908, "uuid": "c0e0f085-9be0-48b7-b437-696c96065dd3", "value": 19129975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674932908, "uuid": "d4137b46-3a68-4028-8bf3-5f48e7b4b05f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932908, "uuid": "f81e6f5e-e2b2-42df-b8f6-3b7451b60468", "value": "2023-01-25_f74feeb0d962353e9b6657757f269638_mafia", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea99a180-9f22-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1674920783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674920783, "uuid": "fe136eee-190d-4993-b5b5-a22b9aa04820", "comment": "Malware payload (GuLoader)", "value": "55f55f9bd22ea1e2543d43e19cf66fe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674920783, "uuid": "5f874175-ca9d-4cfa-a320-e49aa9ac2b39", "comment": "Malware payload (GuLoader)", "value": "5e6a06823a71a80073a6c260d90e16044c3676709b8ce469fd2050de98979b04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674920783, "uuid": "770323e5-9c77-4c7a-8aba-c74f091ea13a", "comment": "Malware payload (GuLoader)", "value": "4b3f44230ee5affa6a67e94594e50460a468fcd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674920783, "uuid": "0d30349c-fdc3-449b-b5f5-85fda82c7e86", "comment": "Malware payload (GuLoader)", "value": "95d8a4d7017f3a1c5d84ef498b3ca13bbd98186d5cea8f49bb2c08436818f0288cc322e9866c3bd8bebcaa9422090644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674920783, "uuid": "20af72b8-9256-47f1-9108-0bc91c8650a7", "value": "T1DD74DF813444D1A5E12ACF3025745BFC123A7FBA6C99338D6905FE772873AC2763662E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674920783, "uuid": "45b607d4-e1e3-4db5-b5dd-3a705618256f", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674920783, "uuid": "e30dcd03-80dc-4b4f-9007-4b07ec2b5ac8", "value": "6144:oIw3Ee6bWfNA3+YjiLC0FWco4mQCjrmS7ZjbfYs6bQV:Z0S3+YjiL7OgCjKGjbfYsvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674920783, "uuid": "456b2c4b-322a-4b5f-93ae-8bf61b117f16", "value": 347838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674920783, "uuid": "f1be415f-52b6-41b6-95e8-17339909d649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674920783, "uuid": "d12a6793-ef23-47b9-86da-a3f52b29657b", "value": "Halkbank_Ekstre_20191415_081738_949589.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47099dc7-9f14-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674914495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674914495, "uuid": "120829aa-9cc5-45a2-9af4-469d1efa1926", "comment": "Malware payload (RedLineStealer)", "value": "b289ee7a52f3c268a7e8a798f5417cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674914495, "uuid": "e11a1d7e-659f-469e-ba01-751c1de34b14", "comment": "Malware payload (RedLineStealer)", "value": "5f85677bb01576b77bc0f57057899d9ec929cee0aeee7769b75baa8faf26025c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674914495, "uuid": "fbce3863-f9cc-4e0a-88c5-755f1b5b3b83", "comment": "Malware payload (RedLineStealer)", "value": "bb6b4670f64e3236551f4c7327454c1918579061", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674914495, "uuid": "bdac5bad-0ffc-4af7-8bca-a9005b738abd", "comment": "Malware payload (RedLineStealer)", "value": "0178337c07edface13cba4a97f4fa8f9a54eae6e627c29d9cf1c69297725cc0f2a87e2943259d2d8071bfab8ac5571d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674914495, "uuid": "bf726ca1-0712-4592-a926-6ba26988ba53", "value": "T19884D001A7E2BC60E929CE76DE2AE6F4671EF8908E14736D2A145B3F14F1177C5A321C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674914495, "uuid": "0754a419-92f6-42bf-810d-fc178c93de53", "value": "d191080c270d3118935d8b6a682d2ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674914495, "uuid": "e2e8c0d4-daff-4157-b3f0-d0be74ad598c", "value": "6144:RX/LJfhurOfqKl12lf7o7qnDZnAdTpxDMjlliqSwzIDM+RcfP:RvF5urKqf17uqnD54DMjSqSAeM+Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674914495, "uuid": "1cdc45ce-ba49-4a74-8422-b61e71898f1a", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674914495, "uuid": "033cb9a4-c108-4fa2-985e-b47aa82a5268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674914495, "uuid": "7942b6d3-2210-45ef-9b1a-e74e9e52d5dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb58eef-9f51-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674940650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674940650, "uuid": "59946e4b-802e-4251-86dd-e4343b0b0793", "comment": "Malware payload", "value": "c5d43b879aa9857b2c5e33ab754feff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674940650, "uuid": "805ed217-b06c-469d-b538-5779363cb549", "comment": "Malware payload", "value": "5fb75666d15c43a83951ba8c261080a50d6228008947555ae2ab1ad5e01a8767", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674940650, "uuid": "4e15bf64-974e-40d4-8016-9496314adc29", "comment": "Malware payload", "value": "8e6c9a4f02c5d289c1d3cd2873deb56de385bf63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674940650, "uuid": "2dde2344-501f-4a54-8f42-eff1f904b9df", "comment": "Malware payload", "value": "55b8a1907f8952b3a347eb16385118b13c90d2d31601886363be200943f9c87366ec568718d74b9b0dda5cbb5ebbe0c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674940650, "uuid": "f0a6c56b-56d7-403c-a03b-587dedbdc114", "value": "T1DAF52C2D77B9EC30E40569BBC69185B2D546EC31E923CA6B3544FF98B836F9012F134A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674940650, "uuid": "fd83436b-c9ae-4323-8579-2a23c24fb51a", "value": "c9e1b2a126d82ba1f1e9535cc8198cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674940650, "uuid": "59b1ca61-1924-42de-b519-1485a823ba70", "value": "49152:BELUqL4c5CJQYXwf1Rm2YGOapGI+NcWW3yg:BELUqL4GCJ7XwtRm1an+qXyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674940650, "uuid": "ff05c69a-e485-4905-86ea-79ef07abb51b", "value": 3553792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674940650, "uuid": "19b0bd32-1ef2-48b3-94b4-61be9d8a2def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674940650, "uuid": "57167b7b-cdeb-4be7-91f7-da41293842fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a07362-9f55-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674942415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674942415, "uuid": "abfc831f-99c8-4510-800c-af6b545a480f", "comment": "Malware payload", "value": "2f90d81f2feb0a5b8444e8f6e6b93eee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674942415, "uuid": "5f8f896f-dd28-4a42-a6b2-c9d82b015deb", "comment": "Malware payload", "value": "60427397a5a9e7cf4668d83a9f8d9e6958b34e865a1b3bacf37ce0360586a657", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674942415, "uuid": "341cd832-3363-433e-a2fc-6493b1e94dcd", "comment": "Malware payload", "value": "1b0b891f6ce23734248be6b471adda6668713ac7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674942415, "uuid": "c9e8a0a3-e8ea-42aa-8ab1-73554f6685ed", "comment": "Malware payload", "value": "cf1d59282d40a3a1996ba468e6fc4959dc42e977ecc59d7dba65108e6a7ca3d6d1a5054117f1f2bae37554af6fdc3735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674942415, "uuid": "d44fb484-adbf-4a66-808e-8b36c8c747e2", "value": "T12FB5334F62D0C57EC463C7B63A3149909FB7FE8B203C1566319A678E1D322F12859BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674942415, "uuid": "8f4e24e4-2096-4ab3-a24a-7fbd194b6df5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674942415, "uuid": "6d2c2a60-809f-4438-bfcf-7386d99481a4", "value": "49152:okug+NENOKrAl7fqrF3JfRDub4BzUPt+iZLHfRJbLCgv2MR:hug+NErrAJfwF5fRCUzQ+i5v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674942415, "uuid": "bcb04221-3265-4362-b5e4-c6a80596b617", "value": 2348510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674942415, "uuid": "0d6aa354-d840-4456-bdd6-7c0e5651e80b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674942415, "uuid": "d2d7ee8d-9943-4019-94c2-3148877f0001", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f947b2a8-9f58-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674944000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674944000, "uuid": "ba14894a-1775-4b76-b08a-6f2a3e7c412e", "comment": "Malware payload (Mirai)", "value": "bbecc3e14648bd58eed197c88cb20e98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674944000, "uuid": "8c8174da-2b4e-4547-97a4-3ba7b44b50d6", "comment": "Malware payload (Mirai)", "value": "61d372592ea9a1ed4176da15db5ee09a45dac3e5ca8a44bc20c0e5c2d30e6615", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674944000, "uuid": "d9d272db-b6bb-4194-853e-002837c2e172", "comment": "Malware payload (Mirai)", "value": "49cf785331712ed0c3ba842c830e8bc7833d1288", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674944000, "uuid": "b61ad9c2-ec52-4b41-a684-de267b01cba5", "comment": "Malware payload (Mirai)", "value": "5e77edd16e571cd809604bc533759dabb4c493d5ef37f0ed24d9e83b46cc3f14525feabac71714e39339b3f42c08fe3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674944000, "uuid": "987eb5c9-32d3-4f7a-a105-68fdf9b5c09b", "value": "T11BF219A5BC96CE02C9D46177FA2E469D372A139CE3DE33036E252F61778782A0E77045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674944000, "uuid": "e78b4ab2-419b-4763-9ff0-91450f75f18b", "value": "768:hJhbTvqPxgfdVX69QPjn2o555wT4l0WrrHDe4sZCN+8lb5uSN45/WPL1v:Naf94z2otwTPQ3BNTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674944000, "uuid": "6a1e2871-23b0-48a1-82db-fdf973788ec7", "value": 36156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674944000, "uuid": "923600ed-e7b4-4f9c-8412-802c9cd8b9b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674944000, "uuid": "11337e7c-eb86-401a-a8c6-4bd75d3d1200", "value": "bbecc3e14648bd58eed197c88cb20e98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c05ec7-9f48-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674937067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937067, "uuid": "dedd2f1d-6a63-45a3-b443-59d44e3a3fd9", "comment": "Malware payload", "value": "3327751be1890fb03a1f1c6aea9d1764", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937067, "uuid": "51e91135-c042-4831-80da-cec5b98c41b1", "comment": "Malware payload", "value": "628cd106d2ef532455d36d882b5e26e8bea2eece17fc0a068ef0203eff2b784b", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937067, "uuid": "d15508e4-8e03-493e-86e5-abae616ac693", "comment": "Malware payload", "value": "97990812ad875236ca9cb5cd085785fab67cc6f5", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937067, "uuid": "7d18ff4b-ca20-48c8-b7c1-3328c3cba94b", "comment": "Malware payload", "value": "e6270b62619b70364717dd174cdb5e1629c626033eddf524a8b2a235c5e44ba72755dbba62a3d3cc021c0e8afb81d6e3", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937067, "uuid": "53a38785-1825-4981-8047-7bd77ef6c3d3", "value": "T130E0A3B356414C4591B083AC7C85719C50C7E14957C75E14B5C97E232D90357E8F3184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937067, "uuid": "3f09d478-6629-4dbf-a801-cba710f7080e", "value": "6:h4QzhqIKAEtaMABuVzYkx1fAbplgCMLKT62J8E9xETLt7gErzWh0Mw8YXcVWUMQ0:hPEhkacFVZELt7eLfYXcVWUMqGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674937067, "uuid": "197ec9a5-d485-4823-bbea-b5593632f39c", "value": 433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674937067, "uuid": "84723acd-1454-45f1-bcf8-0fbb38f059dc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937067, "uuid": "7311a71a-e249-4a01-a89f-5810d7c7fe49", "value": "Eft_1087_1262023.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3364db-9f4a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674937620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937620, "uuid": "6fe59bcb-cc7a-4e39-a46d-8856fa8fdf35", "comment": "Malware payload", "value": "864ac4716a3408531e003f3b164313f9", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937620, "uuid": "3785c985-c615-48ec-b9a9-f41f2d7c5d7e", "comment": "Malware payload", "value": "629dc0590bf8733fbb1453a31d3d480a63c9056dd4300eb04c5a8d3d3062dfe3", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937620, "uuid": "94e6d851-362d-40d8-8433-27e120955c8f", "comment": "Malware payload", "value": "f7ea374f73784dd3a323366278c68ae5c02b1c86", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937620, "uuid": "f08663b7-3b29-4aea-9211-69ea06ee20ab", "comment": "Malware payload", "value": "91b98b84a7cbee7d7626dea5283f51d273474f3c8cad867c08b4b0665cdfd0fc838e3ca09c72fa010f19de8714bad9d7", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937620, "uuid": "4b6cc85d-0bd5-495b-8079-7e3bfb5f384c", "value": "T19D01BDA3584139680365ADEE7A4170A5056BB1E648CDC8C0E181A471147DF2FFA67E3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937620, "uuid": "d4fab945-0c5b-4c68-bdc4-546d2d06fbf0", "value": "24:hYzxBqhCjKDY42RbUA1t+4NBA2DKD1KD97:rCj0w1nN26CW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674937620, "uuid": "88a22e8a-9d0e-4466-90ca-6b2ef64f84bb", "value": 796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674937620, "uuid": "50d96a97-663b-4838-8a48-ab0ec2373299", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937620, "uuid": "2a729f3a-322c-4068-b503-a2284f189889", "value": "sample.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db195a9-9eea-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674896414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674896414, "uuid": "5f9ea6df-99ef-4f54-a416-964609871591", "comment": "Malware payload (RedLineStealer)", "value": "9ebf95dbf897eb05edd8d2e537166d3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674896414, "uuid": "8f5cae63-f72b-4650-addf-53965b6fdee6", "comment": "Malware payload (RedLineStealer)", "value": "631d4b6aa2c0980a0dba7fd2df7b651a838851a2f450220dd71713bac6ac2686", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674896414, "uuid": "b876dbda-b14f-4e0d-9576-60cd6da88073", "comment": "Malware payload (RedLineStealer)", "value": "9a1891309c2174add2c071c7933e337ba03763a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674896414, "uuid": "cdab8031-122a-4854-a902-06dd49be1785", "comment": "Malware payload (RedLineStealer)", "value": "5ef08681f4b1538b412e0ed25f9b3b8f9e033455c40e8782db067bb38b5012a86c3b9831853983b58d34d2eb00ddfefd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674896414, "uuid": "00a12501-6388-41e7-ba10-ca311a2cd6fb", "value": "T11684BF0167A2BCA0D925CE769E1AE6F4E71EF4908E1573AD1A14BB3F14F11B7C5A320C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674896414, "uuid": "e52092d0-0ce6-4af8-8b6e-4eb3e820fc9c", "value": "4bc9925dd568c221c7d9868dfc769dfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674896414, "uuid": "16d1e57d-551f-43f0-8507-83a97797748d", "value": "6144:HLh1FuE7YD7/hJpHadS0j6CCLM6qSwzIDMdP:H11gE707H2xE9qSAeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674896414, "uuid": "bc2401bc-3ae2-4188-ad95-755c7f9bac8b", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674896414, "uuid": "5423112c-c090-40d3-8ed7-14b804e03a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674896414, "uuid": "aace2de5-4cf7-44b1-b31f-eb7cc73d6ecd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022e7817-9ec2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674879161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674879161, "uuid": "47590095-1ad3-4671-8178-fb3d41f69381", "comment": "Malware payload", "value": "3c329700417ebb92a5bb3a3942d39160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674879161, "uuid": "7afcf9ea-c8e8-44b7-aef0-b3f555749c21", "comment": "Malware payload", "value": "636a19d31b845f3d46ad586d69d80620c7c9d4a8dea5a8b6bfb821841b1224c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674879161, "uuid": "cf1faed2-ccb2-4771-843a-23cdde959ace", "comment": "Malware payload", "value": "c57f7d34bfab42191e37bac580c5ad0fef2a02db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674879161, "uuid": "4fd8401e-4e9c-404a-a761-a233232938fd", "comment": "Malware payload", "value": "e42aa94f99236b36f4f99ebf27e8cbeda0862a7b48af119ccefb37d43197819ff6e74908ef918c91af8d24ef0fa42641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674879161, "uuid": "04976a9b-2632-4d6b-afba-2ec1fb4b4b2d", "value": "T1F176331433E4FFF2E1201571C1B82FC569F5AB5C6F129CAF639F8A1D3CB9498A112668", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674879161, "uuid": "90d32d2f-4616-456b-a517-5e0cd42ff488", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674879161, "uuid": "1556b78a-a75a-4ea0-9261-3a7a55d649a0", "value": "196608:91OYMgHZNAzme54smI9+CLSwnKDV/RpIiVc6vE0j:3O7B5H9+CLSwnoVUxyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674879161, "uuid": "4e58d130-5d11-411d-8d35-754c50754227", "value": 7618745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674879161, "uuid": "318c0b04-6aab-4f68-8546-80ff607b43a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674879161, "uuid": "aa548c93-608b-45f4-90d0-c903d5e89f53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbb9045-9f53-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674941461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674941461, "uuid": "9eb543eb-379b-43da-8ebd-f57ab3e2aa72", "comment": "Malware payload", "value": "da75dc77ed7ae453e80aef0d02a13166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674941461, "uuid": "ffe7e6b8-4d39-45c3-9e07-46013e193fd9", "comment": "Malware payload", "value": "63cb3f34caeb039a1dbfffd4e45e449d000ee4a47dc520401402d7440c565d52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674941461, "uuid": "e66f2d48-e905-4e20-89ab-4b7dcfa30a04", "comment": "Malware payload", "value": "74e5a3a3e3e02963e7e58260d67fd0f7d0a459eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674941461, "uuid": "d7449c13-2ad1-4f87-82aa-7816560bac8f", "comment": "Malware payload", "value": "09966a3a6534bdb292b93c6546bd1549678e6d4ce604125c85b6e35ca7a58a348cf83569ed00a4a5f5d5ab8d2e12ec7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674941461, "uuid": "0af487d0-ac20-4e99-99ad-e4c0a6036b60", "value": "T13CB5334AA982C97EE943C7FB3934D040AFB3ED87683C1640B6852BDD1D754F12D3629A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674941461, "uuid": "4e8533b8-f702-440c-b565-096285ea180e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674941461, "uuid": "b9047b2e-c47f-4a2b-aad9-f4d029126480", "value": "49152:okug+Wy6rZMK9fUN6CLQ3l19MVznL5sz7xeAXopCUi+NPCG5wKQ0OdknLCgv2MR:hug+WVrqK9cN1M3CXsQAXopCUi+NaEwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674941461, "uuid": "bc3640f1-4571-4974-b749-fd5ea7f678b3", "value": 2331606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674941461, "uuid": "2f42a7eb-ef53-4f47-86ce-556f0b9fc565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674941461, "uuid": "170f384c-7bfc-450b-bd58-baaebbd653cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fada55c-9eaf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674871265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871265, "uuid": "ea909f77-2c67-4d29-a54c-5d99f124d1e0", "comment": "Malware payload", "value": "1291e7c96e6c89b15376adf9fd0abf6f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871265, "uuid": "f010fbd4-dd74-4dfd-a4a1-d80bd736bf6a", "comment": "Malware payload", "value": "6613469bb3b5835dae03af91c1b5a6669bd82eed25d67a125d4824415daf9186", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871265, "uuid": "3a45a6ff-225e-44e3-acfa-af30db935d11", "comment": "Malware payload", "value": "bfeb74aef3b263ca523ba37548933e0ef15bd435", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871265, "uuid": "158c1729-48da-4b44-8342-ddf124073f91", "comment": "Malware payload", "value": "238a1f52d671f1e2e81636dbf77309b0e56a6f3c1945a9f77569071c649cfc56d0f6ea6a7d67f2379eb48721e5062481", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871265, "uuid": "32f32d9e-4ad7-458b-89ff-1a039cb2f149", "value": "T1A462388B06751C61F368ACB74A19B45E01BFF13A26D240A4BFCCC7B17A7A0094B652F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871265, "uuid": "6c8f7d3e-5caa-4b2a-8673-e0ba4a0ddb25", "value": "384:aLKVneNL8ELpak7Q1SXGB0RBf3oXggNsak8Oqbi1kOoIXaqgw0dUf4nwir:aLMeNL8ELpak7Q1SXGe33oXgesa9OqbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674871265, "uuid": "cde0ff59-9a18-4093-840c-b0916e290457", "value": 14771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674871265, "uuid": "046d16de-ed72-44f9-afaa-a4daeabc5e50", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871265, "uuid": "9ab86637-f855-4ab2-97c6-9072ab777493", "value": "6613469bb3b5835dae03af91c1b5a6669bd82eed25d67a125d4824415daf9186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005d00b8-9f25-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674921678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921678, "uuid": "b6f08a8a-4b7a-4dfe-9f70-383c15ccf221", "comment": "Malware payload (GCleaner)", "value": "90416c35ae0b0162f9fbb341e8507fea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921678, "uuid": "1c6b503b-ac53-4d9f-bdb3-a4188399974e", "comment": "Malware payload (GCleaner)", "value": "66d1783de9eed94650203f0775d1247032c1e39e6446dcbb431c42b8a4050209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921678, "uuid": "28b5ebac-f2f2-4a94-bdb9-5ee31149625c", "comment": "Malware payload (GCleaner)", "value": "f0a09cf16bb05f60fef5ebc8bf7d5866bbce9e6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921678, "uuid": "6abcc02e-a71c-44cb-99da-6e106dcc2f0e", "comment": "Malware payload (GCleaner)", "value": "ec2620d739c67010045ff3ec05579172c3a947581e7b3c9dbf5fd381d2e140fd5063caa68874959f9fd2bb501deb8e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921678, "uuid": "041c4070-9c6e-46a4-bee9-ecc6323b0fa9", "value": "T138B53397DAC2C5FEE6104FF62A21A184DF37FC27D9BE51027605A2ED07A16300DB2799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921678, "uuid": "ee2c309a-c3c2-42d7-aaf2-c01a36a82ee9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921678, "uuid": "38f620a7-5890-4f20-b39e-8c1fb40f7036", "value": "49152:okug+Fzdk7T/bMfZrVxtnrQqcM/ERCuWSNnMF1BngfvDkBLLCgv2MR:hug+F2X49bWqcMsHNMT9ivw9v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674921678, "uuid": "a6eb6fda-e17e-4045-966d-0f05b30ae438", "value": 2328197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674921678, "uuid": "025e0cb1-28c1-4549-879b-c912ae007fe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921678, "uuid": "72693ea1-7ea1-49f1-9584-24e25e015a01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c146ae-9f37-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674929817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674929817, "uuid": "c86774d0-cc9b-4f33-9dd5-70e4a2066b26", "comment": "Malware payload", "value": "b34a6034e441fe473d9c0e000dd3cba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674929817, "uuid": "e4fc6fdb-f4d2-47a8-8ed0-cfc9ba2ecbc6", "comment": "Malware payload", "value": "66eee9351d2bb45fe88261c4ff2f34678588fd9236f83e774cbfcc4bc1ff913c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674929817, "uuid": "861cf1d9-2efd-4491-ad17-d034eeb36819", "comment": "Malware payload", "value": "9a429ff1ab8a00479df8180edb11f4c7d9822092", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674929817, "uuid": "548872ea-7257-47e8-a430-cdc3c9acca70", "comment": "Malware payload", "value": "be39c1e64706405a30e027798638cd45e1154db0fc2791adcc6deea85a6e8b733e5a42dc613dfcc697fc2abacaf790eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674929817, "uuid": "86408c78-9ab8-426c-bb3e-8a0b63938e91", "value": "T103B53307A994D7BFC822D9BA2D3192B15B23FC43643C0192765A33CD2A72B705DF47A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674929817, "uuid": "f5be1bc0-cbbb-456e-a253-923059e3e452", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674929817, "uuid": "ccbd4566-b26b-4195-b24d-2f0de59f6cac", "value": "49152:okug+Z5RcxoAgJRHqM3fbPPt7mx6OE5ky+mhzeQ8TLCgv2MR:hug+ZgteFHTPtmLOk1Vrv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674929817, "uuid": "ea513f9d-27c2-4127-a296-5b49a6a07295", "value": 2356005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674929817, "uuid": "ca2ef108-afb2-4137-a08a-8a2fd2e85c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674929817, "uuid": "6dbcd4b7-bd06-4365-b61b-2193786c46bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabede23-9f24-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674921642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921642, "uuid": "390457ea-757c-42e9-8237-be343a6d89b4", "comment": "Malware payload (RedLineStealer)", "value": "d7e03c4e12795600c2a22bfb80040474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921642, "uuid": "fafa0cd3-ebbc-42f6-bc44-96c7557a625a", "comment": "Malware payload (RedLineStealer)", "value": "693f31a5ca4725de280a4286060c4d1c8ade1fde322906b8f438b4bb796ff566", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921642, "uuid": "4fe09008-04fc-46f3-8a6b-af60fc67051a", "comment": "Malware payload (RedLineStealer)", "value": "e0cce8deae2ce0882324fcd30ead47edc79cee55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921642, "uuid": "82d25f1c-b6c8-4fb6-b39c-1193b2c7c300", "comment": "Malware payload (RedLineStealer)", "value": "a7e0b65ced6a22bc1662441f473b6c02d9dd109a5f9d3a2370f5684d65cdcf1ae4c1a52a8037d122027391eaca0598dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921642, "uuid": "ae04cee1-0f37-4873-98e2-020a9ca14365", "value": "T1A684BF02A7E2BC71D925CA769E1FE6F4672EF4608E14736D2A186B3F14F1173C9E2118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921642, "uuid": "6d2f5044-d3f6-46b9-914b-6f1471855823", "value": "d191080c270d3118935d8b6a682d2ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921642, "uuid": "1eea3d66-8dd4-4550-afeb-76b3f663cdd8", "value": "6144:xLaqlMAckTs9NWF9GIRva7YbSqOfEeZQbVicTrqSwzIDMH0P:xW3kg3W7GZweqbVrTrqSAeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674921642, "uuid": "3b4b5572-fafc-4f3b-a2af-d7d7b08293ef", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674921642, "uuid": "9702a145-0eb7-4e8c-a3ce-b4aa0e22f611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921642, "uuid": "ed4c4e34-c41d-482a-ad36-a77bc3eee4aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad97b9b3-9f46-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674936142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674936142, "uuid": "7c14a824-9fbc-4114-8a2c-dcf52fbbc676", "comment": "Malware payload", "value": "700468ceb4666adfc6f0cd19c3c12397", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674936142, "uuid": "23029345-48ce-4c88-8d2c-723b3345a1af", "comment": "Malware payload", "value": "6abb41d9933441ecfa5a5875c333ae36ad834818c326d51d826f118984f6d22d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674936142, "uuid": "cdd1bb19-1118-466b-a4d5-a9594a9492fd", "comment": "Malware payload", "value": "a069b65e05ceac71dd5a7e6e0a5c12ffb246fc15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674936142, "uuid": "3e5f7d65-35ca-4727-a78f-16ce276e947c", "comment": "Malware payload", "value": "f512d63afafd571229bcf5a3e430af43081ed5d12d40472e6513cbc6e8dabf175ef9e75c9c97328513a9b2dbbefe5ba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674936142, "uuid": "466b19b1-bd39-4619-b77b-094abf1785e1", "value": "T15AB53346A0528AFDD0178FBB16309681FB3FBDC7A03D1951324A539E3F3176416A2BAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674936142, "uuid": "0eaa8485-1351-48b6-aa08-135ec5925a4c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674936142, "uuid": "172a7902-941d-4a81-ad48-16c57c7957f0", "value": "49152:okug+X2oSmry5rWS+uM35BXAKvWD1BCm0yVsVvfdDpLCgv2MR:hug+X2oFtPBm6medBv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674936142, "uuid": "d11fc7f6-17d5-4269-a16e-b91af04f48cc", "value": 2340175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674936142, "uuid": "b2553dac-9848-4b8a-9ba6-2debc7e86c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674936142, "uuid": "43de66a7-7741-451d-bb98-8eb62c5a86e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3931f908-9eb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Targeted)", "timestamp": 1674874529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674874529, "uuid": "3e512165-c4be-4ef2-9025-831a581aca0f", "comment": "Malware payload (Targeted)", "value": "70c464221d3e4875317c9edbef04a035", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Targeted", "colour": "#303A96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674874529, "uuid": "d9eba456-3c62-45fc-bb8d-8fe96105ec51", "comment": "Malware payload (Targeted)", "value": "6c743c890151d0719150246382b5e0158e8abc4a29dd4b2f049ce7d313b1a330", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Targeted", "colour": "#303A96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674874529, "uuid": "9b0ceb5f-b54b-47d8-b8ba-bac355d1c164", "comment": "Malware payload (Targeted)", "value": "8a1d92c8e5b7a5b3a6a34137c9eee01f89cd5564", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Targeted", "colour": "#303A96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674874529, "uuid": "2f894000-0969-4fab-8c85-0245bd886c4d", "comment": "Malware payload (Targeted)", "value": "4eec4ef8c9dbf785c134c4713a0915278232782d88ac301e24526949a4be8da1ba4a2e09990ab94ff9eab41df2372d7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Targeted", "colour": "#303A96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674874529, "uuid": "dc5329c0-1330-45e6-88db-b465a0ec0485", "value": "T194E36C527AD1C472E2B30E311974EA725A3FFD305F21AA5F639402AE9F305D0A931E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674874529, "uuid": "86d1cf68-3023-494a-9487-7f0c9181975a", "value": "d59243e057545e233bed18dcd0f74e50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674874529, "uuid": "fee25bb8-3ede-4b08-a831-c143abca2825", "value": "3072:EpcLP/OYl2YNm96RhybfaX4mZd0+x02dfw5apKyu7dLzLV+hhgxQA:Epcflpi62bSX4B+7KVohyxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674874529, "uuid": "62b0d8ac-eda3-48ba-ba8a-70fb44aec9d6", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674874529, "uuid": "c9c3cbfb-7320-413b-896d-1d6f3df3883a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674874529, "uuid": "222c5d6b-443f-4754-9850-bd37a728a020", "value": "70c464221d3e4875317c9edbef04a035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f706851f-9efa-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674903624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903624, "uuid": "142d9840-866d-40b7-9b55-ef6d391f3e82", "comment": "Malware payload (GCleaner)", "value": "8fbe4b8f74a89354861f454486c633ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903624, "uuid": "5fa36a29-81dd-4caf-b255-90e51936cc0b", "comment": "Malware payload (GCleaner)", "value": "6ca494e85056b0101a20967140a86e06d7b468b41da24d33c6fa0323f98eb447", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903624, "uuid": "a6db15d6-fc97-4a02-8454-c73b5a828eb4", "comment": "Malware payload (GCleaner)", "value": "d535623b0561e4a90391daad06afa3a83db1a1dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903624, "uuid": "dc882fc0-de7f-4a43-884a-fb77b83482ab", "comment": "Malware payload (GCleaner)", "value": "c9d9121975617001216a087df5422eb07297ea80334d492299c66733b801d4f473224d2ff6449c4c3a9ce37672483bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903624, "uuid": "b4551a65-5a1b-4d0e-b84a-82e03b4ee48f", "value": "T1E9B533895061A2FFE54BA6F72931A048AF73FDCE703D00111564235E6FB6670BE7329A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903624, "uuid": "f9753233-8196-42e0-9e91-e49a79f5eb35", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903624, "uuid": "66dcdcc1-36d2-45a1-b013-b8102bea7975", "value": "49152:okug+Gj6TpY58z+INatqVoZVjLi+qWmq0RsTV+yJ6hItLCgv2MR:hug+Gj6TpYG+qoZtLi+CRsBrJAuv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674903624, "uuid": "48ea5b00-7c67-4200-a7b9-f3f831d152f4", "value": 2383008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674903624, "uuid": "ff3e6f46-11f1-4d56-b2e1-288c2826a505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903624, "uuid": "60c65bd6-2dbb-4d0e-819c-ddea032f8235", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a747b2b-9f34-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674928164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674928164, "uuid": "4af2701e-85af-4dd1-8b37-ad22e58de3f1", "comment": "Malware payload", "value": "74f3a89dc298bc5cae065d38cd0ee25c", "object_relation": "md5", "Tag": [ { "name": "exe-pattern", "colour": "#2F32C6", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674928164, "uuid": "478ff5fc-e384-4f76-bb31-c0634ba9e85e", "comment": "Malware payload", "value": "6eb0fda5b60f3fd5d9cfdfa2e25175ad445a4a0a84867810b51da9029f03016f", "object_relation": "sha256", "Tag": [ { "name": "exe-pattern", "colour": "#2F32C6", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674928164, "uuid": "d84302f5-718f-4c64-abf4-f74c0413473c", "comment": "Malware payload", "value": "d3496ed0a5bb4fa0c73abf02943037407f764d10", "object_relation": "sha1", "Tag": [ { "name": "exe-pattern", "colour": "#2F32C6", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674928164, "uuid": "fb6a0687-e6a3-4258-9fd0-3f9ba0bd41c3", "comment": "Malware payload", "value": "f80cdc24962505ef43c8a94463a0967ed05e7a4ac205f0a91f30467ec9281b78a0494fe34064a01f65687c5a898fb4d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe-pattern", "colour": "#2F32C6", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674928164, "uuid": "e94d7f9f-893e-42f1-8ab9-002ac643c254", "value": "T180216321604B5E57C219C8B7A4753097EEAF0793465F2987B101544049118A727EFFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674928164, "uuid": "8b926948-a3b8-4b53-bf65-a34969ed3233", "value": "24:QXJWbCiHTGihSFKCHo7cMR+weWifW1Au8HIVuEIoD2HGjI438FBKg+:4JUJoXHTM0wtooAh0rIK7I4MXKg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674928164, "uuid": "605522e1-b4c4-4431-8f79-bda2f2639775", "value": 1125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674928164, "uuid": "5085840f-11bd-46f1-b9b9-4b91bcb78885", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674928164, "uuid": "90ee6af8-c35d-4d37-b266-c04b84a1c13a", "value": "6eb0fda5b60f3fd5d9cfdfa2e25175ad445a4a0a84867810b51da9029f03016f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f678ca3-9f42-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674934374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934374, "uuid": "85927d00-06a5-4c3b-9859-20adcb3e2283", "comment": "Malware payload", "value": "5763ec951023a9a46c109378ed20947f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934374, "uuid": "a0cc4c3b-4368-49f7-b1e2-c0aa54495334", "comment": "Malware payload", "value": "6f64830d42b7c0b8930be9b5430a258d495a9cd8e9c02f11e87a563adb58dfdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934374, "uuid": "86876db6-c3e0-445a-80fa-d91dce314d7f", "comment": "Malware payload", "value": "379416a5cacbbab0af0f34033a41e7e09b479d5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934374, "uuid": "93c5cc3b-3917-4570-a396-46f979d0f3aa", "comment": "Malware payload", "value": "151764ebff25f360032117d36fa1c1950341421f53d3392d8be81ee5e544a363d0579af04f8d8a2ab5a680445ae4f556", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934374, "uuid": "5acea1d9-30b5-40b5-ab49-730f666be41d", "value": "T1CD446D38F9E6A477C26B8A71FB20B2466CFC4359AF34DBD9A28077413283557CA76350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934374, "uuid": "42924014-6411-4b0b-8595-6ff8cb81074e", "value": "6144:H8uXbxONFqiDmLPV/ZthPoXHR3u6ijodt3SYxzRF+hlmpo:HEmrVzhPoXHR3Pijod5rRF+vSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674934374, "uuid": "8369d9cc-ce90-4983-8855-c29997a310e3", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674934374, "uuid": "4f137533-e962-444b-a4ad-d2aec091ecd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934374, "uuid": "1d945826-6e64-4e93-8be3-b2100f692ded", "value": "pacman.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0dde81-9f58-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674943606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943606, "uuid": "01103966-4280-465a-85c7-04c25938c38a", "comment": "Malware payload", "value": "eb32c070e658937aa9fa9f3ae629b2b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943606, "uuid": "6aaf18c1-5084-465f-b908-0c543432e61b", "comment": "Malware payload", "value": "70ba57fb0bf2f34b86426d21559f5f6d05c1268193904de8e959d7b06ce964ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943606, "uuid": "5d437fc5-f367-42cf-b03b-7a5f985cb235", "comment": "Malware payload", "value": "f393d7b531cd44ce418647fe95715adc3e3c61d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943606, "uuid": "80b39333-16ee-401a-a6af-cb082fed0307", "comment": "Malware payload", "value": "9b6e8ae9840684fdd5463de91918986eb7b2e3933543886ed887667b8bdf7dfd8fff400e649a6753016056f798aac49b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943606, "uuid": "f99fe644-fe9e-4980-9e26-3de3d9ac6c6b", "value": "T1B4947C93ABD44295EC3EC431DC3745610622BCB9DBD05BDB99C8F27D09702D09A3EA6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943606, "uuid": "ea4bea75-efa0-4f22-a0ca-14592397094d", "value": "a4d32f1aef525b8ada6a26f28596ac2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943606, "uuid": "439132a8-d210-4319-b4c2-2b70946225e5", "value": "6144:7znUygWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:7mW2KXzJ4pdd3klnnWosPhnzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674943606, "uuid": "81eaad65-177c-4f05-986d-ae1e48930a3c", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674943606, "uuid": "5f99996d-6ec2-49ae-987f-c06e298d5f91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943606, "uuid": "d70a61f1-b7e0-4c1b-972f-a44b8be53248", "value": "mal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21dd412-9eff-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1674905709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674905709, "uuid": "c0f8612b-28d5-4db5-822f-8c2c988fb669", "comment": "Malware payload (CoinMiner)", "value": "7207a26cf8d156106b8062e7bb99eadb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674905709, "uuid": "894ecdb4-41b8-4e62-a56c-633705b39625", "comment": "Malware payload (CoinMiner)", "value": "70dddee5260354519c01b84b2d66783f7aacd89b4c6654bc765cbf34996b7018", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674905709, "uuid": "1db41f04-a948-4633-b081-f2af7bf89a5c", "comment": "Malware payload (CoinMiner)", "value": "c05957eb06774694226135a9813045f02cbce7e1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674905709, "uuid": "854dfc84-8462-4b45-b780-7d5488edac0c", "comment": "Malware payload (CoinMiner)", "value": "480344e5cc935e00759a516154e20b6609eca97fdedfbae63b0e93c0541447029b9240990afced1991af8a5c4e856a7c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674905709, "uuid": "59bbe263-a911-46b5-b5ac-fa158d594feb", "value": "T1DDD5E041FF1D94F1F6AA9034D56389B80E203C29AAD281573EBCFE0D5779381647A73A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674905709, "uuid": "537cb7e6-30d5-46fb-b3d1-9b1356a41744", "value": "0f8061980e6fad11f082c5dc3282ff76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674905709, "uuid": "afac3a2f-4aae-4bb0-bcc5-e05f0eaa508a", "value": "49152:YuAwIfF9ZsgVlyPR4urMdqatfZJYuh9j7eR:YuAwIHZsFxwrYm9jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674905709, "uuid": "62229511-5789-4bd3-87ac-34857a1f20ff", "value": 2909696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674905709, "uuid": "e0eded9a-5477-45e7-8269-e00fc473b6bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674905709, "uuid": "e4de3a5a-d9df-4850-b79f-e5d15658a1ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefbee30-9ec8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674882082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674882082, "uuid": "085f051c-bbb2-49dd-94d1-2599fbc9e530", "comment": "Malware payload (RedLineStealer)", "value": "3b4c0d0274385dd1c3f2a5c4afe730fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674882082, "uuid": "724a5160-829d-4621-96bd-0bafe9518668", "comment": "Malware payload (RedLineStealer)", "value": "7162ae318254f2743851f09dbd26e1a1b22da1673d055b5a33bab0e100f11d6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674882082, "uuid": "dcd975b6-c9b6-4a58-a41f-407a335c0206", "comment": "Malware payload (RedLineStealer)", "value": "a2d6fa3a4c2b05768939d3ad6b07ae314268ee7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674882082, "uuid": "7134bf24-8408-4e95-bdb7-3684c81f70c1", "comment": "Malware payload (RedLineStealer)", "value": "973826e027058bcbeb26d2114c14f072ffc830a51157723bee4413ff261ad6813435dfaa9bd54e1d43bb4ff1618acc9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674882082, "uuid": "23800316-3a9c-482c-9bea-3cc122d1c4bb", "value": "T10F84CF8176D57C4BEA67E6338E1AF7F8B51EB9939F1522E71208AA0F19B15E1C173300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674882082, "uuid": "94b4fcd3-6a87-404d-98df-6c7005c0a452", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674882082, "uuid": "2c6db601-414c-42a0-818e-3b83cb9e9619", "value": "6144:5LLWgJ0PuZP+vY3Du/svP/4hYe0lEFG0Ax9CEbnVnMsz8dV:5nWUo0DuyP/4z0lE40ALCWlL4dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674882082, "uuid": "6934fa82-b787-4dc3-8f48-e11b1fba90b6", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674882082, "uuid": "67c336eb-5629-4312-971c-f8ec21eb61b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674882082, "uuid": "b1a93087-a9b6-4a8b-ad97-efd902a82042", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f7e72d-9f32-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674927506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927506, "uuid": "5858827a-2fa5-49d8-a1f7-c2189abe6746", "comment": "Malware payload", "value": "096f0ab227027518fa6a224036abb21a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927506, "uuid": "732666af-1ad0-4e74-ad1f-772158512977", "comment": "Malware payload", "value": "7271a4fcba817ab547176e51a2acad97c58eb5168e3a884537ee3687f853a169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927506, "uuid": "c4cf27a2-a6f7-40ec-b2ae-8364f0002cb4", "comment": "Malware payload", "value": "ac2119b37e05664c0e90a478fa3f02837ba0bc86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927506, "uuid": "b7e5ad0e-ae58-40a1-8a36-0eab300b78fc", "comment": "Malware payload", "value": "225ef4256ccf0de62224e8cb5a78fc094c00441db830c345bfe693b1a3431a264a465b3c544b19903c98f03ed577f2c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927506, "uuid": "b6d9cb6d-aaa4-4623-aa53-58cef62fc1cb", "value": "T12815128C759072EFD85BC075CEA51C64EA20386A531F8253906727EDAA2EAD7DF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927506, "uuid": "41bbdf9d-bb12-46b8-9bb4-baf13638cb88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927506, "uuid": "0878b2b9-7ec6-4124-abba-aa88efa12b2d", "value": "24576:ayz5t4g541H3Z6bBnMH+5t9b1B0jNXj5:a8Dp5yH3wlnMHIbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927506, "uuid": "6d52a64d-cdb9-47c4-9bf6-7f551b568172", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927506, "uuid": "cec773c4-980a-4c1e-8df2-84ff35e4af49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927506, "uuid": "77189b0e-c5ac-442b-98c1-965d05dacf8a", "value": "096f0ab227027518fa6a224036abb21a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f03150c-9f3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674933004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933004, "uuid": "dc598176-4871-4d9c-b992-6b739d7270e9", "comment": "Malware payload", "value": "15578026730e6167e7de93f7b87b2af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933004, "uuid": "86ac6699-48f0-43b2-aa71-bc9ea4e0aabe", "comment": "Malware payload", "value": "7335d92aa0d7a2c2233b172e11474aa953c47cb7b8e6bded3dbf91a9d881e973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933004, "uuid": "4d148e05-1639-47ae-95d8-d9a91d9fe327", "comment": "Malware payload", "value": "6c554e922ec846d6338d9e97182c30486b154002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933004, "uuid": "5343342c-08eb-491b-9e66-fe534da84aa0", "comment": "Malware payload", "value": "74805872913c47d175bd6e4777ba6f8e84544db6fee94021269cd2fba046f8ac8b2b218cc3105e98cdeae6483a9cb174", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933004, "uuid": "95b08377-2f3d-41b7-a523-af6eb65af352", "value": "T1B6168E23B244653FC15B2E354927A654983FBF603B5A9C4B6BF41C4C8F3A5817E3A24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933004, "uuid": "fa94f661-4e5f-42a7-a7d5-e0b82b8138bb", "value": "fe3e0771cf98d345b42da1d17dfe44a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933004, "uuid": "94e5283e-0a0f-4b07-9744-a5d96466be55", "value": "49152:vDKt5jqtb72StuLh5cyqHo+oDc+HTst7R39JM9wWAToTCN7x/:L5KLhvN+ooV3ASWQ71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674933004, "uuid": "cf28556d-6a1b-4093-8db1-8f6add60d12f", "value": 4028416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674933004, "uuid": "0684d11b-bad1-48c4-9cea-a0c305cc7ac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933004, "uuid": "e2a0e22c-dea5-4c06-afe0-315d3a2a94bd", "value": "SQLi Dorks Generator By The N3RoX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27ef808-9eb2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674872612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872612, "uuid": "b41d1979-0572-41ee-85f9-8f1bb0e1ad97", "comment": "Malware payload", "value": "a6c641f216dfe97a2803069cf62399aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872612, "uuid": "4847b625-491c-4d01-8a59-4c29f95cb0b2", "comment": "Malware payload", "value": "733c4637376df81a88f79443ed7f62c35b1b14879e06a05287f753245b1a228a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872612, "uuid": "9c801f9e-7ad0-4f16-a516-e7e72efb602f", "comment": "Malware payload", "value": "b5ac41283e6218e3c31bc1a0a17d720b927b63f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872612, "uuid": "66b4d5a8-244e-48d1-b23f-01349e13e905", "comment": "Malware payload", "value": "4ff97bf491e1e66d7091856e25f9593eadd23af48bf6d8ca40046b55b428b682b7713d1b1c1d5d2613ca90b80d0ae663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872612, "uuid": "97aff3a2-63c6-4ce6-9970-3a9c9a66b79a", "value": "T14C7633F9FECC8875C502103396F45ED0DABCFA689928525717DC0EBADA36452CA46BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872612, "uuid": "5e9b9c62-2bef-448c-9cad-20f81af07745", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872612, "uuid": "0e886d63-084d-4019-93aa-532b38648357", "value": "196608:91O4g3uGPtRz3gUucaoJBCUzUmk3FXf/vEC1isk:3OJnPvXucaoGUz4FXf/cEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674872612, "uuid": "91af0a27-c233-482a-8283-4b9589bb152f", "value": 7641259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674872612, "uuid": "53907d32-32ba-4aa2-95db-f499ed146bcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872612, "uuid": "5a40af0f-1629-4999-b8f9-c8e0c8375ef8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e025a4-9f04-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674907829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674907829, "uuid": "992a53b1-e9d9-41f7-a106-dffe0a2343df", "comment": "Malware payload (njrat)", "value": "c0aba984ae0f8c4385d8434702315472", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674907829, "uuid": "b298d645-3fd3-4ea1-932f-26e63877103e", "comment": "Malware payload (njrat)", "value": "73a1623fdb5de72f14d6114eb877f0c85905aa4e448208531a465789f5ded305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674907829, "uuid": "992b4490-9bc4-4a7e-9d5a-1a1152747ecc", "comment": "Malware payload (njrat)", "value": "102a5bda7dd62d7d8b164c1cb65e43411c6b4b72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674907829, "uuid": "365a1458-09af-43ae-befb-a41419742334", "comment": "Malware payload (njrat)", "value": "8330278987d40b9e314c311fcaa4d8e3134b3c56c5dd2325ec9b551c4ffd9c1ab463f3a69079ffb67629b24d8c0b2e7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674907829, "uuid": "d45e57d5-3723-4477-a562-f036f4cf3669", "value": "T1EC034B4D7BE18568C5FD157B05B2D42207BAE04F2E23D90E8EF5649A37636C08B54EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674907829, "uuid": "d6029555-ad7f-4fe0-9f84-f08c94fa3c94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674907829, "uuid": "9dffa24f-38c5-4832-b786-5b11dfd658dc", "value": "384:gLu9MiLdBndznNCyMGmpcaPxzcG2DrsrAF+rMRTyN/0L+EcoinblneHQM3epzXkX:JjRNRMGmp9J123srM+rMRa8NuKtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674907829, "uuid": "e26d5a80-4f4b-4b98-a214-00db76c6f8a5", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674907829, "uuid": "62fa6616-c336-4ec5-9a1a-850a5dedf51a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674907829, "uuid": "cd39fd7e-4c48-4bdb-add1-b05650c0dcdc", "value": "c0aba984ae0f8c4385d8434702315472.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd43602-9f06-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674908786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908786, "uuid": "10f2c304-12ec-4fc1-a312-7508b7980793", "comment": "Malware payload", "value": "9f9229ce0b0211eec77c99048b50d18b", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-goldsoftware", "colour": "#875946", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908786, "uuid": "7066606e-b66a-4e6d-ac4e-19f7f2f879a3", "comment": "Malware payload", "value": "73fbd228f3048ca821448df4ae4a33343295749e67f3a847669099283e79fd00", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-goldsoftware", "colour": "#875946", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908786, "uuid": "5f1cad62-8603-4903-9b69-00a5961e6518", "comment": "Malware payload", "value": "50e4928658d231639698c2b0405b00d492f5eca6", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-goldsoftware", "colour": "#875946", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908786, "uuid": "d6ea1488-af0e-4334-8256-e595a9bf41e7", "comment": "Malware payload", "value": "e54bab2afbc10159422ba4c2b0cb65a329e6865dca6a4d8af5263ed06f64c99715ea224a8bc8cb43a68e6a2482e37626", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-goldsoftware", "colour": "#875946", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908786, "uuid": "bfa95ed3-c215-43a0-bf06-80847905ce4f", "value": "T10FD533D03A6E7302A862DC2769A6CB1E07CF7CECB45AF3D795717989A5304DC2358282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908786, "uuid": "0526ff16-29b6-4e82-8b19-3f4d1d35611d", "value": "49152:yv4vY08wptkjP7rwS81VjW7LQCyizSto6N3wUgaYKbf7tfovLGiwjx:Fg08wMbmPW7Ize6t/ga1bzqvLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674908786, "uuid": "f7b1eb9a-b436-486b-b317-07d17bf36002", "value": 2971791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674908786, "uuid": "141f93f4-6acf-4cd6-8ae9-0035bf033cb8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908786, "uuid": "b4613f81-2832-40ff-861c-c849008b94d3", "value": "FileProgramSetup_v13.8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6571cbf7-9ed7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Blackmoon)", "timestamp": 1674888347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674888347, "uuid": "51f09748-267d-4dfc-a66b-083f93b600c0", "comment": "Malware payload (Blackmoon)", "value": "b80f468dfd41d1934e3781477c4bdfcf", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674888347, "uuid": "6b49c5f1-1256-44ff-b777-4797b82a6ae9", "comment": "Malware payload (Blackmoon)", "value": "7417670ca8549824d2276e1e34aecdc05f4a3e14bbc29bfe2d9b5d4f24e74896", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674888347, "uuid": "a28f1fe4-6592-4ed1-ab06-37da1e89f24a", "comment": "Malware payload (Blackmoon)", "value": "f9f6d678e2ccbeadbe99a1e162d88ed9a287ec18", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674888347, "uuid": "a81d0b59-6943-4831-92bd-e55fcb8ee8fd", "comment": "Malware payload (Blackmoon)", "value": "5e92f7a0914b564db54d1bb2b3f93f904f3d68813dcc84697fb9634e95d589dfbfc592f5dce371b4b8b09b5058369726", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674888347, "uuid": "98ce8ffd-c34f-4739-84c0-13392df85300", "value": "T168D423D0255015EAE8C053B9B877811F62ADBE198EFC8D07EBDB0A687FF3564706A44C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674888347, "uuid": "86e2d430-0506-4935-8ec5-fc3ec6476b77", "value": "8f5481075faf292a45dceeeb1650fd1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674888347, "uuid": "d9c9a481-2df0-4adc-bab9-b1da94302460", "value": "12288:Rcrhez9dvAwhWijQXMjCXCjzrgfj/Oo6hFA:FzrqiQXAVXgfj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674888347, "uuid": "e2188f1f-22d6-4255-ab89-072e6e3f8137", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674888347, "uuid": "f585bfa7-9834-41af-9f6b-8ee5442104ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674888347, "uuid": "74e59e4d-b614-4641-80fb-e634f2dd6b93", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7535\u8111\u7b80\u4f53\u4e2d\u6587\u7ffb\u8bd1\u8bed\u8a00\u5305 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e420ce-9ecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674883971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674883971, "uuid": "9f352ddd-44d0-4070-b5ea-33c062a15f4c", "comment": "Malware payload (RedLineStealer)", "value": "117abd1969ffd8f5dc1740e68582e783", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674883971, "uuid": "04af1298-7e72-42cf-aed4-63e8030326b3", "comment": "Malware payload (RedLineStealer)", "value": "78c6dde90bca0055b77cf3b95c3a7bf7f9a75bcbd4ea60cefae362993bb5cd59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674883971, "uuid": "f9712c34-7bf4-42b1-95a4-a44b9aedb0d3", "comment": "Malware payload (RedLineStealer)", "value": "28a49cb466c1f24779829bf537d03a2a8520e5b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674883971, "uuid": "58df30a4-f5c5-4c10-aeb1-2782475007b0", "comment": "Malware payload (RedLineStealer)", "value": "21404f5c537e0d45b9733346c0a94c76e81914d722a25a9d42ab65455511de7b22fdbfc359b60c93cf17093b2006696c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674883971, "uuid": "104adb76-43ca-4f57-996d-0192a1fa6642", "value": "T17B84D00376E57C48E967E6338E1EFBE8B11EFA91DE5463DA2308AA0F1DB05A1C153311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674883971, "uuid": "e25c2584-2d5b-4ea0-9d66-b10565376637", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674883971, "uuid": "85c26207-6192-40b7-9270-e7b473a36b66", "value": "6144:8LbSFCZclbbwNo/agwOPQk/BXck8x9CEbnVngX8dV:8XS4ciNoigQk/mFLCWlXdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674883971, "uuid": "57da90bf-c1cb-429f-9717-1d1fb894240d", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674883971, "uuid": "fe64f0f3-d9e9-48e1-8890-d81b49e2253d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674883971, "uuid": "d09d02e3-36a6-42ba-a719-81eb65c3b208", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da128a38-9ef6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674901857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901857, "uuid": "0e1882f6-43c3-4049-aa69-2832f1246377", "comment": "Malware payload (RedLineStealer)", "value": "e31fa27b869a342a5decfa7b28ac86de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901857, "uuid": "f5f5b93c-b6ee-462b-b8bb-11bc017ebbb4", "comment": "Malware payload (RedLineStealer)", "value": "78d9b9eaf94fe911ac5425413a42c2d7d9e4a238bfa00c44543e83f37cf462aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901857, "uuid": "acd42fa0-81d0-45a5-b806-bf693ac8ed28", "comment": "Malware payload (RedLineStealer)", "value": "4f2373d97c6f8a8e0f22763d60865e69be38dbd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901857, "uuid": "52ba42d9-bd84-4a0d-a53d-c65b7ca8702c", "comment": "Malware payload (RedLineStealer)", "value": "13b0d02d5704ae358df5d2c84ecb0f6310fd050e5352129958006683db4ca68dc1d891191276ae031a48943fbe336ca2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901857, "uuid": "89439e4d-644c-432e-958f-74526a8ca4b2", "value": "T11384CF0163E27C61D9A5CA769E2BA6F4731FF4508E15372D2A049B3F34F11B3D5AA20E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901857, "uuid": "89b6e5a7-5b4c-435b-b36e-f2d75358d4db", "value": "02e2a6cbf522a2149390d29c2ff67ff0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901857, "uuid": "95a48c77-ff45-484f-ae3f-010790e22fec", "value": "12288:kGQYlKhyaKOH7p8t+m8mVCFUM6syqSAeMG:k8lKhydOHOYjUM6syqSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674901857, "uuid": "34a14208-c30f-4e9b-a440-694bf230d503", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674901857, "uuid": "c1c48655-f0dc-48d4-9c21-8cc0746b27bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901857, "uuid": "00f43f14-236e-437e-8228-a36129f9371a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c56a55-9f35-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1674928697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674928697, "uuid": "f2b15e0b-1671-4d4a-8ff4-b1b1f418cb86", "comment": "Malware payload (QuasarRAT)", "value": "9d6bb03b177aba8b924d845fb31f0e33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674928697, "uuid": "8eb95b7c-cd14-493b-9eb3-73ba1182023f", "comment": "Malware payload (QuasarRAT)", "value": "78dba4330a89c61f3d91ed3601818ec3f4f2830b4a608526bf746103f0f1dcb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674928697, "uuid": "7fe9a9bc-3474-489b-b1c6-6ddff366f361", "comment": "Malware payload (QuasarRAT)", "value": "d4155e8901742b509828bac96b8126365e3a9b97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674928697, "uuid": "82090501-8adc-46a4-9b7e-4979828733ca", "comment": "Malware payload (QuasarRAT)", "value": "834945ab317e732eb44018c55d6e22a826e5e5a9a76ff4701c4a8a168461840b50e4c2bb35c81b2ca7cf8a9559da1395", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674928697, "uuid": "0342bf99-ad9c-41ba-a4eb-bebdd5ce3d84", "value": "T16D1512A9725472CEC897D077C9A45CA4EB50347B931B9203B02B11BEAE4EA97CF501F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674928697, "uuid": "5ef84679-2463-4fc3-939c-c925f61f644d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674928697, "uuid": "9dd796f6-9120-49e6-8e53-6bd622521c48", "value": "24576:AUgU8lWld2ZgcAw8K4gCFeecdvnl7m/MyxY0PugAQv:AUgU8g72ZZsVzoecdvnlwvugD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674928697, "uuid": "d3bd6082-84b5-448d-a10d-8f79bf45c487", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674928697, "uuid": "70d7c367-2f15-44cf-b084-3407b1a1a98b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674928697, "uuid": "9e90eb8e-0771-4505-b607-636dcd57276b", "value": "9d6bb03b177aba8b924d845fb31f0e33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986aab24-9f32-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674927517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927517, "uuid": "9029763c-3368-49d6-9376-07ea513e33f7", "comment": "Malware payload", "value": "70b8dfc0b08787043bbf97f5fe9cb2be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927517, "uuid": "44663fe0-26a3-4b3d-aa05-0c262c9be9a6", "comment": "Malware payload", "value": "791294d15240f8c2fd514577d6b9d0a86ac93f42c313e45be5fca2faa24b28d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927517, "uuid": "150fc3f1-b7d9-47d6-93d8-e621f2b52a77", "comment": "Malware payload", "value": "bf6ad956f72b6e2ffbccdba5c97b883dfc6f8fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927517, "uuid": "ff5cbe12-5b06-49de-b582-c09605703a00", "comment": "Malware payload", "value": "2718743f8e7c5e64b324d29651f5d46032de532b95f5ac8a072ad2335febd9b415b2059863c1bd0abf7d210973d6665d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927517, "uuid": "df2dee9a-2bf1-49e1-8b94-3bcee93d1d40", "value": "T15474CF0266E4BC85D977E733BD1EF7E8B51EB9C1EF1463DA1208AA0F18705A1CE62311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927517, "uuid": "afe77ba2-85db-43c9-a409-e4cd0470a520", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927517, "uuid": "db27b76c-b48f-4545-a67a-08426bc6f011", "value": "6144:rLf6yTsmq6flLggdTbjjNB8ezonSt1Cx9CEbnVngmn98dV:rz6KWKggdTzNB8w3CLCWl5+dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927517, "uuid": "7cf4d846-5a93-42d4-9c97-42231cc423ea", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927517, "uuid": "1b551720-fab2-4f97-bf9a-cacdaa83b291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927517, "uuid": "1941c36a-cb17-4e15-8943-cfbdb39d5185", "value": "70b8dfc0b08787043bbf97f5fe9cb2be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ea95f6-9f56-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674943104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943104, "uuid": "c77f8867-a45a-4c12-9e84-06da8aea4571", "comment": "Malware payload (Mirai)", "value": "65bcf8898c0def2899472fd0426a295e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943104, "uuid": "ba5b8d72-d748-410d-81fd-d4ca09307054", "comment": "Malware payload (Mirai)", "value": "792d392e3dd256f1cd904a58984d389483410f6b2171dfb5bbd0503d379ea170", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943104, "uuid": "137cdc3d-5421-4ba1-8919-49d83a113d19", "comment": "Malware payload (Mirai)", "value": "4af061ed02caacba74992920326b2f6266a2e183", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943104, "uuid": "c02c8c55-bb12-4fe8-8b28-1fff8ace5f16", "comment": "Malware payload (Mirai)", "value": "6c82a974d6a8308aac38b18fb799b6ff6baa52f9380f08123cfab07ee1a11539c235605fe9610c394088843ac66b47f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943104, "uuid": "8a01fdfb-27e5-469f-ba32-fb9cf18e18c0", "value": "T1DDB32B5AFB808F03C4D52775BADF421533239B54A3EB23065928AFB43F867AE4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943104, "uuid": "af67e09b-0195-4720-8604-0201bc3d1d41", "value": "1536:RmnPEcCl0bZaN7tfsjs5pdckptFll7AidrdaUZoGHwirhnGzw/9FpMN8h3jw:rcr8xtfsjs5pdckFPrdPeGHlrAM/9bTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674943104, "uuid": "d165ca69-b0e8-4992-be1b-1319cfcd04a8", "value": 109018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674943104, "uuid": "7f95c9be-826d-4530-9e82-246e05319fff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943104, "uuid": "326df046-5fb9-43c6-a268-da673781577e", "value": "65bcf8898c0def2899472fd0426a295e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e861c4-9ea9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674868613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674868613, "uuid": "9460ca91-922a-4f81-a80e-615d4f00504b", "comment": "Malware payload (GCleaner)", "value": "82b222ae5c0638080d55d9890bbefbe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674868613, "uuid": "d4172c96-3dc1-4d85-9b12-cdb3ee050134", "comment": "Malware payload (GCleaner)", "value": "79d574cd60efa731cf7e9e7e42a084ac45acc57d2bda959094f74b0b353e7863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674868613, "uuid": "62d40bd1-4a63-4e1c-a81e-a30b98790c80", "comment": "Malware payload (GCleaner)", "value": "5d94f6a704aaacdce382a8ce42ae290df5843d2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674868613, "uuid": "1b84438b-1849-44a3-b95c-dad6ba3d9bcf", "comment": "Malware payload (GCleaner)", "value": "f5496c6a53255e6232567ffad17e96228a972214ab29aaa79c62f1f956f50a9a96bad9cddaf1520875fa4cbf68e79a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674868613, "uuid": "d9568cf1-6d25-4707-8505-4660e6f96ec8", "value": "T1A795334DA4D2C3FCC5518BB626340198AB73AEBE743D11E13296A3CE3F56B30159739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674868613, "uuid": "e83106d7-6cef-47ba-bdea-aca3993453b2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674868613, "uuid": "d31fad0a-7881-4c01-82cd-b0d07b4e28cb", "value": "49152:okug+zHfgzYUccpdiuGq684S4djaur8bLCgv2MR:hug+zoMUccpeAduqv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674868613, "uuid": "915c4ece-588d-4568-8a0d-bb5fa395b182", "value": 1994054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674868613, "uuid": "44d5a8fd-dd6c-4c79-97e7-112034296cf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674868613, "uuid": "06f26d9b-a656-481f-b124-63d5d1accdc8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8956b6c3-9f32-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674927491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927491, "uuid": "a9f2ee5c-ddf4-4102-8a8c-fd7953b30f03", "comment": "Malware payload (RedLineStealer)", "value": "11511ba5fd4de1fc5051d0bcefb388ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927491, "uuid": "6f0869c1-7fa1-4f79-ad19-632eedea8d10", "comment": "Malware payload (RedLineStealer)", "value": "79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927491, "uuid": "6cd37cb4-5052-41dc-accd-1e5bc42dc8bf", "comment": "Malware payload (RedLineStealer)", "value": "5e9476f39df92e01d0952e703869e71f85d470cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927491, "uuid": "7f42f041-7296-4b4d-8bef-1b83ad591ce3", "comment": "Malware payload (RedLineStealer)", "value": "2bd02fbe59a3165594cf6ba19dbe63ce65bfe57bc7ba70b7eb845d179ec17d6714df6746ea28a8191cab3e98953559d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927491, "uuid": "26456725-c4c5-48e3-84dd-1301b80fc43d", "value": "T107548E22A7E2BC61D925CE728E2EE6F4671EF8508D14776D1A14AF3F18F1173C5A221C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927491, "uuid": "ac71fae4-75b8-4189-aa10-a77ee8a3ae9f", "value": "a5cda000ff4d200b1a7c245df76a958a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927491, "uuid": "a06f95cb-b203-41b9-a576-62656fb9d2fb", "value": "3072:0pb2LIT54Ga9Qzgp4gaCJrSjgBoMZmYKxQCBnIyCSyxzID1C7hZW0KIsiuNZ:xLIKGa96dfkBoMsDlqSwzIDM/KPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927491, "uuid": "c334e8d1-ae4e-4ec0-a1a9-21d32801353c", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927491, "uuid": "62a46b58-23f1-4d69-970a-1669eb5a1025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927491, "uuid": "9f642038-9b65-4318-8b2a-d8b1d383a06d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aad888e-9f5c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674945318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674945318, "uuid": "7970f9f7-6c26-4687-a12e-2d225622f734", "comment": "Malware payload", "value": "d3a05c0ff423927ebebefed3504d550b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674945318, "uuid": "f1ca6779-9642-4df0-bcc9-ef7e37199fd5", "comment": "Malware payload", "value": "7affc76a4157933fcc362420264c17d8e97ec24efac74f58265b66f9554ac051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674945318, "uuid": "5053fc17-e9ac-476b-9f42-b1a53ab1acc5", "comment": "Malware payload", "value": "bd61410abf38958e78b7cdfd0ba89b1f50ebc55c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674945318, "uuid": "758ae694-5a4b-41d9-8f65-9cc29c58568c", "comment": "Malware payload", "value": "310781cc8aedd717bb5415c9a7392f8dd6b6f06137057f89c4af8a083a0913aa4d5c17b6ea9cbb4b3eafa64107eb740b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674945318, "uuid": "70e72c73-e2b9-4f06-8a1c-4bf461c719bb", "value": "T1C184BFC1E6A17C75E6374B3A8E1EDAE8751EB452CE54E71E3238AA3F18B0361C563314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674945318, "uuid": "2b4711a7-8f99-42c3-a803-72b9f1301070", "value": "dc3a0c75117ce1f8b0d73167dcb17e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674945318, "uuid": "61d5e7ce-06ca-4238-b287-b751d290a314", "value": "6144:bWLq2WMjtlaFUfgJXi0HXlzruohy6MWm0E954QxaJFZ:6Wd6t8zJXi0HX1uoE6MWmRz4QxIFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674945318, "uuid": "7b919cc3-287c-433a-8455-9ec11aa9fedd", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674945318, "uuid": "426e0e8b-eb7a-4570-aa4a-bc17b31aa263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674945318, "uuid": "76e6894d-8558-41b1-9575-b0968abc70c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb35f19-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1674894881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894881, "uuid": "67dc7283-fee6-4b9e-b66b-a16cdd275820", "comment": "Malware payload (Amadey)", "value": "6e88af8e504dc7980e29d93eecbfd624", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894881, "uuid": "f167dfd4-ad2e-443a-a6fc-5d2fd4d13ad7", "comment": "Malware payload (Amadey)", "value": "7b5ca8bdb682f55e5004d959e989a9fbb02f263a19ec6af7e50b0f4c7ccaacf8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894881, "uuid": "76cc88ba-afd2-4ad4-9363-1b0be723cf15", "comment": "Malware payload (Amadey)", "value": "28a3928ffcc2c034dbc85c7e950fce4232cc4503", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894881, "uuid": "35dca6ef-22d0-420f-b95b-1e5222677984", "comment": "Malware payload (Amadey)", "value": "45eac4efe6345739c96848b7d706a521c92b9254858a4d72e19cd1b965a9d7cb8ffc29f7a0c5e96c7bd8615a44922ab8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894881, "uuid": "c4e5854f-a37c-4582-89eb-b8318c001d26", "value": "T1F2357D1BA26601BCD4BBD1788A235A47E775740603709BEB17D05AAA3F13FE16E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894881, "uuid": "a15883b5-ba39-4e84-bdcd-37dab3783ce4", "value": "7440c982ea49d693b3f3d5cb31294fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894881, "uuid": "1963a189-7fb9-46ec-bffc-bbc674544663", "value": "24576:eVaH8jJPWhQnZzrZ+7xr1rZfVlTxd43vSH5m:0AhQnZzrZSxxZfVlU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894881, "uuid": "e9d9d42d-4911-4887-b884-a622b887bb64", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894881, "uuid": "cb804718-6c23-489f-8f80-b88ad9c9ce87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894881, "uuid": "c1f82a64-d2fe-4881-b2aa-a089e015b0f6", "value": "6e88af8e504dc7980e29d93eecbfd624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39f24e3-9f42-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674934461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934461, "uuid": "7adf2676-8469-4080-8a01-5e74d301ff22", "comment": "Malware payload", "value": "c02122523a18f1ac5908a59aaf14615f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934461, "uuid": "868a8168-c90f-459b-a3e4-e8cf5944bbdb", "comment": "Malware payload", "value": "7c03beb8e0a0f4ddf2ecf1ffb81304e63524ab9a7c028ab0b3412a37fce908f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934461, "uuid": "9c74206e-6dbe-408c-b1e9-522fd052f272", "comment": "Malware payload", "value": "17776f23a47539a1b65a511c1bf0ed39282370b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934461, "uuid": "b7dfd937-a2fb-4e0e-898e-cce8d5886878", "comment": "Malware payload", "value": "484052d4930e650e69304f35f675c583fb417304a279776bdbcc1d4cfd06fcb1a2f2b266260f187c6929ebb5e5bbe9f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934461, "uuid": "710977a2-6a96-4acf-add3-3261d641770c", "value": "T1C3A35C227FE04076E2F30A315AB167A6A3BBBE715531C50B6714394E6E31E85EE39313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934461, "uuid": "ca7a56a5-43f6-4b6c-9efb-c861e9096324", "value": "6df6e99bae10817058127898c796b82d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934461, "uuid": "eff11266-c8a6-4c12-846b-dbe97f0494e8", "value": "1536:NqPjvlpp/06w6Px9+3cu9V+gKk3GCq2iW7z:NqPL1/7w6ZAs+VBKmGCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674934461, "uuid": "92c6f5e5-d811-47f3-82a2-2b21387b586a", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674934461, "uuid": "5063b552-6248-4c3d-864a-a0ece4cfc52a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934461, "uuid": "6a268fa1-0b27-45c5-a2bf-ca3f83cac3bd", "value": "copymar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a509b5-9f5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674946791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946791, "uuid": "9ca7b2b4-239b-40ac-ae73-804f587fa7f5", "comment": "Malware payload (Mirai)", "value": "d9c99955919315810fbe6a1f0af25132", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946791, "uuid": "8ff7bdf2-ce96-46be-9462-f20e4628cea4", "comment": "Malware payload (Mirai)", "value": "7c5f96a06506f624d25983f46bec82c3bdb2e34f5f86796747664febb9609f77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946791, "uuid": "77a148f1-81d6-4254-a677-5c823b802eea", "comment": "Malware payload (Mirai)", "value": "88214782468f6082edc8d12911d2408c0c837ce2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946791, "uuid": "8ea623af-bbe5-42ab-a34b-1919bf78c1d5", "comment": "Malware payload (Mirai)", "value": "54c3b9b6ef1e687bad7b1c533e9df73053034954a6cbf72348181f2e8a3c54d60bf997891ac07fcd59fc6bd7f24bf648", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946791, "uuid": "a5d487b8-cc2e-47fc-8eeb-134479967c26", "value": "T19C134A31EE661E27C1D465BB51F74326B5F5434E20B4872E7D720F8CBB90A8422A36F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946791, "uuid": "31d35ead-c832-4d91-83a1-1fee3f485455", "value": "384:okoIks5wBDVQ09um6dydRnL9xlYAqVKWXDEpw3ZOuKgFU+prqdyW3lWnGiQTBwS+:okoGcDJ9ZRDqgWXDEKnO+WuXQTBwSGou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674946791, "uuid": "5e4e5f49-3af0-4b45-9fa3-f1b5d11bc5bb", "value": 41992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674946791, "uuid": "9d3782f8-5f85-4a7b-b614-e99648dbea24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946791, "uuid": "467d7785-1359-40ad-b5ab-f12118f96729", "value": "d9c99955919315810fbe6a1f0af25132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b7f130-9efc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674904230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674904230, "uuid": "2496603e-74b0-4ffe-ac11-23dab588af35", "comment": "Malware payload (RedLineStealer)", "value": "eafc5e2b7b17a7251f855b9800710d24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674904230, "uuid": "d8973eba-68eb-4674-b0a0-86bde5dbd920", "comment": "Malware payload (RedLineStealer)", "value": "7d765084ded9de78c8f04cf508b69b0938415d4850fdce8959b4f6cec194fa5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674904230, "uuid": "1991847f-764b-4ee9-8ce6-dd4d186bade0", "comment": "Malware payload (RedLineStealer)", "value": "2c7040e5ea9ec81e3bd031372d4cb97029b77225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674904230, "uuid": "5dd35a06-881a-4672-b3b5-225e8e6cbf84", "comment": "Malware payload (RedLineStealer)", "value": "65efa19b76d540223a8c7b326b605bd17899f53521497aef4b20f659b2cd56a475b13ff2c2c606776dc9c868c9178a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674904230, "uuid": "ee73ba53-2d0c-4aec-a5f9-aeda0218b9a9", "value": "T18415FB08EA56AB92EE589F35C1E8CCD04760FE10564DEF2F6AD01EE2E4433E6DD2145B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674904230, "uuid": "65bf3a23-dae0-4d67-adc0-bbd48db97501", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674904230, "uuid": "c288be38-1a66-40fc-8eee-d4d58ba969ff", "value": "12288:xOSY00p9h1ZNxFpdBAyJDoZpGeZcrvi6hvysQA0EuRYDKgOFl6wTg7zDgcDj2LMS:xOYyJDoZpGeZcrvi6hvyso9UFaq2TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674904230, "uuid": "e8fa1d8e-792d-4d77-9b6e-499a1fc9dbc1", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674904230, "uuid": "668b971b-7789-4641-bee1-85b667166047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674904230, "uuid": "4d82be79-d91c-463a-89f2-6f275212653d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7af45b7-9eb2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674872594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872594, "uuid": "dd70e9cc-e603-4eb9-a3bb-17dfa07722fd", "comment": "Malware payload", "value": "0aa544b387a4efb0040ee6d887420e5c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872594, "uuid": "54a1e2ba-b592-461d-9297-a327c6e07ffd", "comment": "Malware payload", "value": "8299be1655630f1cdaca064e77e8c8d390e1fc6ea3cd749ce9eae6df2aa8befa", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872594, "uuid": "a8183579-58ed-4fc6-9845-8e4d04649747", "comment": "Malware payload", "value": "57abe05a78db63418772a5d2e9f4888ae268b7f8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872594, "uuid": "0bf76c0b-a58c-4878-9f2c-d58fcd4f8b8c", "comment": "Malware payload", "value": "6eb8050ca851c9bd214752c45ac77edc19eafa703f4e1f7cc25ee24f4f2c94de9eb4b5cdf41253fc70c0af3901b8ac03", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872594, "uuid": "3cbadfce-054a-4f46-9795-0f95d14641ea", "value": "T1782733631C159CDAD032A035597F2385A875CA6A3EF2B7222444DFB7D5F34A48EC9EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872594, "uuid": "ead624d4-d608-4639-b658-305f4876fe20", "value": "393216:S6ELBsJA35z7A79L+d+51mbgafiubcsZ3bVT9i/zVN2I+TXdl8KpPbNiRSKcsfJX:OLaJA35z7c5FvmbBffcu3Xi/zVN2IkNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674872594, "uuid": "490b5d15-6abb-4943-868e-22c2abf525c0", "value": 21503235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674872594, "uuid": "7664770c-f6c5-463d-b4e6-d2d8092f0f48", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872594, "uuid": "33153538-e6cf-4269-8de8-667ff8e900f8", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49d135d-9ee1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674892855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892855, "uuid": "0a239081-19f4-494e-9b5c-313150dc1044", "comment": "Malware payload (GCleaner)", "value": "463b15f22369218cf7cf763838c53512", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892855, "uuid": "a0ac1d32-8b19-4ec2-9a7a-0193b028080c", "comment": "Malware payload (GCleaner)", "value": "82d67c2b07ff3b2b24242f276bd1659a347dc15e2e48bb21c63456b6743ba43d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892855, "uuid": "23daf695-9d3d-444e-ac3f-bed2709e285e", "comment": "Malware payload (GCleaner)", "value": "02d06acce5078db6e2ee9280fa0240a56f24af4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892855, "uuid": "2b8400f0-8cf1-437e-ad9f-9e1a10178435", "comment": "Malware payload (GCleaner)", "value": "cb918d0dbe87d1889aba9c3e2190b96bf4586a5180c8841bbfb0853b02bc58d7f74b23b319d577a236536943f12eb1f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892855, "uuid": "edb6ef2f-3b70-47fc-8227-dc364945f6d3", "value": "T114B53327D490C2BCC3438BB87679D240DF73ED8774BD3102B2992ADC1DA27E06975699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892855, "uuid": "8a42b1e3-47bb-4051-bfb6-5de42efc7da7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892855, "uuid": "7a800e20-c91b-4be4-8e51-d19be3f3dca4", "value": "49152:okug+Or+fA4a7XCpl7P5jYjpYrgBMszLwV8fHCCZWPjUnkkLCgv2MR:hug+374XCeV4grAefj1Vv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674892855, "uuid": "4087af67-8c34-4296-a1d1-463f80fd9105", "value": 2350438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674892855, "uuid": "bbaf2991-296f-4446-8fb1-2385e3a4460c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892855, "uuid": "ba5f35b4-0018-4821-b32b-79e7fe1dd428", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033a4e7b-9f0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1674910087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674910087, "uuid": "bd587ce8-a418-489b-a8f7-f58b1bd7662f", "comment": "Malware payload (TeamBot)", "value": "904414d23fbd09bc9d3cf706cb473c18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674910087, "uuid": "9900f1b6-9739-4eef-96bc-86cbb1858d06", "comment": "Malware payload (TeamBot)", "value": "82ec7de1d60c838a6f0edb5effc8d1fef0d63cade11b2ee7538ef447275c0d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674910087, "uuid": "2b960d35-902a-4d47-8bbc-e970b26857d3", "comment": "Malware payload (TeamBot)", "value": "4d42b5d184f2b76664903aec3c36c29a561dd42b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674910087, "uuid": "319a1093-7ca2-4abd-af4f-464e31a686c7", "comment": "Malware payload (TeamBot)", "value": "f056eee87282e57743ed7b9d229d3960a6e07c491cb36c010270a460515162cd5b6e6870d3259530622f945e1067b14d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674910087, "uuid": "6cf4eda1-cdc2-41cf-8cbf-5ccda0851e4c", "value": "T116548D8157E2BC60D925CE729E2AE6F4671EFC508D14736D2A18BB3F18F11B7C5A3218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674910087, "uuid": "e15139e8-8665-4416-9132-048e8ac9e2d2", "value": "d191080c270d3118935d8b6a682d2ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674910087, "uuid": "fc3df439-ae7a-4b08-b304-c445807c5c23", "value": "6144:XELFwAre0JypfVNMVc8/qSwzIDMc9OWzP:0x/rzJ88/qSAeMgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674910087, "uuid": "5a4e212a-ae35-419e-898d-20b1e0c07ede", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674910087, "uuid": "3d53188d-6617-4c59-a1ff-0807bc37b725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674910087, "uuid": "d200c133-5a39-4119-be0f-a51c1a495e9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd48a0b6-9ec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674878670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674878670, "uuid": "397a1f90-0fb9-4cda-b013-238e005d25d1", "comment": "Malware payload (Smoke Loader)", "value": "f1919afe5a8c6e8c1ba3608a1cf743ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674878670, "uuid": "2fa07c7a-f713-405e-a079-a7cf761e048d", "comment": "Malware payload (Smoke Loader)", "value": "82f213bcafb40bb12d79967ca7b7e4ca3acdb8664fc516e802ed32193a13ac10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674878670, "uuid": "bfe65b82-e7ef-4b1b-add8-302802d8d1a6", "comment": "Malware payload (Smoke Loader)", "value": "a06fda942b66a9d649735bad9def7d7809e0ff4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674878670, "uuid": "0625c802-9ccc-4bb6-9297-31c86cd762b9", "comment": "Malware payload (Smoke Loader)", "value": "45d508282787ecbf1a18c01ae2ee5ab07442a6bb9373f36f63f55a5b9026865d444c886c97eaccb4ec03e29a849169ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674878670, "uuid": "f1af149b-bef3-4095-bf33-6f19ebbef0bc", "value": "T10554AD0266E1BC84E967E6338E1AF7E8B51EFDD1AF5563D91208BACF1DB15A1C163300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674878670, "uuid": "bebdc00a-fde1-43c3-9286-ff017ec84782", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674878670, "uuid": "5c0590bd-bc86-45fd-bf7e-a89af4bfb8a7", "value": "6144:oLzjPnfCKgRIooY65WtuQZUDsIJx9CEbnVnB68dV:ovj3CnoMtuxDsIJLCWlxdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674878670, "uuid": "4c47590a-0446-4cbe-b5aa-43d4a89d2131", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674878670, "uuid": "85d4bc7e-8639-42d2-8cbb-2ffb567b1bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674878670, "uuid": "638de617-5a84-4869-9120-b62d06de5d03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49e96e4-9f48-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1674937067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937067, "uuid": "496eb157-9cd4-47ae-948f-8d21128dac34", "comment": "Malware payload (NetWire)", "value": "30de906d4955a6863bc9b45602a5ed3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937067, "uuid": "91bcc715-1038-4b71-af62-a162307c0460", "comment": "Malware payload (NetWire)", "value": "868ec037a1d8de69e0b32853f957d2b9329877fa0b1d99c0fdb07952c61fd6c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937067, "uuid": "4a421241-20eb-44c7-8f88-72fd5e5e4abd", "comment": "Malware payload (NetWire)", "value": "74659c613ad6dde0cdb47ea69bc737c48e443bea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674937067, "uuid": "1074b2f1-d314-4fa4-970a-ccf63fe962e8", "comment": "Malware payload (NetWire)", "value": "4df9690f65b74f085d3559cfd919476769e8dbc4d4274c40c3531f98f3a9fbd6b559161677c270432d12a3d172ce852c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937067, "uuid": "7c9d17a3-906a-41e5-bd69-e95b5c08c2c1", "value": "T174157B516191C2C5ECF64E780778F92467859E5BA32D41AE7EC7343A88F378B84783A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937067, "uuid": "7462b213-cd30-486f-ba3c-8fc324d976ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937067, "uuid": "07a3961c-bb2a-4623-8e9b-7cec9058662c", "value": "12288:BErIIoMZAYCu9gpDLoQV7EvknemE0IvyNnJV4ilzP3X:WVOKSpD59Es7bIaNz4OP3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674937067, "uuid": "1244d420-43b5-4723-b720-cb2f040a554f", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674937067, "uuid": "dcb3b950-631b-4627-bedb-1e06a5c877fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674937067, "uuid": "343ca505-014f-47c3-b92b-009162dcefb0", "value": "invoice89938.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1b1b85-9eee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674898483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674898483, "uuid": "161a39f7-8b05-4160-ad58-eab254f6190b", "comment": "Malware payload", "value": "24034f9c0193f69a37fb6047611e28ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674898483, "uuid": "7447587f-3ea5-47b5-a731-ab537879e153", "comment": "Malware payload", "value": "86eb5115b062fbdd135203e15095f5bf8c5df20290fc84bf43bed24615c49068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674898483, "uuid": "d500f735-2247-458f-841a-c61d69e67236", "comment": "Malware payload", "value": "533676852813475947eaab672e4c307eabfcc22e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674898483, "uuid": "37704a56-9eaa-4425-9dcb-589728eb5150", "comment": "Malware payload", "value": "c1a3d1e1402d1b3a5f381bb12e1996d560c5f4b22f200fa772254a50a04f4da655c78c211bfb0f884b53f27efcb089a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674898483, "uuid": "d45e2c45-033a-4559-83ab-2515aa83c2ea", "value": "T14D7633A23DD9D073D64B0D3208C0B77979F2D3110B1264739B5A474DFEA9AB2DB22B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674898483, "uuid": "9fe260c3-2602-4afc-9e6d-ff020919ffe3", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674898483, "uuid": "a2073545-6cb3-4932-8aed-6672855046da", "value": "196608:91O4vsCD6TAo7EDrwYWSpjKwOsUE1IlQ7xGrlFo8I5x:3O4vsCDIKkDWjKwOP/l2kJFw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674898483, "uuid": "ffb72798-edfd-4312-a547-12ce3814b3ac", "value": 7652178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674898483, "uuid": "5c638489-1cb1-46bd-8fff-f7185e4faf1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674898483, "uuid": "40ec6087-3c16-4a71-bbb2-82ebb5412e91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677dbe42-9ecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674884056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674884056, "uuid": "78315300-b1f8-46f3-864b-081a1e029c22", "comment": "Malware payload (Smoke Loader)", "value": "047bb49f0ac28120a7c78a25a3893cbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674884056, "uuid": "4e1c2e3d-8683-4009-ba36-b6f968c79c0c", "comment": "Malware payload (Smoke Loader)", "value": "871db6c4af81766fc0a26509c1cf032fb419241a31d19cf393251a8c32b8fd42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674884056, "uuid": "20be3bd1-6aa7-4ce7-99b2-dc365977b671", "comment": "Malware payload (Smoke Loader)", "value": "da137491057e90c4596cd9c7903f32d9bf30f0d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674884056, "uuid": "d472fffe-6a5c-4c04-be21-3f077f9e249d", "comment": "Malware payload (Smoke Loader)", "value": "1bbeabac884f0c5353a1ce48883132c9eb15e74e4cf7cb4166c568e206140b479fae340a5c3c502551cf846c1e099393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674884056, "uuid": "21e5762d-632e-49ac-88ac-20ddc22c966c", "value": "T1E054AE0276E4BC45D957E6738D1BFBE8B41EB990DE5423DA1208AECF19F25A1C6633C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674884056, "uuid": "b730cf8b-5811-45f2-909d-8a83993a95aa", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674884056, "uuid": "e479f718-8db1-463d-9712-8748ac016b3a", "value": "3072:nDfLOdP5Uyg/TaviiL6O+ZrxjkoF1go9ClANbFrZVngcIbyq/dVHGa:bLOdy/bMiiL6nrqUx9CEbnVney8dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674884056, "uuid": "761c789a-cf2f-4af9-ac4e-a3fd0afab320", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674884056, "uuid": "cdf47b65-9da8-4b5c-9173-4e9a27ec2241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674884056, "uuid": "e57189e5-3493-41eb-8022-0a04478d6812", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1466f9d7-9f25-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674921712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921712, "uuid": "036c462e-a946-4bf7-a06f-4cf11f37ab70", "comment": "Malware payload", "value": "fd43c204fad47ac3ca43a162bece786f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921712, "uuid": "01f9caf4-c5ea-410a-b088-449674994abb", "comment": "Malware payload", "value": "88d89a47d77799c0b844e5b7acf414dca15877f62993415b72553ba6c8cf0855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921712, "uuid": "c2c13b9e-bb89-4622-8dd3-fb7bc9304d38", "comment": "Malware payload", "value": "37f976632c43ba10fb10a64c99ea1ddfa8cac9cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921712, "uuid": "6cfea349-2dd3-4b62-8637-a2e5559b42fc", "comment": "Malware payload", "value": "6f29c96f07c13434884a71b2e4d5252754463eae86695b57010d49a8aca7b50c0a5bae1a04001d549d5713a6ba926df8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921712, "uuid": "e43ddcc8-06bd-424b-b75e-d71b51d95c5f", "value": "T1EE763355F6D3C134F1690731CD8E6F53A0F5E5AC4F621C23340A6EAE6E5C6A286272EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921712, "uuid": "b1cda821-e835-4cc8-8689-28d56efa04d2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921712, "uuid": "5e30f911-7adb-4be6-8444-b04434025a2d", "value": "98304:91OZDb3VwCrnxs82m0kxTtnAYDtc7Z5r+zs3Yw+WvHC2x8noywqFV5rbVXPMV:91OZDb3DzSkHnDy7Z5r+AYw/PqRXVfMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674921712, "uuid": "efba377e-b8a5-4031-a6f9-e10e442f6a40", "value": 7591853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674921712, "uuid": "5bd62dfc-c154-4196-ae69-f324a41444b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921712, "uuid": "174592ed-d715-4210-95fb-18335485aa97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85f6339-9f65-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674949555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674949555, "uuid": "57e4f9d6-3be0-4915-b9a3-851eecd66cd7", "comment": "Malware payload", "value": "08968a69f34594bca3df10c41e5fe518", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674949555, "uuid": "f2ca2295-a104-48ce-a722-55cf7cfb8b7b", "comment": "Malware payload", "value": "8a5310da3120be2ada751ddad023144627ed3141a8e8b5dc9b7b0e7f7f1162e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674949555, "uuid": "5e83a5d4-033c-491a-9621-d2ded7d5a818", "comment": "Malware payload", "value": "f0927dfb6dfbdae36d1816d1f37ef329f5ec116d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674949555, "uuid": "2eddf8b1-a5e3-47f1-9e4d-894637500db1", "comment": "Malware payload", "value": "998fa54decba85f301aa45c49e1f3bb64c8cc308899f11154ae5c70f7a93d001a9f564acadfb79d532cd8b0d00419457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674949555, "uuid": "fae29ab5-73ad-49a0-8e2c-3f51e86ad6f9", "value": "T1C9B53389D4F4917CD0ABC6FF7E715450A672FDAB383D3011719C229E26286A01DBE2E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674949555, "uuid": "9978d767-d2c3-4bc1-9b5c-c7978928ba2f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674949555, "uuid": "4fdc8e58-67f0-4eab-aa94-67d35ef91a21", "value": "49152:okug+WRJbCUJtc6h3CjSOedDSjlGQoC2m7UIQzcenoF5ntIHLCgv2MR:hug+GJv82glic7UFTUniv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674949555, "uuid": "97c59883-1fad-4331-af8f-52f5eb671b08", "value": 2358872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674949555, "uuid": "aaa8ba6c-a5fd-4949-b9d1-3a52d4105387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674949555, "uuid": "c194daa6-b759-469a-b236-f27f82554d81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d859044-9f30-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674926532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926532, "uuid": "3894942f-e35c-4112-8d40-05f5a48f9a25", "comment": "Malware payload", "value": "ae1597605da353950132453644fcf357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926532, "uuid": "85990646-7ebe-4ecb-b821-d80fc4225bcd", "comment": "Malware payload", "value": "8a599a85488695ae8483ed6609d592b99060dde3f5bc49910512183bdda70ea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926532, "uuid": "2617ddee-58b6-40d6-80b1-680a5a229330", "comment": "Malware payload", "value": "1ed2f854bfeabd640174fd903edfc7f9b79ec46a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926532, "uuid": "dc05f69d-fc15-4829-ac10-597d4b441cfe", "comment": "Malware payload", "value": "1383e2e43c2d174260a562a1e6ff2c8ac5df36c6a4b72a9323dcd9446ef640ac8fad39d78ab9470cba9d6b439adeaace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926532, "uuid": "1a0c8372-45ab-4511-8013-d7dd21848e74", "value": "T1CC75F793F89580F480FEE164C766A227BDA134D9033437D36FA186E11B66FE866BD314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926532, "uuid": "5fc77de9-f7bf-4fcf-a10a-ee0d2093ca20", "value": "24576:jDI1dw+OlIzFyHv1C5z+UER/2SAzlXfGtYmWj7:jEjwvlIKv05z+UERnIcYmWj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674926532, "uuid": "0da1e9d6-0722-43f7-9182-6103262ffca5", "value": 1693981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674926532, "uuid": "ec2d0a7d-0bd9-48d2-b2aa-14baa93eb044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926532, "uuid": "cb781f7b-62a5-4881-ad25-d4f227107fc3", "value": "ae1597605da353950132453644fcf357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc64a640-9f1c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674918182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674918182, "uuid": "e9d0f7ab-fbca-4e29-ad03-d286e9391189", "comment": "Malware payload (RedLineStealer)", "value": "30974f7abde490dfe11e9034974dd90e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674918182, "uuid": "d6054de0-85cc-4b5e-9252-19925f646b83", "comment": "Malware payload (RedLineStealer)", "value": "8a6d75808a1bbe40563931890c0bb90e24fad0b5c269282d27c4c517ec5a8b20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674918182, "uuid": "bb3ab971-703b-4bc0-98b7-fa0d9ccb115c", "comment": "Malware payload (RedLineStealer)", "value": "f62ed14e830229d24c7bc660e6bc852833aac3b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674918182, "uuid": "c04b8950-46b5-4e4d-93a9-8f9717f455a8", "comment": "Malware payload (RedLineStealer)", "value": "2b47f04745741b240f85489d2aa14a09772e1c2a959501808a21b6074fcc19be6e954a75ce42ec902fb053f4cfc9a479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674918182, "uuid": "bb88cf5b-d3a0-4921-bf34-0e96e4d981ef", "value": "T13184BE8167E2BCA0D537CA728E2AE6F4771EF4928D14776D2A049B3F19F1173C5A221C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674918182, "uuid": "e85acb2a-db76-4fed-be32-171f35a2c698", "value": "d191080c270d3118935d8b6a682d2ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674918182, "uuid": "346d2818-5ad0-45e4-8f56-c9f7ee841329", "value": "6144:rL0we73KcLlbkLQFpK2eZk7ijHFdFy4TpoL9PwLMfqSwzIDMZDS/9NsP:rIF1LlwD2Kk7KFdbYwLoqSAeM5S/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674918182, "uuid": "fc9268a1-9e6e-4ac9-a8a5-dd907ea682e6", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674918182, "uuid": "8206270e-f02f-4e7b-bbd2-ede5210a749a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674918182, "uuid": "dba70d76-4696-41db-b6ee-ef11385a68d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0de3b11-9eb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1674871750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871750, "uuid": "3bc6ecea-f467-4664-8a28-1830327e7c52", "comment": "Malware payload (Amadey)", "value": "236f2f8581593b17002215b427e0ba0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871750, "uuid": "190ce7ed-d267-4f6a-8d31-650988323636", "comment": "Malware payload (Amadey)", "value": "8b08665a4841798bf73e2f8b9e0a617ed2cb17a86250c46ab50c01322767deca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871750, "uuid": "aa0c8838-7b9b-4f42-b963-0552f50291e3", "comment": "Malware payload (Amadey)", "value": "7570455789a03771f3a6cf42fa3a83810b1295f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871750, "uuid": "3ee90cca-0a07-482f-9bde-cdfbb589fed3", "comment": "Malware payload (Amadey)", "value": "c451f6b841e64fbc6b8f49ea6aae1ec7b64211e7de462aec0f2304019b0ae923bd64f60932d7dbcd13284e4e7fd4a8eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871750, "uuid": "91e725dc-4b62-4616-a8a2-86b91a1253ca", "value": "T1FF75AE01BB949420D5F662730906971F90B79DBE05110A23257F5A6EFE32CCEECACB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871750, "uuid": "a480fcb3-bb10-434c-9cd7-a6b9ded003e2", "value": "39a4439f8bc5e6e61317c81ff97d3d8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871750, "uuid": "13c6e79e-9238-450c-9296-3f666c028239", "value": "24576:WaNRz4sh9pzkLX8SRjbhoKZgWKW1cQkRP43dQHk4p1z8W3:pN/XgLsKjdxD18V432E4p1z8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674871750, "uuid": "40fe4751-77a1-48f0-ad1c-d6d9ff4ef7a1", "value": 1565328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674871750, "uuid": "6307f73b-5b65-4058-8315-2dd5a360368b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871750, "uuid": "73d05ea9-754c-454e-8786-f9097bb45bca", "value": "236f2f8581593b17002215b427e0ba0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50e1bf1-9f0d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674911754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674911754, "uuid": "7da804f9-b95c-496e-83f7-488c6719541f", "comment": "Malware payload (GCleaner)", "value": "05719c97ee44cbb5360448423e383e49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674911754, "uuid": "38d39b13-6c4c-4c68-8dfd-d81afc51d676", "comment": "Malware payload (GCleaner)", "value": "8b3a4af37a344f8e46e5e9b00c50a0326ff045e98f0c059a94e6ce6ed4a275b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674911754, "uuid": "0b446438-42da-468e-bd23-cc392d893ffd", "comment": "Malware payload (GCleaner)", "value": "65cb35c6bbffd9922d348eeec1ec78cc14211096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674911754, "uuid": "ea8fbba0-c655-4836-bf92-054fc3b3de0a", "comment": "Malware payload (GCleaner)", "value": "032891389d8ffc35258adc3dc7a3f677ef19ab3113e93677c46f3a299edaa3b3e2c50292b404d0fe537c84a9cd8aded8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674911754, "uuid": "dddc5d90-4681-4fab-a79c-8ce022e44a59", "value": "T1A9B53346658289FDD3028FFB25399600FFF3BE8F913E1005724496DD2A7D1B0A87A799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674911754, "uuid": "42030d91-c346-4fb4-ae39-005438ba8418", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674911754, "uuid": "8a6cc6ae-64b3-44ec-a551-e638ddd241e8", "value": "49152:okug+brFpuEzbLctnjXY1SrNpFQRcfAhvu0xo/vUXWOWTjyTvKNYjHnXq6LCgv2Y:hug+FpL/4tje+LmRcfAhvVxoAWT8KNYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674911754, "uuid": "9ef286bb-13c9-4e3c-9dc9-4dc5a6c97603", "value": 2357266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674911754, "uuid": "ac500140-9dd3-4e9e-a7f4-b8a6faec2d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674911754, "uuid": "506178ca-afbf-49fa-adc2-7f0e0c86b650", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2c5009-9ef4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674901032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901032, "uuid": "9d78a178-6fab-4cd2-b8ee-d558568e6d35", "comment": "Malware payload", "value": "06b48f6a297797a892305455030c0e9c", "object_relation": "md5", "Tag": [ { "name": "bthport.sys", "colour": "#F21238", "exportable": true, "hide_tag": false }, { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901032, "uuid": "d519f4d9-f6d2-4e3e-99b5-ffb79d0e12d0", "comment": "Malware payload", "value": "8bde70c4b1f9538ed53f066b879cb09e3c6ce790cbb48c4ea5272e58748a6475", "object_relation": "sha256", "Tag": [ { "name": "bthport.sys", "colour": "#F21238", "exportable": true, "hide_tag": false }, { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901032, "uuid": "8f0f6e07-41b9-49b7-bad9-cc2fddba57f3", "comment": "Malware payload", "value": "6310452ec5184a53eb5bf65acd1e8f11a39a767f", "object_relation": "sha1", "Tag": [ { "name": "bthport.sys", "colour": "#F21238", "exportable": true, "hide_tag": false }, { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674901032, "uuid": "780e1e29-cab2-4f02-b111-2d1471b44136", "comment": "Malware payload", "value": "400d16525450352bf4fd1239a7e6c7e2d486b626e5f355c3f7573f29f84aa6d7feb89eb0cd4e58ded65c6eaa8a0311ca", "object_relation": "sha3-384", "Tag": [ { "name": "bthport.sys", "colour": "#F21238", "exportable": true, "hide_tag": false }, { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901032, "uuid": "d501297b-e564-4350-859f-25ea130948cc", "value": "T19075391541FC15B2F4BFE4B9CA7B9266F3B03C650724BAEB18A0853D8B03ED46639725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901032, "uuid": "6586e1b3-c2c0-4aa6-876e-94c1866643dc", "value": "d3e2a77eaff8af20d62a7c26f1adb568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901032, "uuid": "2d34f6a2-9aee-4880-8bb5-43442568d83d", "value": "24576:AUR4+Q6dxRc6BGcNckxcZqE8TiTiCtX4symdO:V1c6lNiqz2TiCZymdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674901032, "uuid": "f0f9c5f4-9236-4d14-ab0e-1d234238dd69", "value": 1565696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674901032, "uuid": "c0191270-b9ca-44fd-b680-8fecd9858010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674901032, "uuid": "e07796f0-29fc-4824-913f-77455ac4a197", "value": "bthport.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930535db-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674894866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894866, "uuid": "de20df19-7d92-448f-9cc3-6449c0b77564", "comment": "Malware payload (Mirai)", "value": "4abb0865d8e3e8ac595cfe6add7bd5fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894866, "uuid": "68f89148-83ca-42a8-b979-98b43ad2da1c", "comment": "Malware payload (Mirai)", "value": "8c2418d93c543dfc530fa6c7c05f9f9b4d91c95f143a520a3c342cae59e1d8b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894866, "uuid": "d3b9c27d-eafd-4576-b7af-f4e808af5931", "comment": "Malware payload (Mirai)", "value": "2d3cb84749026a417a90dcfe0404c3262625e1f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894866, "uuid": "15ceab70-8289-40b3-9c1b-a9a7201cbdc0", "comment": "Malware payload (Mirai)", "value": "9f71be5a11ea6cd8e8bc8ca2b1aade39a702ca19326d1cddb4311efe6f8d1d858fa08679104260b35ada90a0005380ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894866, "uuid": "7e6ac12b-b3f0-48d9-bb04-f62a1da4ae41", "value": "T14FD2E151A7C7A2F1EDC51D7AF8718188C3760AB9D0AB20948FE915AB78C6CD74C35823", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894866, "uuid": "8068783c-b75a-4154-9926-166fa7c2cb26", "value": "384:0Xsk9VclMzl0DI7k2mysezUG5M0oJv6KdrF0dyAFJfRQkglwdwyqCC9IQYsS/LFv:N+AApmpeTqhXFmnQkwIAID3xvfCa23Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894866, "uuid": "1367baaf-abf0-4762-beb9-1c34320ba7a0", "value": 30132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894866, "uuid": "5db1c6ff-56a1-446c-bae9-9781d2347e93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894866, "uuid": "c27bfea8-13a4-4a91-ad21-0ec765941e28", "value": "4abb0865d8e3e8ac595cfe6add7bd5fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d0795c-9f3f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674933207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933207, "uuid": "d4d6d4b8-0ad3-4d9a-9233-c8233413f623", "comment": "Malware payload", "value": "fbdd33cf51fe4113000a7fc14908b56d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933207, "uuid": "ca595655-bf05-4b0b-b328-e3b2f51ba4d8", "comment": "Malware payload", "value": "8e0a2bc6b7cb6a2531569d25e0708df76f0ea8a2cd52bc8ab3b090e08fed319b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933207, "uuid": "8518d3de-3bba-4220-bf72-bdcf6f1966f0", "comment": "Malware payload", "value": "ceaf739f285eabea68567e2df0288406b3e99138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933207, "uuid": "bcfbf4a0-75ce-49a1-90f7-67427d7c2435", "comment": "Malware payload", "value": "121e152faa4baa3d0d8ef4d30d1105e2cc5fa176729f50b0619f32a2e2309efa86b95e3b2e23a73324bc5081091b7927", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933207, "uuid": "6aa1593e-4177-41a6-aa61-8a6c3d5844aa", "value": "T12DF4393AF6A821E9D076C039D9478D13FB7274590321ABEB02E44A655F97DE81F3E390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933207, "uuid": "426c1a8b-91d5-404a-9385-5c1bf4f3c6c1", "value": "b72a0ad5c8bb46735a391c8036af4eb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933207, "uuid": "d7c3fdae-1eda-4831-91f9-a29c3a98e14b", "value": "12288:aAkzqQTJ0C2Yk46NAF75VeLXoM52eVDOvvXx1I5y1wWEQnEC:aAcJ0C2Yk46NsV9M5TV0v2y1R1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674933207, "uuid": "a4ada145-5928-480e-af6a-f6901fa74397", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674933207, "uuid": "21a1a95c-9717-418b-8173-c4240ac54a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933207, "uuid": "d257ea78-afd5-4968-83e8-37658997a902", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b014434-9ee3-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674893430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674893430, "uuid": "ee0e629c-cd37-45f1-9554-48f40eea1997", "comment": "Malware payload (ArkeiStealer)", "value": "a9e86c9cb3ad3f029abca852fdb79822", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674893430, "uuid": "1b8b4ba2-c0f9-4221-a5bf-d26a12f8142a", "comment": "Malware payload (ArkeiStealer)", "value": "8eb995eea0b0973e28f2e922b33bcdec5b42cac58dabd420e248b657a6813266", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674893430, "uuid": "37a95d5c-7da4-4bcb-be9b-8b462db5b3b3", "comment": "Malware payload (ArkeiStealer)", "value": "d9e515f4460c64e38cf5466aacdf6e9fcb1177d4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674893430, "uuid": "925364b6-182d-4c21-8870-1c65b5e5a1ef", "comment": "Malware payload (ArkeiStealer)", "value": "74920444789ca0a638743927751d6cf70140bdb543a174f1d183b9a913b95d6fd1f44634a92b6a6370b822bd6fef8d10", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674893430, "uuid": "be7a6424-14b3-43f7-a3f0-eddf60b64a7c", "value": "T1DCE5CE41F9E794B2E90355720967A2FF2320AD091F31CAC7E644BF6EEC766E10E32255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674893430, "uuid": "a358d426-7f59-42dc-a060-9d3910f4bf69", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674893430, "uuid": "d30ae820-73f0-4816-bb9e-8bd5b6c1a7e9", "value": "49152:dblU8XCc3HAXxVs3KTtt4y7sNuFwY03PUZS0QcjVcRdbpnuDYz1o:dbjHAXxztiy7sNuFBMPsZhcRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674893430, "uuid": "fa53addc-f260-427f-bdb6-db2b1ff0b2d1", "value": 3137536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674893430, "uuid": "864477b9-0240-4fd2-a212-98d284df8362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674893430, "uuid": "a78cd0b9-c810-4157-b5fd-13c877481660", "value": "a9e86c9cb3ad3f029abca852fdb79822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daeb1ae5-9edd-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674891121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674891121, "uuid": "e2461cfd-2f7c-4654-8e9e-b7feeba2b0a3", "comment": "Malware payload (GCleaner)", "value": "b8356a4aa8eeccc41363679b68e28583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674891121, "uuid": "2873540e-9e15-4d5a-ab24-b70f329b0ca3", "comment": "Malware payload (GCleaner)", "value": "8ec7eb0e93191db4513d40f3b80ab87a874aa9fece0576f0dd63fcb4e0d1eecb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674891121, "uuid": "cd123350-a66d-419d-ba7c-4f9e0c7c2e62", "comment": "Malware payload (GCleaner)", "value": "836e1de24f287e5744564525c4cfdcf669c167e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674891121, "uuid": "1c9e26b6-06fa-484b-acfb-86e0225c5ec2", "comment": "Malware payload (GCleaner)", "value": "b20e0bf1e33c00e9326c76cb4750f1a7a02bb8ac61e1b7d7a5225e193ffd856d5e17da0c5a757c9bd9c62e4dd748a278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674891121, "uuid": "7a4c4838-54ef-46e0-91ea-2b09087ea15b", "value": "T1B6B5334EE59645FEEC72C3FB1D288081DF76DD67303D0211314617EE7A34B21A8AA7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674891121, "uuid": "d2dcc5f7-77c0-4901-a694-82252dea5d6f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674891121, "uuid": "adeaea66-3580-4697-b393-37964a5be7f0", "value": "49152:okug+x7z07o4Z5KwBfW7N+jauM1I/8yg9qo8jBMV5AI4MLCgv2MR:hug+dS7PW7Nru+I/8ygMnlMV5AI4Mv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674891121, "uuid": "d7291bf2-08de-4289-8c21-2a483ff54836", "value": 2372766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674891121, "uuid": "d33d674a-8adc-4e7f-8194-0708a80c18a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674891121, "uuid": "4053532b-d9b4-45d8-b7f6-8537011f5451", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacddc96-9e9f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674864492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864492, "uuid": "e974bd48-da16-4cb4-9316-1b078055f2f7", "comment": "Malware payload", "value": "c1f55bf8710fa5b547fd5f794c134bf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864492, "uuid": "06bcd19a-6450-4082-8d5d-dda0f79c1028", "comment": "Malware payload", "value": "8ed76062c61d2cda43be72d6a8df253399136b12268c517afe0e7ec23398951c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864492, "uuid": "84c73e10-fb1a-4373-8b01-ca46404add32", "comment": "Malware payload", "value": "d1a42fdce3ab068f24d52f65b17ede3c39819d4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864492, "uuid": "3345d4b0-ee26-4dfe-b46b-63facf5c284e", "comment": "Malware payload", "value": "13fe5ec385cedde0cc4471bc07c1ddd9ab416820137ed8419c24e381ad6bafc330c8f1dca4d533130832034eb18fb9dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864492, "uuid": "a8c8b5e5-5b98-4d3f-b05c-3c327d0de674", "value": "T1D176331030CC52BFDA8B0573DB649BE37A6FC25D1A20407717E982756E3D62E8F72668", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864492, "uuid": "37877404-e689-4609-9868-593608d63613", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864492, "uuid": "85442086-e5f2-4f20-9875-f2f34c6f3b9c", "value": "196608:91OGdwn39KAVOLKLfdMs28Ez50m9v+KT5mdbf91:3OGM39w0dc8HmFL6bf91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674864492, "uuid": "052003fa-fc16-4f31-a6a3-7a28bc725e20", "value": 7635689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674864492, "uuid": "066a3275-7ead-4090-b24d-d15896503d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864492, "uuid": "1bfa516f-bf67-4bb0-ac93-5d0d6b83827c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e072c0e-9e9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674864175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864175, "uuid": "eae16ec6-c5a8-4e9b-a1a8-d72ad981b53a", "comment": "Malware payload (RedLineStealer)", "value": "c0d8f8970b2aca036541848a5b3a2fea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864175, "uuid": "5c641b5f-00b9-4d32-bbfd-02d98d1171ed", "comment": "Malware payload (RedLineStealer)", "value": "8ef3618a3aa183b9e4a48452a75ffe202572978390c65b12e84e6a9dd6c5f8b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864175, "uuid": "6d7f0e62-282a-4889-a9ab-430a622d0859", "comment": "Malware payload (RedLineStealer)", "value": "8372049b1563390fbeae244f6d44ccbe89a52af5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864175, "uuid": "c6cb7847-5ed9-44e9-820c-4ece101e019b", "comment": "Malware payload (RedLineStealer)", "value": "6065b028ba29631522cbc2def890e59a6c2125bc9b53876da7b51ecf75a3a630f93824ffb89f5ea49fcb035456c7c6ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864175, "uuid": "af5e591b-4d67-4665-9ba8-102aac8924e2", "value": "T14384D00226E17F48E967E6328E1EF7E4B1DEF5C1DF5527DA1208AB4F18B17A1C622710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864175, "uuid": "129aedfa-4a30-48b5-aab7-006dd86cd581", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864175, "uuid": "c8a5cd2e-8535-41a9-b4ff-526f99de5ae7", "value": "6144:hQLfEmDOcKmFy9Da830IPRZ6NUau131djLlhGWBa/Ox9CEbnVnRLy3Y8dV:qzEQFy9D730I76ClXjLDLamLCWlgdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674864175, "uuid": "2b286aa0-92a5-4750-8dad-f191972116e7", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674864175, "uuid": "7a85d4e0-8840-405b-8560-223f201fa567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864175, "uuid": "d85a48ab-1684-4af9-999a-bcb6c8b81ef7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2213d15f-9ed3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674886516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674886516, "uuid": "4be4a99d-949b-49af-bc82-97559881c501", "comment": "Malware payload (GCleaner)", "value": "dcc2e95ba1831ec28917ce6344603031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674886516, "uuid": "809dfd8d-a2ed-4b0e-b6ce-ea0439bf00ae", "comment": "Malware payload (GCleaner)", "value": "907d4be4e628450058739013e2fe60e0da3fd015554c9ebc77c408996d91acc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674886516, "uuid": "56e9abb8-1861-4bdc-a763-59018944a3f4", "comment": "Malware payload (GCleaner)", "value": "a724cd6662bce0d54da0003a918a21c7ef214473", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674886516, "uuid": "9b1b99ca-4473-45f7-90b2-49bc0334081e", "comment": "Malware payload (GCleaner)", "value": "1e94ef6391a336a5bde332b2be9afc869414a10f7b0a82b05583e8f4ea17231532216778a51c7c11cb713fe89209a90c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674886516, "uuid": "10271d5f-01dc-4dec-9c42-dd0a72b96249", "value": "T19AB5335AB061D67DD44783BA3B3282809BB6FDCBB07D05417A58237C1B726606A81FDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674886516, "uuid": "3c5ae297-9be5-456a-a83d-b258669e2afc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674886516, "uuid": "3b5671c6-57fb-4bb7-97f7-17797ca24ca9", "value": "49152:okug+qTBLY2Y2SsinI7ZCEKr+nRFH74qi2JbLCgv2MR:hug+qVLtY2quZzaGR97Zv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674886516, "uuid": "cf1bb873-eefe-4617-aeec-2966bd28255e", "value": 2379009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674886516, "uuid": "d34d1a02-1dae-4371-9fe2-67d60879b09a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674886516, "uuid": "5874005b-56bb-44c6-8d86-224c322a59ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f14edd0-9f24-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1674921327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921327, "uuid": "6b740fe1-3ff0-4314-99e0-7617554210e5", "comment": "Malware payload (AsyncRAT)", "value": "a47355c5131e669569fd038d40ec3b30", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921327, "uuid": "ab97b4f1-64e8-46be-be0e-71c2e288e46c", "comment": "Malware payload (AsyncRAT)", "value": "915218971d799dd8d84bcf104a727d40f5bea6456ea20d93d97bcd9e771dabf6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921327, "uuid": "de250653-0a3d-4fe7-b83b-cca947f9017b", "comment": "Malware payload (AsyncRAT)", "value": "5c8069a1ee5a606b8c8614606e63c73abaf9d20b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921327, "uuid": "d267ec5d-07ac-4d71-8125-baa0471feaff", "comment": "Malware payload (AsyncRAT)", "value": "1f7d6b1755c713b3bebac7375f930c0301d6116dcd370831bd0d89be5539fad088eac8742f50625b9795849912c8369e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921327, "uuid": "d67267e7-9544-43ef-83f5-13a2d0d4ea9f", "value": "T155C42211326AA83BC9E814FF28651A451BF95A4836C2DBDC4CCB61D67FE3BE143225D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921327, "uuid": "78c97d92-3d01-4857-9e52-05ac409c355f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921327, "uuid": "41f163b4-6aaa-448c-9b90-676ad68100a8", "value": "12288:Is7nq0Xp2iNUWgMlSYtz8L6guw4YXxtaXryOxRNAeINEFgvMIr:31bfoL342xta3N6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674921327, "uuid": "f7a5a965-67ec-478e-9ec1-a40c613a9bce", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674921327, "uuid": "518b4f08-3364-44c7-b5fa-e1a2baad6e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921327, "uuid": "f5b8c074-b8a9-4858-aa67-b4a3116ba202", "value": "EM5L2qVr2LBJzrD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b0d580-9ea1-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1674865183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674865183, "uuid": "722b6f94-a0ea-4ac1-a9d0-7d42f250a1e2", "comment": "Malware payload (TeamBot)", "value": "5f65378449813815c935961e396e71e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674865183, "uuid": "389c43cb-e190-4a3a-82f9-edd42ccb0e8e", "comment": "Malware payload (TeamBot)", "value": "9170175c73ff579232d9e18747bb3183b5f75e7373ffcefa2bd631186ac8f9fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674865183, "uuid": "db11e775-e7da-42ab-b76a-0afa5b2a11d2", "comment": "Malware payload (TeamBot)", "value": "828f7aabddb77b00f25031c73450874cbfc40e42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674865183, "uuid": "704e7a76-c4b3-4e3f-97b4-1a1385bc2366", "comment": "Malware payload (TeamBot)", "value": "020f5d58b3b864a8cc368c4d7ac3114e8206e24d2b3005f7b2c097f2627bd08fdc017fa44dd9ff7d4b068d2c88cb0ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674865183, "uuid": "f75ff6bd-9a3b-4abf-b607-cffe0d303dc1", "value": "T1F954BF0276E5BC48D967E6338E1EFBE8B51EF9B1DE5523D93208AA1F1CB15A1C163310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674865183, "uuid": "a6e41979-5ec0-4c6f-a89b-72ef62eecf3d", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674865183, "uuid": "d1d38921-c36f-49a2-a4ec-9285556a2006", "value": "6144:CLzjPW9koT2J35qnl1m8y2bx9CEbnVnM/78dV:CvjuqFglS2bLCWlCAdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674865183, "uuid": "aec82485-7b9f-400d-878a-e5269e1dcf93", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674865183, "uuid": "27ea0cde-56b3-485c-ac75-177f00fc21e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674865183, "uuid": "34dfabca-76e5-4fe6-8f3a-7dffc231ae59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b222c5-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674894874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894874, "uuid": "a2f441be-5243-49c8-acc0-af5ecc96d39c", "comment": "Malware payload (Mirai)", "value": "40cc5648897929aee057002634521f1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894874, "uuid": "69b39079-c033-4240-b314-8cccdb596230", "comment": "Malware payload (Mirai)", "value": "937fa242d16cede787bf9ec17d5174af8afab2752ddcfe2b058c276fb23b908e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894874, "uuid": "aaafb35d-a774-49e9-b8ee-c362990afc95", "comment": "Malware payload (Mirai)", "value": "cd62e2ad0286165525f920c4510e197d995e8250", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894874, "uuid": "656b8390-8ed7-43b2-88c2-175ce82cbfd8", "comment": "Malware payload (Mirai)", "value": "eee8480fd1f324a1dd1365689b16a3acb622cb410e20c58e33e504aac338a92e4967d737e72683fcd18ea3cabd417940", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894874, "uuid": "cf6a1053-45c4-467b-8430-187253a7b1c5", "value": "T1A5E2D090C3DA4EE9C67E94732C5FFD690410A504878558E2BBE4BEFBE482F951B34682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894874, "uuid": "b3307640-36bf-48e7-93c6-0fbf200d6921", "value": "768:SlFZv/kTLxTswvUDZjjCkWKJRF1RNnbcuyD7UVyqe:4Z0TLxTswvCjkKj1RNnouy8sqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894874, "uuid": "bee1fefa-a2ba-4a79-a50d-a586250e6dc2", "value": 31248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894874, "uuid": "749912fa-2b5e-42f7-ba3d-3aaa04856a06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894874, "uuid": "ca0b3e5a-e2ce-4b42-a637-3cedb08faaef", "value": "40cc5648897929aee057002634521f1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb63032-9f63-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674948675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674948675, "uuid": "d2100f65-bbdb-432e-a717-7b73c9394908", "comment": "Malware payload", "value": "b5f09034596007ccbfe94440491a12fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674948675, "uuid": "da661fef-88a8-4b02-8903-3167544b7531", "comment": "Malware payload", "value": "988e02cd2ffc25b5bf95f8348fda71e3608283c4b589846bd7b3006f47438888", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674948675, "uuid": "8b3671ed-53d9-4c56-994c-bcfca6562100", "comment": "Malware payload", "value": "c404527a438b8b7514fce34e452d0809658d813c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674948675, "uuid": "90bdd365-46da-4692-924c-261f7c32bc76", "comment": "Malware payload", "value": "a6d8fce7f386500f5a465311eebc4eb764ba471c3fbf79e7b163f9727e7e2c5b47e3de1e9dad1a557bbbc8b90e09cbd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674948675, "uuid": "22ae7183-4d2d-4bcb-b1ff-475cd931f631", "value": "T17284B0C2A6B1FCB5D9374B328E1ECAD4351EB452CF7D672A22386A1F1872361C563319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674948675, "uuid": "88b6298b-393e-48f0-823c-eecb08b2bb83", "value": "dc3a0c75117ce1f8b0d73167dcb17e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674948675, "uuid": "500649a8-cbb2-4754-bf7f-e6c7f5f05a84", "value": "6144:qLcjmcop+SAl/t5dAdPPfGfobiz7Sj4hCkFm0E954DVvFZ:qYicosSa5dAdPGobiz7Sj4hLmRz4NFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674948675, "uuid": "60e11854-3404-4521-90dc-8b378c22d2a3", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674948675, "uuid": "aeeea243-a2d1-41f8-bb91-f58ed6821f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674948675, "uuid": "1eef3b1c-3017-465a-9cf2-d93023a1066e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98e264a-9f31-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674927250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927250, "uuid": "d003319b-6d3a-4184-b223-6581f4037251", "comment": "Malware payload (RedLineStealer)", "value": "b233bd924e256ceb482624d048734031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927250, "uuid": "181f57dd-8667-48e4-a1ec-ccd1a5d54378", "comment": "Malware payload (RedLineStealer)", "value": "9890ec39b9d8146654db2f6fd2b03506d6e2b33e2fb0d279b52a735723940652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927250, "uuid": "b88af605-75f4-4544-8469-4d1a08c81231", "comment": "Malware payload (RedLineStealer)", "value": "8a05e2f988133651d6a3f8249d138cca2f3b2f7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927250, "uuid": "b71aa3f4-aaa7-4f94-aa1f-0c02c157de73", "comment": "Malware payload (RedLineStealer)", "value": "ca5b91efdaebf2e0523f65fea194dce29e39c701d2ca5f8f51b922dd2c0281b4745ab12b5cdf64cf03290fb83ac7cb6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927250, "uuid": "ff6120b1-57b7-46d4-85e5-984ade054c35", "value": "T19B84D00267E2BC20E925CE759E2AE6F4772EF4509D15733E2A196B3F18F1173C5A221C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927250, "uuid": "a25d26c6-9ed3-4b40-91dd-58cd64232da9", "value": "a5cda000ff4d200b1a7c245df76a958a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927250, "uuid": "fc6df1ed-1d89-4583-9f2f-6f226ca4b350", "value": "6144:ULa9GvAe0deJBSmrobx2fNcWEjqcrUyBphoqSwzIDMOulQYOP:UeMvAe0mBFrs+FEZZhoqSAeM9lL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927250, "uuid": "c9a81cb5-3c32-4033-a9f7-d03d0f817db5", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927250, "uuid": "2204f6b2-5e3c-4bc5-83a7-baac22715dcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927250, "uuid": "76ab4ee1-a16f-44ee-b90b-db5561c4c41b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc51432-9f1c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674918100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674918100, "uuid": "78151fbd-3a89-4616-be75-1cbf4d5e7fea", "comment": "Malware payload (GCleaner)", "value": "5e0d38fef7c983a68d3b37dac3c8b932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674918100, "uuid": "7a8b8785-da41-4d4d-a786-1c0fd1f92438", "comment": "Malware payload (GCleaner)", "value": "98ba3b03e83ce646745c83a1f373825babb20927f78efdf58fb6f60e1866bcb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674918100, "uuid": "3724f066-45a5-43bd-a9cd-eaa1e4161fc8", "comment": "Malware payload (GCleaner)", "value": "a74d16b379e9ba56bc7c9834c7f4979f04da05b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674918100, "uuid": "474f4f4f-0d4f-4947-833e-f9b848d04cbe", "comment": "Malware payload (GCleaner)", "value": "05bf2d1f2c0e6fd41afe086b62e57be4591bfcd61a7773ef902d624fcd1289d07c5b60c2039b0b743d8a450a71a504fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674918100, "uuid": "c692819b-68d4-4781-8884-ebc4b47eb583", "value": "T16DB5330365A0D9FDE8728EBA0D308244BF3AACCB747D150133586ADD2DFA39058AB765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674918100, "uuid": "54949b6b-e426-49b0-894f-507a97e357ca", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674918100, "uuid": "429c0571-3d4c-4848-85f9-077d066977d1", "value": "49152:okug+hNFKZnCYOdgq2twNy83ivXsnHhf04Fr+F3cKEimLCgv2MR:hug+hBglypSvuGFzEiWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674918100, "uuid": "67de2a08-0308-435e-b717-0bcfb14923d2", "value": 2373617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674918100, "uuid": "473f8847-7c0e-4e31-832c-fa68a7b5b00b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674918100, "uuid": "a07787c2-a4c0-4ab4-90e1-86e697cbb348", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07666e53-9f3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Neurevt)", "timestamp": 1674932427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932427, "uuid": "c822a29a-d46a-48c6-bf1d-dc0204b14ac4", "comment": "Malware payload (Neurevt)", "value": "77c0c3e49ad114f40a5ffec63a58b740", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932427, "uuid": "7ad4c080-f718-4c0c-871c-4a41ca6fbc3a", "comment": "Malware payload (Neurevt)", "value": "9a88e4c02cb3205593bb6f344ce6628fc86e9370b130371165a59d6cf6891465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932427, "uuid": "19344290-54a0-4089-9328-e59805672720", "comment": "Malware payload (Neurevt)", "value": "2ec3e134f0b2893b58100d80358f4c57e144a647", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932427, "uuid": "258dc003-7378-4844-9f06-0703040f2f30", "comment": "Malware payload (Neurevt)", "value": "a8e2e6b61481f5894a5930cf43b61c0a77ce656cf67240b52de6ffa600e971ccff546cb2a0ef1fe8ef730fce7eaeb9a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932427, "uuid": "b2722334-5122-4582-a9b2-85c04629f18b", "value": "T1A914129EC040AFA5E40CA1FA46858126FD589B5DF3B9D07B9809FE2C35E49F86279730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932427, "uuid": "b6d7167b-9d04-4d17-a218-96b8b9b270ff", "value": "529ac643cc5d5d995f9d7ad9d0e3505d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932427, "uuid": "cee3016f-95eb-422c-b738-44e2de482a0b", "value": "3072:pZbt0LcUrD/CYCm9jkH5AhbwAnw55BTM0K42aaAu5Nvro6CTxN8+51LHznVk1PDV:pZbt0lTCYCr5AhbwP5BTSZapaDoTo+5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674932427, "uuid": "01a876ba-70d6-4e9d-b13c-efd54943bec4", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674932427, "uuid": "d104e0c1-4a03-47af-b80a-18c2f10f32ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932427, "uuid": "d5e1bce6-16c9-4292-a704-ddec1c4c770c", "value": "9A88E4C02CB3205593BB6F344CE6628FC86E9370B1303.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d107b14a-9e9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674864046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864046, "uuid": "ccdbb4ef-0cc1-4a7d-ba63-10d0ea1753f3", "comment": "Malware payload (RedLineStealer)", "value": "88acf60671b819d2c3d37e3091f35b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864046, "uuid": "8e9be1a6-5f4a-4b3b-ad7d-d58b7024d7a5", "comment": "Malware payload (RedLineStealer)", "value": "9c3ec19f573f84104bc82a69cc3f036aaee74e4ef2a7ae0ff62312531e46a07f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864046, "uuid": "d7837721-d340-4495-8922-506fff4ee405", "comment": "Malware payload (RedLineStealer)", "value": "f1040a6a732e5973ae65105c24d615ea025fa78c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674864046, "uuid": "5ed54744-1d41-4a3c-9888-4692f547eb7b", "comment": "Malware payload (RedLineStealer)", "value": "1c434727ec8aada5680605b70f7a1c84615a9aee16e59b602f6c098b688050738c10671816ffb89d5b04cb993b047758", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864046, "uuid": "cdf3a8f9-c437-49d8-9b32-36b13f3df98c", "value": "T173B42089714B553AEA189EB7B28ACDB0AF398D690481D349F2C43FCF353DF42A5C8911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864046, "uuid": "315d4f36-86df-4db1-9268-a3dd8ec1f8c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864046, "uuid": "993084e4-ca07-43ad-a9b8-c6efd704ae7c", "value": "3072:zlv9WH20wBqN+Z4OD5O6IDSiAec6fU+pj3M6Bi+yp+n/Wmtja+KzTOzzoz0:zyHupIDSAcGg7pkVK3Ozzoz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674864046, "uuid": "9d8b9f5f-6d39-4625-a19b-d68ec5320bdb", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674864046, "uuid": "019bcd01-3eb9-45ab-915d-ed8292705901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674864046, "uuid": "3d1a7e7c-ecc9-4200-b872-bc393c0fa7bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0a450b-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674894854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894854, "uuid": "d37560f0-71db-4c76-8e29-b0ce8f7cdfa4", "comment": "Malware payload (Mirai)", "value": "2de408f8db4e769794c18f8c40570ca7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894854, "uuid": "ef69cd12-f2d3-4246-985c-d59ec6e4427c", "comment": "Malware payload (Mirai)", "value": "9c93f2c1045ee7c47eb90dfa1a4b7f9a612ce962c10b4b2ca4d8614a7ff24fac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894854, "uuid": "a37e215e-891e-4481-a62b-eb2476ba8c0d", "comment": "Malware payload (Mirai)", "value": "8adb9ad10da09417a25300ab49864786e12d5732", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894854, "uuid": "1b6cd711-cab8-4c51-9b0c-8ec18f3d72c6", "comment": "Malware payload (Mirai)", "value": "79b7778662a0a2efd675d6c3bdb16db4bbb0f769a0dd8ad0de97aa6704f05431c34ffe1bcfecc6a615e347dcd6e99766", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894854, "uuid": "ee4ac2e5-6bab-4906-8586-e53ca1f212da", "value": "T120933CD294015E6CFD1BCA36D61BCA097C2191058FF20E27E762BD8B5D3A5B9ED0EC81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894854, "uuid": "83630f15-d6d2-401c-b681-03ea3f2ab8be", "value": "1536:UCoJ5PrbMo52+6lj0PYL8cBwdnCY7XdsiYC:OH+VGQ9ZYzdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894854, "uuid": "22744fc6-298b-44ca-bf86-fd70d3211ad4", "value": 93864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894854, "uuid": "67a32f68-fd6c-4dec-93d0-06f3c4e93056", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894854, "uuid": "e5b79793-fc47-487b-b099-c1e0aadb6ad7", "value": "2de408f8db4e769794c18f8c40570ca7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbbfc2f-9f32-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674927311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927311, "uuid": "e8cfd959-8381-4f0c-b07a-8eecf13b1d95", "comment": "Malware payload", "value": "17afdadc5b9e4d5c61baa3400088802d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927311, "uuid": "02097be8-8008-43ff-b0fa-b854d64daadb", "comment": "Malware payload", "value": "9d22bacb457b0a1a05e676b6d0460c99eba3308553688a7425672c847f5e23d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927311, "uuid": "014a13da-dc89-4c53-92f5-16fef3f9d376", "comment": "Malware payload", "value": "d28c59f4707fc49d9217ff62b6e9bd59a6803b21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927311, "uuid": "54571cf1-b2db-46cf-9fd0-c4da0c9ce6de", "comment": "Malware payload", "value": "cc1415a1107c19db0d3294720f17a14ab5f7be29d93286eeb67df597e9a68cf85a6795f6ce73a1715e04220a5324c0c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927311, "uuid": "50071eaa-556f-4914-9214-d1cb7dbfef65", "value": "T101652241B5D049B1E4B71A321DB9A322A9BD7D201E34DA1F73E87D3C9E325D0A215BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927311, "uuid": "ca88c9c2-b6ee-4e6f-85fe-a458ea1c2a74", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927311, "uuid": "37b162f8-985a-49ec-a0ee-0973ac16f29c", "value": "24576:wNA3R5drXRDz3CxzC7g9zjQo3dIW0Jo0ubXk8MFIzMFIvbQNAwBeAZoArMM6JW:p5lD2f93Q4qHubXGLeiLBPZYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927311, "uuid": "5cc59da0-980c-4960-8e11-04206f62f567", "value": 1506946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927311, "uuid": "1506c7ae-0a00-4141-9cbb-7c39dd91595e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927311, "uuid": "ef62c646-33b3-46dd-91dc-c2c0e68a8f4b", "value": "17afdadc5b9e4d5c61baa3400088802d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173843e5-9f45-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674935460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935460, "uuid": "4f4aca6f-857f-45c6-8062-395c117dee97", "comment": "Malware payload", "value": "b7f3c45535dcb2e1644d588b4d761ef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935460, "uuid": "ef365769-5d7c-49c4-b0a0-6e0ca8da7e93", "comment": "Malware payload", "value": "9d3f0d6a3a7444d7cf575d807036fa3ac1760d36d64f4d4e3f66f39e425ac493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935460, "uuid": "b8987446-9f69-4d6a-a3a2-2d7fb729deb8", "comment": "Malware payload", "value": "3e5beb5abde8f92afcb7dfc5bb529747944855dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935460, "uuid": "a2939211-2f8a-47a8-b699-cfc8aab01157", "comment": "Malware payload", "value": "bacfa57f3fd72a30a72ad0b42de312e8bd50bca8e5564355bf3595ab66e929324b982727bf801bc2faf3b0ec22f5d301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935460, "uuid": "fc528768-a14b-47ed-b6be-e883fbc45a96", "value": "T14CF54E6D7BB9DC30E40569BBCA9185B2D506EC31E923CA5B3544FF98B836F9012F134A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935460, "uuid": "22e3931e-fecb-42d5-a507-f2f1e9f58195", "value": "bc3b73abc53c01628df9daff99e83704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935460, "uuid": "b4da23d8-7682-47d4-b8c2-dd3192965c35", "value": "24576:JEDUEIY3GQgmQUnQQQQQQQQQQQQzIxYJJQLd8VZnB/NfMa7+NFCuvBLXBw90HCZJ:JEDUqtQ8nwnFn5ba0HbK/TCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674935460, "uuid": "39e01964-7258-4387-bb3c-a1e14be83185", "value": 3544064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674935460, "uuid": "43d134a4-29af-44dc-a14e-1d34f6e01dc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935460, "uuid": "787a4e56-f85f-473d-a144-efd21632096d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193f4e9e-9f27-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674922579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674922579, "uuid": "80e52ccf-cafb-4d8a-a0d1-d6ec51ceda45", "comment": "Malware payload (GCleaner)", "value": "52e2157566fe5d7cff2f731f45d3cb12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674922579, "uuid": "c5eec0ef-fe91-4536-b931-ed9c3e2f90fd", "comment": "Malware payload (GCleaner)", "value": "9d769331b288f1e1087769cca0bbe7e08bff0733e6ef64fafef1beaacb0df08d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674922579, "uuid": "7c4ebcd5-9358-4fd9-9eb6-4a252c127ac8", "comment": "Malware payload (GCleaner)", "value": "fbfb46768a8f16ff34cdd0ddce840bc056a91984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674922579, "uuid": "ef98cd0c-859a-4d37-8498-e664fb7a4948", "comment": "Malware payload (GCleaner)", "value": "9289f4d851a8950268314cd957e774b4aab7a83e2a9a7b4d2106095e5459a4ed644a9609daec368f71c7e854cbae20c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674922579, "uuid": "0c2393eb-58aa-422b-a4ab-9ec38cf863ea", "value": "T1BAB5339EB581D579D2A14BFB1A302184EF73EEDB60BF029636C5739C18A3CF164A06D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674922579, "uuid": "1dc6eb75-62bb-4998-bcf3-9c3fb5e78938", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674922579, "uuid": "cb4282e0-0c88-4286-81a6-c58dcf5a6d25", "value": "49152:okug+1PzCdDahgV2wLaCBmciFmhtgB9xzhSODSyzilLQxVLCgv2MR:hug+1bCghc2A5iFt9xNpzil4Jv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674922579, "uuid": "bcaaf54c-0f7b-45ff-a74a-8a52bf78b4a2", "value": 2364219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674922579, "uuid": "06467e27-eaf6-4e0f-a219-cb2c16965c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674922579, "uuid": "0cc63f2b-04eb-4168-ad02-2d60f0c73c18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f5cdb2-9efb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674903734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903734, "uuid": "b23be478-9a3e-415e-83ca-eb30482b30df", "comment": "Malware payload", "value": "3b92a61cbfb21a4502a663f09b362925", "object_relation": "md5", "Tag": [ { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "detect-debug-environment", "colour": "#8180AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idle", "colour": "#4BCDF5", "exportable": true, "hide_tag": false }, { "name": "long-sleeps", "colour": "#E092CA", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "schedsvc", "colour": "#4F9AC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903734, "uuid": "adec704d-aa50-4191-b426-4c52c136534b", "comment": "Malware payload", "value": "9fa2cb4e283623f56adbc1e779ea16cd3a7a89ddd6afca932968c3f77c8365f7", "object_relation": "sha256", "Tag": [ { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "detect-debug-environment", "colour": "#8180AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idle", "colour": "#4BCDF5", "exportable": true, "hide_tag": false }, { "name": "long-sleeps", "colour": "#E092CA", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "schedsvc", "colour": "#4F9AC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903734, "uuid": "2888a1d5-265a-40bc-aaae-c9e29fc9e1b6", "comment": "Malware payload", "value": "736c6df952bbbc76eecf874a48142e5b56b762d3", "object_relation": "sha1", "Tag": [ { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "detect-debug-environment", "colour": "#8180AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idle", "colour": "#4BCDF5", "exportable": true, "hide_tag": false }, { "name": "long-sleeps", "colour": "#E092CA", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "schedsvc", "colour": "#4F9AC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903734, "uuid": "b837cd30-d524-4d79-afdf-6c710513c306", "comment": "Malware payload", "value": "edc4ea880b4f19c6c0d2faca545bf1db4dc684d716bbb7d20949b588c9b5bf1c0c19a2bc1885a978409268c740e7bf11", "object_relation": "sha3-384", "Tag": [ { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "detect-debug-environment", "colour": "#8180AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idle", "colour": "#4BCDF5", "exportable": true, "hide_tag": false }, { "name": "long-sleeps", "colour": "#E092CA", "exportable": true, "hide_tag": false }, { "name": "malicious", "colour": "#0748F3", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "schedsvc", "colour": "#4F9AC6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903734, "uuid": "53f5a857-b05f-4287-ae54-89d7c0ddab7a", "value": "T141052A1DA7EC4654E07B827489A74321F672B8215B20C2DF3199923E6F37BD49F36B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903734, "uuid": "191052c2-4e0f-4295-9882-4d0a2ad3d462", "value": "582b32465a0b3011c65d107f8e7eef01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903734, "uuid": "93d660cc-424a-47e1-a880-bca21832a8a5", "value": "24576:HSIN9U1pP3FKZhPkv78TYJmaUXk/CYZM7A9gRtW:HSBzihP076YJmaU0/VZM7A9gRtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674903734, "uuid": "5a3df12d-b193-412c-a48a-c6f2a451546a", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674903734, "uuid": "495a68b0-1578-4b11-aa95-14e9998de650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903734, "uuid": "bef36e63-c4bc-4df2-aa71-5149f39bb100", "value": "schedsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9932615-9eb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674871792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871792, "uuid": "ae5847eb-b117-4ec7-9698-186097b17d41", "comment": "Malware payload (RemcosRAT)", "value": "bb43b1a9498275be7e321b2bc217096f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871792, "uuid": "f1e0efd6-a817-41d8-a29b-e52353bb4ddc", "comment": "Malware payload (RemcosRAT)", "value": "a06b22bc855434e422e2361ed4e07e88c5958b5bebecc34020c3c011b0ce03b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871792, "uuid": "9a925505-c1ab-4a73-a217-d99c19ba6202", "comment": "Malware payload (RemcosRAT)", "value": "be8179b069807d89c58954bf20d255ad119cf565", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871792, "uuid": "b0ae195c-3fcd-446d-b1d3-09c37412eb94", "comment": "Malware payload (RemcosRAT)", "value": "1603824dc385a94910909c896e8d3f56e1852edae0af7b6195d173bce22a88525ce4ee7ba05d105d46964e6b92aac649", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871792, "uuid": "ca5fd9fd-8269-46b0-abb2-be6755e4804e", "value": "T1F125DF4023EC9E45F6BE4B7996B9405217B77C927573E21D8EC130DE4EB2B00AB46B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871792, "uuid": "f55d0886-c185-4b07-82fc-741a4b0a27d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871792, "uuid": "276ce65d-f58c-457f-bb3e-8b6084cefca9", "value": "12288:+SkOvbnR8ey/ZhvQXDCzFqIGc9EhsZ0Ap5nk4DP934wWcmBe1vB2AhZZZUZJG3Cs:QvvnXGctZnp5nkoPdvvB22ZoayXZV8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674871792, "uuid": "03eda6c2-f7f8-40ff-8b45-c462f758735f", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674871792, "uuid": "56766916-68fb-458f-aab0-c4e641bf406c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871792, "uuid": "47d19707-4654-4d00-b4ab-96ed66d7d3d7", "value": "bb43b1a9498275be7e321b2bc217096f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ba21bb-9f40-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674933342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933342, "uuid": "efaff854-8577-4d10-8862-2ae2b1176fe7", "comment": "Malware payload", "value": "edc88e80732f0a9ed458f6a5547fc55d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933342, "uuid": "f4592691-09fd-488a-aaeb-5dcf15a52214", "comment": "Malware payload", "value": "a0ccaedf07b76fe0e6b4bd99d4de6859068ac595815700a02899b408048d21d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933342, "uuid": "05a8458f-072f-44be-9312-a31ed5b80042", "comment": "Malware payload", "value": "c0e442529b18d2a3e9808511d03f8c082916dfb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933342, "uuid": "aa331426-fc2e-4030-a508-328737da2abc", "comment": "Malware payload", "value": "60ca89cdb750a3f229833877243af8f61539655f4ca91b28ac841965662201d070d59bc523f952b0fdd889a09c83f257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933342, "uuid": "3cf925cc-521c-4dba-b754-4f2c11f5b53d", "value": "T145B5338FD0A4C57BDD36CFBB18715684AB339C87603C32017658738D1E3A26169B9BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933342, "uuid": "4cd7c42e-5720-4be6-9588-9f047e3b9380", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933342, "uuid": "a651ba0a-8662-4bd1-9587-6edff4fb4a4f", "value": "49152:okug+v7s10Aw2hil8HPLISBeboUVebkaMtaFHO2Ed/OTSMxN6lLCgv2MR:hug+v7mkmHKoUIbkaMgHOjdGmAN6Zv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674933342, "uuid": "a3d57e65-03b2-4b9a-99e2-64354b8edba8", "value": 2363249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674933342, "uuid": "d86738ea-3265-4d5f-93ee-3bca6086e160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933342, "uuid": "f2474125-e2b6-432e-bf26-ba22100ab2a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73098f86-9f5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674946781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946781, "uuid": "a27fcd2f-0ae7-4317-bd49-ac595af78546", "comment": "Malware payload (Mirai)", "value": "1ef6009e50c07485384aae94a3b01130", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946781, "uuid": "ded41ec2-f6e5-4fea-aa4f-a8929837b032", "comment": "Malware payload (Mirai)", "value": "a219a401f67f2dba72fc2d4095783ad81cf1cc03ec881e9af1a61406d8b03ce4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946781, "uuid": "863517a9-b215-436f-9ba9-bbdb01814bf9", "comment": "Malware payload (Mirai)", "value": "e73c15ced3403214d1587afc7525460c4e96bbca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674946781, "uuid": "2cfb8d6b-8f33-4a6e-8d41-a59951d0271d", "comment": "Malware payload (Mirai)", "value": "fa258e02a1b34cca02a97d6542a6b70a4dd0c5b020ab61d02abc956c6cce420f45afa38c0ca24acf20d0fb4a7ba4fb95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946781, "uuid": "415d3c47-af1f-43de-861b-8baf04523739", "value": "T17BE26CA1C93D6D58E26946B4B1348A381323C929EB9B5FF64646C765840FFCCB62C3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946781, "uuid": "80791954-770b-4d33-958a-6906b14fd705", "value": "768:Wax8+gddAmDDk8ACySoHQr60mCl+1vAf:Wargwgk8ARH50mCl2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674946781, "uuid": "d3df8e05-815b-4b78-943c-c8ed8b3ccd6f", "value": 33784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674946781, "uuid": "a98d5353-4396-496a-8cd1-6fcdd3e479bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674946781, "uuid": "113a0372-e8d2-4a1c-8743-a80c85cbad6c", "value": "1ef6009e50c07485384aae94a3b01130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bc5eb3-9f18-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674916322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916322, "uuid": "a772060c-6af2-44ab-b3ec-651b7111be87", "comment": "Malware payload (GCleaner)", "value": "eb5a629054891e425d37010437b0cfe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916322, "uuid": "139cbd69-6775-4f72-8353-ea728b65f699", "comment": "Malware payload (GCleaner)", "value": "a21d6b518c6d778c33960ca4e6cce32e2712ffc7bcac8ebb9b7ceef80ca631ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916322, "uuid": "839e398f-a335-4f1f-b4e2-3f03728e8831", "comment": "Malware payload (GCleaner)", "value": "ddca8d8bd536c2a0656ff18740d6f2e96f75f7ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916322, "uuid": "cff8b5b8-a748-4640-86a5-56c427d19754", "comment": "Malware payload (GCleaner)", "value": "3fef1936ac95693c1cf9b66e85af55b81f74da3e19ae7fdba380a4b5d8eca70f88ab119a03c6f90dcb526a3858f9d6a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916322, "uuid": "ba3f045d-8971-444d-868b-a6828881996e", "value": "T18BB5330BA482C13FD52187FB26754142CF72BD9E203C06D9399A369D19B18A06DB9BFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916322, "uuid": "02b124ee-25aa-4844-a2f5-07f0b7a8eeef", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916322, "uuid": "d27b16cc-3b2a-49e8-98a0-82c49852c40d", "value": "49152:okug+mN1LIwBELRzLnmncp7iExbsw+jT6NWqtvO6nR5hBiRVLCgv2MR:hug+mN1LqLRnmnc/50q9tbnvhBCJv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674916322, "uuid": "99e82def-f1a5-4c07-8b85-cba4f06ae007", "value": 2333936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674916322, "uuid": "2882c2df-4f6f-412c-935d-005bbe95f30c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916322, "uuid": "faecbc57-c9af-4518-abf1-0b75e601cf80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ef33ee-9ec4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674880271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674880271, "uuid": "98cbd9d2-fecc-44ed-92fe-c479333a447b", "comment": "Malware payload (GCleaner)", "value": "803d9a40f87b6c9505fff2254b8b479b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674880271, "uuid": "40c1b82d-aa5f-4589-8629-06f711052c9d", "comment": "Malware payload (GCleaner)", "value": "a507bf6f4f3ce30224821394e81efa4ec284f41b31084a56ee1163b0eca0ad85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674880271, "uuid": "1578547c-d040-492b-801d-66d21db7d262", "comment": "Malware payload (GCleaner)", "value": "6dba5f7a1cfa773cc43dab7d073a65acc1768952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674880271, "uuid": "33249ece-b687-4b5a-ae0d-4fd351b85403", "comment": "Malware payload (GCleaner)", "value": "61aeb665a3c8cbc6806e017656ead71de7d90b207cb004beda7db8c00ad6439c003fc7d85e58e2efd544e49e74509e5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674880271, "uuid": "b624e8d3-080a-4728-a27a-bd8aae256c8b", "value": "T1CEB5334A9681C2BDD256C1BA2A35C041AF62ECEF243D1551368E13DC1FB72323C7B2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674880271, "uuid": "2c6215c5-1eba-40e5-843f-aeba789529ba", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674880271, "uuid": "f7b06df0-b76e-4fb2-aa4d-d0a503a5be89", "value": "49152:okug+Epk4g4kaSquPHMP4fQzJ3CCFRBQCQJFREBs8ngsEJlSWLCgv2MR:hug+EO4g4jS9Pf+3CCFLQ9qusE3Tv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674880271, "uuid": "5ab8fd81-0fde-4642-9864-348c6d51de04", "value": 2368048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674880271, "uuid": "07a705f5-837b-4fdb-9ed3-47f2d49211a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674880271, "uuid": "15bbf3aa-bcef-4f25-901d-8a21ee9a3f24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f930cd-9f3a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674930754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674930754, "uuid": "7797a550-9a82-479c-b617-c7fd613ee037", "comment": "Malware payload", "value": "e259a7326623ed105885982f6712e4de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674930754, "uuid": "bea79485-0660-4a89-9c3e-fb7843adba93", "comment": "Malware payload", "value": "a5659a2555bf2bc4af3fb4862f36b56b6d76ebfa9d48e07499694d132ea14542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674930754, "uuid": "5416a43b-80e2-443b-b4f6-dbbb99b602da", "comment": "Malware payload", "value": "7c79073e49fe16cbf9ffbc6c05f5a12398ff55c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674930754, "uuid": "065caf5d-5b25-4740-8ad5-cb9bd6e9702c", "comment": "Malware payload", "value": "8d73d08e69057fd2299b2cc87d930340b60972a40bc2dac502a0c9d922f5626758677af93e5253b6706a999bf8e59bd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674930754, "uuid": "d19e0ac2-ba78-42a4-adaa-a0c99105eaf0", "value": "T179B5335B71D16979DC57CFF62EB488C0EFB1ACCB203E1A05620873ED2E626B15C72295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674930754, "uuid": "95dfe283-6499-46ca-b7b2-8fa32785400b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674930754, "uuid": "dce6d46c-4770-4e3b-ac2e-8195f68b5957", "value": "49152:okug+UrCjezsTd3gxdPSKfNemBKTwz9Qn2rtl7aSU8cf0mvIlleaZiLCgv2MR:hug+UrCjezshwDPDNemBwtCG+csDlgaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674930754, "uuid": "0a46e6ca-c21d-4dd1-bcc5-c75b1eb4e88e", "value": 2390922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674930754, "uuid": "f8586f0e-2cfb-484d-93a6-e194056b493f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674930754, "uuid": "753fb6c1-fba5-436d-ad38-012d4d8581b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870b4767-9f5d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674945956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674945956, "uuid": "6480ef90-e8c9-4ba9-a74f-cccb851e370d", "comment": "Malware payload", "value": "6bab002a1b89736378500df7cc2d54c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674945956, "uuid": "2f5b3208-847b-4693-b6a2-758af5001d44", "comment": "Malware payload", "value": "a5fbfce88bab3ed7a3dfe3b5e6d38b3ee9b5a38217a4ef6c027a2f1c900739a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674945956, "uuid": "e3953364-e3ec-4cd1-b2f4-b0711befeb70", "comment": "Malware payload", "value": "85b7239804526bf82501aaeebee72b3bca4c1099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674945956, "uuid": "2721b3de-6610-4615-badd-476cc8574622", "comment": "Malware payload", "value": "aff2c1f50a656c4de934f8b68a3f64def3c9891907d4eccec81dba02ebb2e09ae8a9ce0435855073d43e395b69a76d6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674945956, "uuid": "6fd9fb7c-1024-4399-be11-8315944daf59", "value": "T144B5334FF253C1FDC9EB87F72431624077EABD5B617E2092B64D27EE1A6122024E2658", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674945956, "uuid": "ac94e3ed-479e-4089-918e-de107207afcb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674945956, "uuid": "c58b41d7-3962-49aa-8421-f30d9d871c92", "value": "49152:okug+iETLtdvOT3pMWDVtlXkkXhW5hqhys4k+XNBjZLCgv2MR:hug+i+LXvapJZjk8Oqhys4hdF1v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674945956, "uuid": "20912e78-222d-4f8d-8eaa-940417132f3d", "value": 2331469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674945956, "uuid": "8199eef8-4ef1-4982-ab3f-e25f3a4047e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674945956, "uuid": "00cdd3d6-a76e-4c18-a5de-248d6fb5afb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f2bc35d-9f32-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1674927367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927367, "uuid": "59576b30-ebbf-44bc-a055-c0416f6d563b", "comment": "Malware payload (QuasarRAT)", "value": "4ea02a0dae627ff7275bbeb795d18745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927367, "uuid": "a6307ce0-c219-49a9-bcea-823c8a745e09", "comment": "Malware payload (QuasarRAT)", "value": "a7712a9a042158f130b574fa3dd247e0736e9b03f612acb48e4dddd482da879c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927367, "uuid": "0b00d2b3-a1d9-4090-9543-65bbbd1a9fc5", "comment": "Malware payload (QuasarRAT)", "value": "a2d94485518b08760e0a09c3128d246cd65a96dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927367, "uuid": "35aadea8-74f8-46d3-bfe6-286301b8d27b", "comment": "Malware payload (QuasarRAT)", "value": "e1433a99bd69d2a2f1618c732f3b4beb8f152115326b1b8522939d26c45f466ef9dc524faee6fd5007c8e26cd22030f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927367, "uuid": "2fd46c53-9f10-4216-bc60-6f356529dd94", "value": "T179652301BAD684B2E2B22A351A39F725A9BD7D201F15DB6EA7C40C6DC9301817734FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927367, "uuid": "1b4cb05f-ef19-4568-82ba-ad67f74b4743", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927367, "uuid": "8187e05d-ed10-4cbb-bbe7-8abb1b38969a", "value": "24576:jNA3R5drXG1pqsXe4TzcNqajQqkvwMP/0XbmXO+BhZJnk7Ah4DYJcN1ErPbjgU57:O5W64ncNqoQqrMP/0Xb+PQAhSYJcN1E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927367, "uuid": "8fd03d79-056f-497c-9d10-b5d35484b8a6", "value": 1515890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927367, "uuid": "188b78bb-b8d6-4092-9ff1-6932aa4d9b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927367, "uuid": "e7846f33-780a-4bb9-9303-4e6b82334ba0", "value": "4ea02a0dae627ff7275bbeb795d18745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1dfb83-9eff-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674905508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674905508, "uuid": "74d68a75-bc01-4c9d-91eb-4dc3f547a3a1", "comment": "Malware payload (RedLineStealer)", "value": "9a9f235f2bd8631c96a53eb79e6a3ea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674905508, "uuid": "e06f1c20-dbd4-435c-95e3-131df360d46e", "comment": "Malware payload (RedLineStealer)", "value": "a804c25cb0dbc46acf4dd7c79af08abd529cf75446e13605a7b1b5fd998b4188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674905508, "uuid": "5825951f-d562-43aa-bb98-ec147c7fab39", "comment": "Malware payload (RedLineStealer)", "value": "6fa1d2a77f6607c13bc36aeff662f4794e7a4a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674905508, "uuid": "3f9b99c2-caf7-4b06-aa87-c3ac8ef196cf", "comment": "Malware payload (RedLineStealer)", "value": "3883b2a41071ed100038263c3527a0bb6bf25027cbb30f1749aadaccc296f41675382be21a0ad5d5fb72f5b811ef9703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674905508, "uuid": "cefb1a7e-d413-4c8c-ae0e-cc84b5a9b60c", "value": "T16184BF0197A3BC60D925CE768E1AA6F4671EF8508E19772D1A38EB3F14F11F7C56222C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674905508, "uuid": "1859b640-b498-4960-b804-a442291be3a3", "value": "02e2a6cbf522a2149390d29c2ff67ff0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674905508, "uuid": "0893adfd-6f34-487d-9362-9a42f2965393", "value": "6144:9VkLmryL76r+eCRe3Z4tK7pdYtWnQbNmrr5qSwzIDM3gPP:9yi0AZ4AdDQwf5qSAeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674905508, "uuid": "8e134ed7-dc79-4771-8faa-18c36bc20668", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674905508, "uuid": "93010557-9819-46f7-b7a5-51ae7c585aae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674905508, "uuid": "c4215571-b7e9-4faa-82c5-d90516729450", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8e87b9-9f51-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674940622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674940622, "uuid": "cf1cf4f8-9b49-4526-96dc-dfc8993e9839", "comment": "Malware payload", "value": "4eb57c1ffa412b178f9a08b85f94d0d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674940622, "uuid": "59d4a0f4-fc54-4ecb-ae72-900ad0975a73", "comment": "Malware payload", "value": "a86a4de307dda2b155f27144bb290ec358b408b6e4b958ca3939a319de37b047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674940622, "uuid": "9b52e431-fad0-4530-85ae-cdcf74038a04", "comment": "Malware payload", "value": "0ef12761600cdac91cbaea7e43e27fb52e93ac47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674940622, "uuid": "29b5b694-20e8-4ac6-ac16-807e990faed1", "comment": "Malware payload", "value": "52e2fff00e7364562f5b1f693baba180ee0ff725992bbb66bdb573e8bee94fc527b3fbdca7023ea3b4ce1323bf6fd62c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674940622, "uuid": "930e1436-17f7-440b-b8cc-fdeeb7960c8c", "value": "T1B0763351FDD59876C59088B2AC8D7FC5F26BE3B14B32CA6727A4CD0D2E3A852D01A53C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674940622, "uuid": "8836421d-bf6b-4b0c-a6ef-8669945bbc66", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674940622, "uuid": "54a7b33b-d6ec-4437-89fa-f7947e5179a2", "value": "196608:91OJDQLK6GuAENeXzpHel/HpeHK4REytv+285:3OJSK6GDvXF+lBeHHRJd+24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674940622, "uuid": "b886ceda-4bf6-4281-836f-7a8140438286", "value": 7607751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674940622, "uuid": "cf58fb0c-b5ea-49c8-bc7a-5dc685a702b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674940622, "uuid": "9bc6edd9-1d6f-4ba9-9a03-af247e94fa8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256bf769-9ef8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674902413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674902413, "uuid": "5a5dfa35-c800-41a3-82c7-e94437776f35", "comment": "Malware payload", "value": "98bb8d5524e8bbfec33bb606d4f3da5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "iscsiexe", "colour": "#0D236D", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674902413, "uuid": "d4424aa1-255a-4101-a97b-5d2d34f4273f", "comment": "Malware payload", "value": "a8b39116b0eef242b654c8958d2864140ba393ccd5972bae786377ddabdb0b1c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "iscsiexe", "colour": "#0D236D", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674902413, "uuid": "5be24ccd-b97f-4a09-9cc9-ad9948153848", "comment": "Malware payload", "value": "fb9c435b44ae1f3e1acdbd1a4d210fdc8528b922", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "iscsiexe", "colour": "#0D236D", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674902413, "uuid": "443fd2a1-801e-42b3-9201-a8feb689ebb7", "comment": "Malware payload", "value": "359cb617191768307f2951b8fe7e088d27847a1af55f12ff8efffc55f119105fcc49600d41cd7e213d50edf8274351ae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "iscsiexe", "colour": "#0D236D", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674902413, "uuid": "ef18bed9-ab9f-4a25-b7fa-7ab18e0a030e", "value": "T13DF33C5D62FA61AAD4AAC278855B0216F7737436230067EF42D0C67C9F277D97A39F00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674902413, "uuid": "9bafdef1-e598-405d-8b6f-ba40ca4e70bc", "value": "050e11911d181e83a118320b526c9ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674902413, "uuid": "4ad59a96-1546-4040-b75b-8451455f44c6", "value": "3072:FYChMoIfCRP+9xk99u0A/DasgmfEI8YXtl1SXiIe:FYj1CRc2n3TsgmfbBXt4iI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674902413, "uuid": "30dc5360-8ab7-47d2-9333-23bcd5d66926", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674902413, "uuid": "e6b93a6a-b4a6-4b88-b58c-5a6ecc73ecf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674902413, "uuid": "c9ed14da-1283-455c-bf7d-95342a316b96", "value": "iscsiexe.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9817f9e-9f32-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674927626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927626, "uuid": "77ca4176-1ac2-49b3-a503-d6ae99e59f5a", "comment": "Malware payload", "value": "adbf34a17e486a4e325423ac6e8fecf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927626, "uuid": "8c3d2058-2e59-4d7b-a0a1-5fdbbe5c780f", "comment": "Malware payload", "value": "aa089445af4df7e50055b303e1476d26e6fa9307c84732f23be5b5fa129e2d36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927626, "uuid": "5583c309-80de-47d9-9533-87cba76bdcc9", "comment": "Malware payload", "value": "80210bdfd834397c5a2644aef1601a965af0b0f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927626, "uuid": "70bc2332-18ab-4c73-897d-99d43a2168ca", "comment": "Malware payload", "value": "95c7beebec81e51c1f44e49d7a0532df447493f62313dca4012ad0cdaf93deca08fb34eacfddf9edf77d9ef0335d0853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927626, "uuid": "40409888-0221-4b71-8a63-c6fc391c3ac2", "value": "T143442BC9BFB56B20C085F3324119402F0559CBB33DA2C69AB0F8166E1EC56EE2B57F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927626, "uuid": "ca3b6c26-afeb-41f9-9233-dc3a9d81d94f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927626, "uuid": "14bd8bbb-1f1a-4d5f-b839-3fe05f9e58d3", "value": "3072:9uz7istXgHWJy2b9gx+XCFsr1aUQo8x59nFW15jxxCHfgvEZrYkZ5rDdhMhsby3j:9ufistzFh8UQ/x7FO5+HlhYkf4kL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927626, "uuid": "66e85aab-eb95-43b7-8ddd-ac588458f8c6", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927626, "uuid": "06856f67-a4f1-4c04-8864-e05bba2e424a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927626, "uuid": "66f21d07-8d3a-4273-b0ce-a2679f31e430", "value": "FileProgramSetup_v13.8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6f3921-9f39-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1674930367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674930367, "uuid": "e27322f6-70db-4fd4-9636-335d4075f17c", "comment": "Malware payload (AsyncRAT)", "value": "dcd4b12969ee7792f0492694299f332c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674930367, "uuid": "6ac5759f-44e1-47d1-abbd-08027a42d629", "comment": "Malware payload (AsyncRAT)", "value": "aa8f46d0c78d12785e1d5bffcd3fac9fa985940762bc77676277a549852814ad", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674930367, "uuid": "8b70840c-9da4-4f26-a14b-e70461b006a8", "comment": "Malware payload (AsyncRAT)", "value": "8015d0e0a3fddf29ff546d173661c09dcfae6d13", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674930367, "uuid": "03c1b8ed-e192-412a-9e3f-cdc1bc6be51c", "comment": "Malware payload (AsyncRAT)", "value": "c9c9857843076b0e11c5ccf4967519e4596464cf56daa0ed262d0bc2b1ff426c139ad2be57f684dc982f85077c01a68f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674930367, "uuid": "47dffc9b-027c-484d-b151-db0f7fd18e5e", "value": "T16CB633180F667F790A78953C706E5A8D37668DC86E4CF8DA22D168C32F96F304D5FA18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674930367, "uuid": "88a6bb1e-54bb-4ff5-9764-0faee33149d4", "value": "49152:AxfOwlFvwC4Zlv8qCdwHrgTVfM0jfKYcv0XlCUyC5KowxztiVNgGj/fd5w0F9W5h:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674930367, "uuid": "3a67f57c-e177-43bb-9304-4f5ab9def12c", "value": 10790433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674930367, "uuid": "dad78c37-1943-4f56-aaee-90ecac4f1428", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674930367, "uuid": "00da9b51-2390-47bd-a464-c019f31a9d8c", "value": "Uni.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b762055-9f2d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674925267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674925267, "uuid": "f68998cd-141e-45ec-8960-94e6132c87cf", "comment": "Malware payload (RedLineStealer)", "value": "5f995edac40f6c47bd576c59ba61a6b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674925267, "uuid": "15f46aa8-5248-4068-9f13-5411283a6171", "comment": "Malware payload (RedLineStealer)", "value": "ab0f46d4c3d31af407db5cb41037054cf8ddc15b1d5bc2fc8d5f9ee17575e2a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674925267, "uuid": "da51d906-55d3-4da8-8a17-99f6780b616f", "comment": "Malware payload (RedLineStealer)", "value": "01a1324e7143712928b4c2d6fc044bdb0232e498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674925267, "uuid": "a553bd0d-1a3c-488c-87cc-b12c21563a08", "comment": "Malware payload (RedLineStealer)", "value": "7ce56624f628aea68ec7a59baf5e993737706e8206fdc4e0e66e3b878c4df45011a574225f7815628bd24b471b971b8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674925267, "uuid": "b5caf18f-ef09-44ff-b448-b53eaf4ae3f0", "value": "T119548D0257E2BC60D525CEB68E2AE6F4771EF450CE15732E1A989B3F28F1177C962318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674925267, "uuid": "09495e19-91a6-4d29-a31a-7fcff65ecd94", "value": "d191080c270d3118935d8b6a682d2ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674925267, "uuid": "645dee64-d357-4e32-ad86-6118ac0fed03", "value": "3072:85l2SLbV5APBir0TEbr2i42/yd1UufzZuC4nIyCSyxzID1C7hZWiwsiuNZ:WtLb4PQSyr2Y/0iufzgLqSwzIDM1nP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674925267, "uuid": "b08abbe1-0970-41a4-a240-abbe6a1f780c", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674925267, "uuid": "32c01730-92eb-4761-8309-e0f8de9fee02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674925267, "uuid": "7a10dbf6-9754-4c5a-849e-ada5fa58da9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a463c8d1-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674894895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894895, "uuid": "06e583b7-e7a6-4e80-bcfd-d812b598a20e", "comment": "Malware payload (Mirai)", "value": "49522db9a82e8192eca7c64382aa3006", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894895, "uuid": "b8417118-ab8a-45f4-abe1-6a13e7d37ce2", "comment": "Malware payload (Mirai)", "value": "afcc0ac459c9c4143eee1eff04351bb0981122474977921f3a5eaa62e3b1fb07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894895, "uuid": "d559aa20-9d5b-4f76-ba9b-8cd5890423b9", "comment": "Malware payload (Mirai)", "value": "11623fc711cd9308a3839eff2165fb5c41d3378f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894895, "uuid": "4019f230-576e-462e-8a8e-1ed0c3f62231", "comment": "Malware payload (Mirai)", "value": "2a8675ce35359e104de7df62a3c03463f18ffc402be03d5e1294b10335dcfaa4288f72a1ef94c34fc8e9bab3b2672142", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894895, "uuid": "802ac285-972b-4164-9a03-97d49b882e21", "value": "T17B4302379A826532C9717536BD2C928BB2953A31F0EB2118770B437936F1F843EAD971", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894895, "uuid": "3258e704-726e-45f5-9c55-eb66a26730a4", "value": "1536:6Bw4+QLTYvu5ivJjZ49vLTxA/ce10UlOd5:6woTYv5ZkG10mg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894895, "uuid": "1451e155-6f3a-4bd3-b753-fd4261356276", "value": 55392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894895, "uuid": "4fcdc4ba-e477-46bc-a862-9b47c6ff49e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894895, "uuid": "29c93e6c-c172-48b8-b626-de7f155bc973", "value": "49522db9a82e8192eca7c64382aa3006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8992835f-9ed5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674887549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674887549, "uuid": "c6fd14da-b686-4c2e-ac2f-8d57c51f083d", "comment": "Malware payload (RedLineStealer)", "value": "1e2db376fb7f1bc872b7e4f30498d126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674887549, "uuid": "991f5412-c55a-4cc9-a7e5-7f9bd65b71b2", "comment": "Malware payload (RedLineStealer)", "value": "b17e6b7ccf7f34f9f5530714d1a4835667d1f12b9fc1e0061d4b7b13b5694b06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674887549, "uuid": "05a067cd-f029-4d64-b13c-a61130b0f5dd", "comment": "Malware payload (RedLineStealer)", "value": "ec1578ca1245dc40bb2a5d9bda90ad96f6f5a7d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674887549, "uuid": "e148c17e-aa8c-4220-9203-db719835d34d", "comment": "Malware payload (RedLineStealer)", "value": "4a5fd759c9aefaf4c9da096375d97ee9686352503b3f74516ad56a5362ac36890c102c93a5802d06348a808472ec834d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674887549, "uuid": "6b2fc9b5-51ce-4760-9806-df81426f3837", "value": "T15384C00276E4BC59D963E6338E1EF7E8B51EF991DF5427DA123CAE0F19B01A1C262311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674887549, "uuid": "a6fda1cb-3cc1-4924-b8e0-c42777b9fe9d", "value": "4bc9925dd568c221c7d9868dfc769dfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674887549, "uuid": "be0aaa1a-686c-4f7c-85c2-9bb1b5a93ab4", "value": "6144:GL5ly3otpb7gUGBFrm5CX3fjXFl495cRJx9CEbnVn0J8dV:GtliqbUUGBFrm5Gf5l495eJLCWlvdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674887549, "uuid": "4f659b9b-252a-4d44-bfd8-5111c915692a", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674887549, "uuid": "4d4ab6e3-d808-45c3-89e0-59e11ff53f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674887549, "uuid": "14700181-658f-45ee-836a-552c24b66339", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475850ac-9f26-11ed-88f6-42010a9c006e", "comment": "Malware payload (Arechclient2)", "timestamp": 1674922227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674922227, "uuid": "53ba760b-257d-4519-8312-bb8744d1b90b", "comment": "Malware payload (Arechclient2)", "value": "0998a098dfc8eb0c1aa8c2065469c75d", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674922227, "uuid": "ddbda3e9-450f-4648-8f8f-cfe72c19d25c", "comment": "Malware payload (Arechclient2)", "value": "b3af0eb6e6ddce0f2e2993634d4b3edd86b3584c0c6f6000c5f94379f491698d", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674922227, "uuid": "9f63e6da-a735-48c3-a178-50c1e6236877", "comment": "Malware payload (Arechclient2)", "value": "bb0614af7e04c2de289bcce81b792a2438da8f9a", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674922227, "uuid": "a7377ff5-d33c-491a-878b-c68fe9cfa150", "comment": "Malware payload (Arechclient2)", "value": "f4dcc1ba6464c135b07ff8e8a376b6163aa413ed4995b37d80d2b38338619ad97c7603c6f7276671c441ea10c07c0388", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674922227, "uuid": "dd6d1763-acbf-42f4-8721-e04c1cd4dd2f", "value": "T155E502D8DC47C947E02751331A97B32BB1A41D4F4C26A78D835ADE83DC255BBB30BA86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674922227, "uuid": "22a66ce6-f891-48cf-bc4b-d8ef18e1d466", "value": "9c119c0b545be0f5d03be66ae71633b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674922227, "uuid": "4d179377-810d-4d79-810d-576ef8471baa", "value": "49152:9Zhfr5JxKAVgcJnxsgmqVsQVv/VuLin5zNwh1TKdVxx/XuKYE:jlrxKwjrfm9EvECzNMTQ9/eKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674922227, "uuid": "a628598e-78ce-4925-ba88-041861efa36b", "value": 3117320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674922227, "uuid": "13cc103b-3c46-4518-9755-d8841b4ba845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674922227, "uuid": "9cc3d390-2f4e-4eab-b49c-f65d4eb0771d", "value": "0998a098dfc8eb0c1aa8c2065469c75d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f35164-9ea1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674865017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674865017, "uuid": "dafdd5b2-1bbd-4c79-a05f-502c125c849a", "comment": "Malware payload (GCleaner)", "value": "8a03fd9716ad2ee89592845dc9162d85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674865017, "uuid": "2a797d0c-aec1-4cd3-b3e0-08cc7254afd3", "comment": "Malware payload (GCleaner)", "value": "b423b216eae47d644e1271bab3b7cf56cc2af2fa3653513a32415f7675117643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674865017, "uuid": "79bc3c31-14e6-4a93-b8f2-1fbbe90b655f", "comment": "Malware payload (GCleaner)", "value": "9522ff7c908739ad156c05566bd9b5c21d7103c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674865017, "uuid": "4ba72e61-028e-4861-ace5-35f074593bfd", "comment": "Malware payload (GCleaner)", "value": "1b51b560cee933aec090b48f84dfce5b9895932da5c0080daa86805fa3f46f2900537b2d2d88966e914e73d29e4b9cc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674865017, "uuid": "ec23fb88-9a85-4c56-bb2b-7c7b259ccc85", "value": "T18E952349B2C1D9BCD5168ABB3E309440DAB2BECB907C0112B61A57EE3DE51701A773DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674865017, "uuid": "8f9209f1-5cf0-4054-a1ac-0b6ddabde3ac", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674865017, "uuid": "e2ea4867-4e93-4282-9514-5c5487c88edc", "value": "49152:okug+RaruCSQWi1jQMO5s0YbBTTu1UcYShmpsWLCgv2MR:hug+RarRx1kMO5WbpuatqGv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674865017, "uuid": "cf313fec-df9a-4e0b-910e-7946125f7e0d", "value": 1967768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674865017, "uuid": "f804803c-e35e-4cbf-a00f-253c096f8dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674865017, "uuid": "9619ec75-03d7-4966-be17-73cb02e08c56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6429a0cf-9f31-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674927000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927000, "uuid": "891ac2a4-41cf-45c4-974d-860f23a23865", "comment": "Malware payload (AgentTesla)", "value": "c0dea1fe3b2a83debb570e86de4cf47d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927000, "uuid": "2f707fd3-b12f-4bdd-9858-4662441e20d8", "comment": "Malware payload (AgentTesla)", "value": "b49bd863e812bf7409860ecc583c23fda928d8f46103ed4f0869a5164a90eefd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927000, "uuid": "1ee509c3-f156-46a7-95da-85fb41a05fc3", "comment": "Malware payload (AgentTesla)", "value": "e010efec11d77d6bd4d5e579a62d8962d835c76a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927000, "uuid": "bfea56e7-fde4-42c1-92ee-43b0d491579b", "comment": "Malware payload (AgentTesla)", "value": "b1e26261eeaf4238df638f368f58889c80d8c1591ad079642f2174663b6416ee14005437646bac36d50986e37701dd10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927000, "uuid": "34e426a9-93db-4b12-8059-c7ac89bf33f8", "value": "T169E4234476F48725D9BE4BFE25B8140153B92E1D3686E75C0ED274EB1D32B920322FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927000, "uuid": "5c922b2d-fc76-43c5-b7b5-4cb445ba90e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927000, "uuid": "b133a81b-73eb-4819-bb3c-2d3375178523", "value": "12288:QaYo2iNbWgMlSYtz8L6gu6KgvAyihgLrRXGy8vsND03Z+Z1QhMI:QaYo1EfoLsYrOQrRXGLp+Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927000, "uuid": "ecf86fe6-b475-43a0-8104-4e856abb1d70", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927000, "uuid": "81b7289d-e954-4bae-bfd9-943b9532bf65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927000, "uuid": "7e171a6d-d9e5-4629-aa20-3d342ea4a4e6", "value": "dhl -0978676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0580d4b-9eaf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674871266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871266, "uuid": "6e2334e3-a685-45d6-8537-e7d14bca8798", "comment": "Malware payload", "value": "b679e6f3db4eafe2401a88dc0527952b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871266, "uuid": "657044b8-1c32-4f44-b56a-2efea5baeb40", "comment": "Malware payload", "value": "b51925620a012112911a3827ad1ad8bcf4c831e483050b2894fd153b7263323b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871266, "uuid": "a7b199b7-45ff-43bd-9b8a-0aa3c1f50706", "comment": "Malware payload", "value": "c0952eb2f73e881b632d040960244f452c817874", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871266, "uuid": "19718b20-820e-4763-a803-af1becf552ef", "comment": "Malware payload", "value": "3114be1d0a8c5ca575e4ef2c764de74f232bb84d6c02b7b62743d4290b20c9a23aac795820bfe49d3e80f9922b9a47fa", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871266, "uuid": "2fa756c3-0c01-48c9-8dd7-aa142e2a1dc4", "value": "T135A269A65FA44C61F19AF8B7470E600D19BEF03620D215D4BFCDD7B4763A14A0B6B2B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871266, "uuid": "094f0919-6324-4a21-89ec-2b167edce7cc", "value": "384:YC1qZi31TyFdAUF/T70npAUFNKnNrcNH+aRehCwZWWhtFn9sGbC1QhMXzbM8CrrS:B1q431OvAUF7EAUINrcj47ZC9qhoCrrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674871266, "uuid": "d8a6ae46-e592-4d71-a769-c2e4eea86213", "value": 22674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674871266, "uuid": "6498acd5-d9d3-40f4-b45c-f959c84d2976", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871266, "uuid": "89459565-f686-4cfa-b4db-06a6cc7b2f22", "value": "b51925620a012112911a3827ad1ad8bcf4c831e483050b2894fd153b7263323b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9d054b-9eee-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674898234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674898234, "uuid": "8672c5b5-a2c2-42f7-b150-4f5b5af720e7", "comment": "Malware payload (RedLineStealer)", "value": "56a003f1940560fb3b9374e748754649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674898234, "uuid": "edfdab1d-7151-481d-97e9-4beb8e9b2674", "comment": "Malware payload (RedLineStealer)", "value": "b5347cf715e4d2437a3d9b52fe2aaf23d493f76f8c77afb032373937c1d9fe00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674898234, "uuid": "1549ab63-4e5c-4ee3-9201-1f88ca11352b", "comment": "Malware payload (RedLineStealer)", "value": "bb2b204022499935ba5c1439989fc525e90fa348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674898234, "uuid": "90c37b52-9780-4bf4-a6f4-8cfe0262b6b9", "comment": "Malware payload (RedLineStealer)", "value": "c35fb8aa23565e425b15b400deeb9852802559b3276b9e2ee1420b4850344cb1c9110d9dbb9d4b8641c9d3bf456997f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674898234, "uuid": "7aea76b7-cdc9-45c5-bde9-a79310b12482", "value": "T13384C002D7E2BC68D925CE769E2EA6F4772EF4508E14732D1A08AB3F15F11B7C56221C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674898234, "uuid": "eb1de9c4-6e4e-4429-94e9-16c0ccc6faee", "value": "02e2a6cbf522a2149390d29c2ff67ff0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674898234, "uuid": "973d5438-ac90-4d5f-ba44-a50e11107abd", "value": "6144:/TLnkNCUHG1cVCCwZ9vRSxcjl3rrutnnqSwzIDMAP:/TrKDURSxcjBraFnqSAeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674898234, "uuid": "e8a2bfb0-a0b9-4451-a7c1-8db0d7fec2f8", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674898234, "uuid": "a075c866-451c-4add-b604-d08bcc4e315c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674898234, "uuid": "44efbe58-943a-46f8-ace7-07d923ed396c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a7406a-9eb3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674872724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872724, "uuid": "32d622e7-4565-4d34-9003-ce84eb0616b2", "comment": "Malware payload", "value": "56f4e7c1b9082a783b03682acc86c5c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872724, "uuid": "615bc34b-0788-41c7-aacc-97809c2960bd", "comment": "Malware payload", "value": "b60f70e958d9d84340650c78e3160745b289f29e6504506d21b398c4edcc0d47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872724, "uuid": "ae4da10c-6780-4149-924e-2c4cf2db6246", "comment": "Malware payload", "value": "634cbd1b8592813a5c13dafd573f7ee3ddacc969", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872724, "uuid": "7d19e014-5ca4-44b7-ba69-f8f6a50965bb", "comment": "Malware payload", "value": "da8fb04d270963fcf384ba8d6066023663508bf05d338dbe0796cecb65fe82d846b1de3e3f2de34131d62dae27c6cae8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872724, "uuid": "17ffc5e8-3f60-46f3-8b18-103177b20304", "value": "T16CA3396C358D8D24D1BF8E79A89125A94AFF91133A03F34B0DA7C4921E127E1CE57CB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872724, "uuid": "6c9adca0-ea33-4ea9-ae77-d484e7101107", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872724, "uuid": "01c39a8d-e407-440a-9cf6-0390fffcd734", "value": "3072:iCmYpDxsK33bacZYHa0Z6M5Hyy3h7fAbL5b7To4O5QaLobyJY6mz:IOy3h7IbRo4O5Q9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674872724, "uuid": "49640b5c-d45f-431e-972e-c678823c0bdb", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674872724, "uuid": "e8b8b39f-a982-486f-9e9d-82ab9c00b0c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872724, "uuid": "05e776dd-7dbb-494a-b66d-d7b45ec546ce", "value": "56f4e7c1b9082a783b03682acc86c5c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e691470b-9f20-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1674919917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674919917, "uuid": "dec6c850-981b-452a-8db6-78fac23c6be2", "comment": "Malware payload (Fabookie)", "value": "d471887769a6d012118d8cd3be559ffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674919917, "uuid": "c203090a-5cda-465b-9109-e86348ab23f6", "comment": "Malware payload (Fabookie)", "value": "b6ccb79b56c67aaa14bae99de29d25fcc220a041161c7e1985dd0cf8707220bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674919917, "uuid": "ac30b5f1-6d0e-457b-834a-7ccd0c661b94", "comment": "Malware payload (Fabookie)", "value": "be0e03e85e211a18da3e04236618e65e2711feb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674919917, "uuid": "17971556-ef8f-41f8-8d32-fcdd77ccdc24", "comment": "Malware payload (Fabookie)", "value": "7d5288656b133cc9a1bf07e2776d15746a824ef5ecf76c373af9c0646d5284fab527d33ac1fa32b1b7c54d6cadeef023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674919917, "uuid": "dea1623e-2016-4f93-9ee0-b46bcd3a4e80", "value": "T1121633DB79E2A060DCA855FE39A1498F4B395CE341A1179604FBF763CBAAF0843F6450", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674919917, "uuid": "0d80dea8-cfd7-42b7-92a6-959c8289da3f", "value": "7d439cf7cce4ada1cedf21e9354e3639", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674919917, "uuid": "a4696ae9-e497-484f-a4eb-69fc93002c53", "value": "98304:maYigx63mX23GcvTRF1poCBIIUk6NCuBrwC4QWIyVQ:1YigxhG3rNFPooIIUk6NCux74QWtVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674919917, "uuid": "67e547a6-3f33-44da-9c8c-075d0f2e7437", "value": 4273168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674919917, "uuid": "8d71d0b1-0b1e-400b-83c8-e7a56124d97c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674919917, "uuid": "55327d70-9fb7-4d9e-a432-afe03c95ec3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d510b11-9f30-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674926559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926559, "uuid": "78c9861f-a127-486f-a71f-7069fa4ac800", "comment": "Malware payload", "value": "f4f8d570644df1967ca104159efec28a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926559, "uuid": "e96f8f8b-e218-4503-b9c8-325152111c27", "comment": "Malware payload", "value": "b72f222928dada0a651782c863ea29cd26241aa31ceda87bdad68ea7c57d04c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926559, "uuid": "3597065d-4e26-47e6-b793-3b892e6995fa", "comment": "Malware payload", "value": "053de3dc892d765c631ef8639ac2f8a126e3bdcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926559, "uuid": "d14009f6-2710-4e61-ba84-ef5446c1e816", "comment": "Malware payload", "value": "5843e3cc1df6e1106012bc42d7d30a4a3dac279b44a35a09134cbf05621de3cd8bb095af7332a0c9107956426c5ccbad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926559, "uuid": "54566fa6-16a6-4f98-a6c5-77802203b1a3", "value": "T140A533079EED5532D0A1A77488F9C2C316717CE5E67C8B13B7C464AE0AB36806671B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926559, "uuid": "e18ffb28-0f01-4950-8e6f-b8e6ff1c40e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926559, "uuid": "37d199e0-6536-4f34-98d7-dd5368399d53", "value": "49152:ZU+UpzEOI24PFlUE/17GYwM7Op9SNeql3WegBSSXOI6m1zpoRuc4:PyEOIlFeE/1XDlGegM3ooRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674926559, "uuid": "3f5c5fdb-4c84-46b4-a4cc-4248d41a21e8", "value": 2203648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674926559, "uuid": "941e3662-a233-4752-8408-2761b0486d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926559, "uuid": "1d1c758d-0a68-40ca-aed3-40de9ce12e5a", "value": "f4f8d570644df1967ca104159efec28a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c00f3ff-9eed-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674897753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674897753, "uuid": "39d2b770-182b-4a7d-91b6-a687302f012b", "comment": "Malware payload (AgentTesla)", "value": "9a47118c793b53d6d9bea38762af53df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674897753, "uuid": "52f35c69-da87-43bf-99fe-70286024402e", "comment": "Malware payload (AgentTesla)", "value": "b74d8b131139455fabd0ecf5fb93b9ea37d48dc86d20d66baca46ac8fbe6a5f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674897753, "uuid": "8a92d178-de65-46fc-8f40-7c953d691190", "comment": "Malware payload (AgentTesla)", "value": "605b3bfe85119615ca5167bfd8a16acc470c3375", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674897753, "uuid": "250d24fe-4579-490c-9ec5-3342db9be7a3", "comment": "Malware payload (AgentTesla)", "value": "7760358fe5de279c961d91e4587ae6bee612a15c1d80b72a492d6c1872a4cf5a709b4de2d1077142a8ff5534d95be2dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674897753, "uuid": "06d3f769-15ac-4006-bf50-b7deff64a713", "value": "T1FAE42300ABBD53A6D45D1A388C986A1457F73D6534F7C32E7C85BACE8972FD2004AE4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674897753, "uuid": "2daeebb6-5a69-44a9-96ab-f9cea4c45e9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674897753, "uuid": "06d5c4bc-7a03-49a3-933d-61eed2dccaf2", "value": "12288:z4VBFjCfuXdm4S4w1gzs4xwExHQCOc6YdeWbTYvT4FEJvNY/YP4naQmMI:iXYwOExqk7b8vTIqaQP4nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674897753, "uuid": "800e9e70-6ebf-4f05-ac6f-2e910b505358", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674897753, "uuid": "bc2c4ee4-b965-4941-a186-36061be3b30a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674897753, "uuid": "d15c9a20-9b55-450b-ae72-f07444979457", "value": "TT Swift ($ 23,506.50) 19.01.23_jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1de389-9f1e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674918696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674918696, "uuid": "6146f162-c86c-4691-955b-7067b81644a0", "comment": "Malware payload", "value": "f6944276589e37d80d4f8520621a71dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674918696, "uuid": "25ed117a-1ce3-4c72-a40e-3cd156112361", "comment": "Malware payload", "value": "bc2c9cef7fbb48e09009a6b5ea5aa47995ed3a59a467e88a5775bd97750e63af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674918696, "uuid": "45b69925-b73c-4c0f-b9d5-d063e24ee80c", "comment": "Malware payload", "value": "6ded803955269670c79abd8cc150f7ddd5816257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674918696, "uuid": "e168aa09-e796-4fb3-b70e-c92032abda32", "comment": "Malware payload", "value": "f83cfcba9c64e216c801eba0dac65613d2ea43b719e2d2a72a5862faff12968fadae548d6530aebec58daf205b649f6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674918696, "uuid": "4ba48f3c-a1d3-4757-a8fc-b933e238ff29", "value": "T1CE76332235D4DD7EE7021231C8A672ECB6E59A751F02C8B3C7CA594D1BBC98BC50AB4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674918696, "uuid": "9038c51a-7b11-4285-9ae3-3dec6f7aaf9a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674918696, "uuid": "e79165b3-5e88-473b-808c-cadcf59d0e84", "value": "196608:91OCzwRqQAsaUEQaNffhyH6I9crny8nt0GFDspqYO6Lc:3OxQHTZfhE9crnnn6GuI3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674918696, "uuid": "c31cac18-f98d-4d0e-a2f5-d5d8f43fcff1", "value": 7621055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674918696, "uuid": "c0fddfc3-b849-4d86-b6c9-b75ce117de84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674918696, "uuid": "547c2fc3-4ca9-4e64-94c0-d6faf201f61b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee428e7a-9f58-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674943982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943982, "uuid": "2020ad9d-afd6-49e3-96aa-ea59fead321f", "comment": "Malware payload (Mirai)", "value": "e80aa091fa2e07da90ab5b2d044b58f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943982, "uuid": "f72e6c6e-83b3-48fd-8f02-fb2123f6367d", "comment": "Malware payload (Mirai)", "value": "bc5b9d0df00dd90a5e5f736b999fe1c9e851eddf16e6a7db9df177b586520caf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943982, "uuid": "4b5e2a26-61b7-408f-8357-9a43ff4fc86c", "comment": "Malware payload (Mirai)", "value": "f1126a7e96b96a4b3725bad3c87e8243110a5797", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943982, "uuid": "b221f1c8-50eb-42b0-bb70-72546efed890", "comment": "Malware payload (Mirai)", "value": "96235662223585890c285c3f83cfd2238ff9bd80adf8739007c16493a418399b2eb7f3fb042ec1c7d3badcf9134b4613", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943982, "uuid": "826e0728-b395-4925-8420-12cb630874fc", "value": "T17D23F75BB9919F01D8D561B6FE1E118D33130768E3EFB3239D246F206B8786B0E7A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943982, "uuid": "7b5067ad-5b3a-4745-b749-344c7129915c", "value": "768:synEvRCFECypQFIeZMEpDLRCRuJlreQTlUEsTQUAfime53+cIpciiIMIWeum5nX3:synE8Fg6/ZnXTlUEsTQpz0IPiIMINumZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674943982, "uuid": "76221430-e33c-4ecc-aff2-82c6e1ae21ae", "value": 46688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674943982, "uuid": "e128dda9-811c-4ea7-a6de-5c30c5cf8f3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943982, "uuid": "67452e98-7245-473a-8507-873d1a14608f", "value": "e80aa091fa2e07da90ab5b2d044b58f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170eeab0-9f45-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674935460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935460, "uuid": "d25d1b76-f34b-47fd-af54-d412437277a8", "comment": "Malware payload", "value": "bc9d204cbebf780460f8f4fb6eab601e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935460, "uuid": "31ea66d0-5d0f-4175-aee8-d371979a08c2", "comment": "Malware payload", "value": "bc90ef0b5390fcb99bff74718311da95f74361acfa8ff6499caa260fc39e5956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935460, "uuid": "864e4cab-d6f7-4bca-8ddb-45ec1c5eb49a", "comment": "Malware payload", "value": "8581d57a42caf6540991b355fefe5ef119808bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674935460, "uuid": "4df86d12-3dba-4b46-bd1f-53d3299b7f7f", "comment": "Malware payload", "value": "3ccd802bb31e508f5c0838c364226dbd3d3b08918e46ffa87f2f2c7dbc67ed5f8736ca2dfaa17ba7b698795aa8d6021e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935460, "uuid": "45eef6d7-8c43-48b9-ade8-ca5381cecfb5", "value": "T17A14BFEAD1533798C4FB9633A273A63A55F11802C4298D37DA4B29D4C94B385C7F8A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935460, "uuid": "53d9831f-5fe3-49a5-8032-a2dd8066747c", "value": "bea2cf47857df51fca0af145cfe53872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935460, "uuid": "cd9e404c-2342-42f8-b646-fbface12ff86", "value": "3072:crxxmJc6QRyeZ9iQN21mgHboUNDENEbPeJ:crrZRq4A3HnNIabm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674935460, "uuid": "3fd1328b-098c-4222-81c8-1b6a71c573e1", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674935460, "uuid": "cc9b4fe1-151b-4d5e-8c86-3850207fbf8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674935460, "uuid": "2a15ea7e-303f-4cb9-88ab-ec667e6eeeb5", "value": "FINDGF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b731fb-9ed9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674889319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674889319, "uuid": "06b4296c-b8db-41ac-9a66-ecad8013d177", "comment": "Malware payload (GCleaner)", "value": "69937c90a4ab9ba3b48f69cc7bd17f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674889319, "uuid": "a8b3a75d-4537-42f6-ac75-541f5350f728", "comment": "Malware payload (GCleaner)", "value": "bd0fc9ba290dd6856dd947ab26f904a7b01a98b434a1d437d272d03ffa50e0d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674889319, "uuid": "04fccd03-14e1-4cd7-8d61-d424440f94bf", "comment": "Malware payload (GCleaner)", "value": "80811c1851743cf68c3fd972c6df094f701754c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674889319, "uuid": "21ac64fb-aac8-49c8-b36d-6e04c98340f2", "comment": "Malware payload (GCleaner)", "value": "2f049820a49ffc7c8dc0ae68f971e3e0c5dad94ee391f6d9aa88b3e61f4935c670a2ad17c82a664c782c3b6e2d2116d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674889319, "uuid": "f455702a-5489-48a1-87ee-59b7a39de8b1", "value": "T11AB5334AA48596FDC532CAB63AB5B240DB35EEC7B43D101A371A139D1EBAA3018F17D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674889319, "uuid": "9b2396e0-d8ad-4d5a-b44d-605fb755d297", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674889319, "uuid": "7e4b2c9a-bf47-46e4-90ef-4f1e3188e6cc", "value": "49152:okug+3qAR9ZjwyU/I+QIXIhHPzWj8CRgg+arHS0e1MiLCgv2MR:hug+/ZjXU8I4Zuyg+ary0gv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674889319, "uuid": "f6f08c0e-8603-4f55-91a5-d79b70ef7666", "value": 2359318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674889319, "uuid": "9cedf17d-b230-4eae-b541-7dfdebe2a6eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674889319, "uuid": "2d4f513b-8e50-4326-b963-84635a95848e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2746765f-9ee3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674893397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674893397, "uuid": "9e460c53-2e05-4449-94d2-b38e227dbb64", "comment": "Malware payload", "value": "8325fc4d375dc05ee25693e10380c22a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674893397, "uuid": "1b831abe-fe7f-4f0b-8641-ca2829e5c7d2", "comment": "Malware payload", "value": "bd6b2385d92e1d77d23f21db18aabea4a3817231d2d311e01e08bfdfa6007707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674893397, "uuid": "04e4ede4-cfa9-48e6-8244-f2abc4b1c9e3", "comment": "Malware payload", "value": "3f507aad167896df7531f3e85fba00f04e726678", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674893397, "uuid": "382222e9-b114-4c4a-a1ad-ba194cc6feba", "comment": "Malware payload", "value": "15d21038932e44c71075c82ca5d23e3cbde946d3d1ea50c465125cc4348f61ba6f3c1733c8fb0a78bf7979bc3295d3a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674893397, "uuid": "b5546791-cfb6-4f02-8ef7-1666fad7e841", "value": "T1D97633653EF684F5D9ED55734CA46FEC5264C3A22F22E133EB191E8D732420500AE6AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674893397, "uuid": "aca345ff-71a4-4573-9ead-40d7d92185c9", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674893397, "uuid": "92026019-9537-4db1-9e48-1e3a8edb35bb", "value": "98304:91OGq/FtSkVhcO3tVTpA1F1UZqyPfCSnoN2HyQlKL7C+l/dzSPhXWJcL6doiuSXv:91OFtS8hpcUq8ndrlKCQ/5jFuSnE13T6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674893397, "uuid": "a3e95ac4-b74b-4103-8cd9-e843036ae9da", "value": 7617492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674893397, "uuid": "167a16b0-e20f-4661-bb45-c6dbd7af20b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674893397, "uuid": "77e2431f-ae3d-49d9-8b60-0cefb7bd448a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00b08bb-9f34-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674928389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674928389, "uuid": "2c6db68a-78fd-46f3-b08f-54cc3f19e042", "comment": "Malware payload (Formbook)", "value": "49afa083ce4079046caa0b41a0466ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674928389, "uuid": "24e1d239-7702-4a9e-9932-77f6273b5ab7", "comment": "Malware payload (Formbook)", "value": "be9126ac1328674d4d5b23d22abd098db84fa2d9bec29f65da9993b69a52b9ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674928389, "uuid": "d390559b-b99d-4abe-9501-24851f31840e", "comment": "Malware payload (Formbook)", "value": "35bc46078eec39547653c8d9863bea07e81d5147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674928389, "uuid": "99d47595-3801-4a08-95dc-6d008ea228b7", "comment": "Malware payload (Formbook)", "value": "c367f37f0134b211b1e82af53c583cf4e8dccd3e344eca93fb2f65a1a69d3831c53a34e19bda08c962a8dc7180037890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674928389, "uuid": "e3d824a2-9e2a-4b37-a19f-f1168e15155e", "value": "T1CBF4BEBC7690AD8FC4178FBB85042C00AA60F4735B43F393A44B15A99E1E7DE8E556E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674928389, "uuid": "72d7ca34-fa36-4bfa-9217-eaad35841122", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674928389, "uuid": "dbadd347-9340-41b7-9a25-dc0dc1f7e744", "value": "12288:INvNSbQOhUk65oBGON/5zm9f9ksnJUH0ZOBq/8sQUQTmeLXp8brrftkQY:I+0OyogOB569f97FWqtQUBC58g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674928389, "uuid": "49857eac-d960-413b-b921-0e75a0e8ffdf", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674928389, "uuid": "31f1fca4-0ac2-4bfc-b990-234b20c1649e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674928389, "uuid": "cf08ce64-9226-4816-8dba-7b555417d9c0", "value": "Bank Copy pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f50108f-9ea9-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674868446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674868446, "uuid": "5fa0a72a-b937-4eb2-a3ed-dd9d34342d53", "comment": "Malware payload (ArkeiStealer)", "value": "04f7ede77002ee9767d96ceb414e1fc1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674868446, "uuid": "463f5930-997f-4deb-9440-b86f900daf90", "comment": "Malware payload (ArkeiStealer)", "value": "bf57038bd501934801f4ef8af2ba4a01d0aac484c550574b43e5eb94e7ee0597", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674868446, "uuid": "f2f5d81c-b4a2-4e23-84a9-b0dd9e79cf29", "comment": "Malware payload (ArkeiStealer)", "value": "b024d3a2824699fb34e91c0b5f7ecc1a02160899", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674868446, "uuid": "7e43941e-c30a-41ea-aac3-c4d63b293e4c", "comment": "Malware payload (ArkeiStealer)", "value": "38886c8077aa60fc5f2131bb15cd19f97f796d76a9dbaae8185e69b235ad8a70ac2936efa1a99e9ff204043727f25479", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674868446, "uuid": "17730e42-c0c1-42ba-aad3-252fbbb09f54", "value": "T1C954AF0262E4BC45D967E7338E1EFFE8B51EF9C1DE6563DA12086A0F19B15A1C16330B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674868446, "uuid": "fb15dfd6-70cf-426f-aae8-c6bd601cc8e5", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674868446, "uuid": "bdbce588-c663-4892-bdef-dafbba8292ea", "value": "3072:dCWQLntv5UbXS3MKx0zhWqueUFsWu8SVDQlQsB8BZ3F1go9ClANbFrZVngc6I8lT:CLntSbC3MZ1aADzs65x9CEbnVnmW8dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674868446, "uuid": "aecef988-4c74-4c45-8c16-25c62a006303", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674868446, "uuid": "1f8ac026-c27c-4919-bcd4-d150bfc1f74c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674868446, "uuid": "ed528d3d-93a0-453a-8681-f3c9db0cd721", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595cc911-9f37-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674929558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674929558, "uuid": "46af31b2-dadc-4b75-bd63-28a81dfb8651", "comment": "Malware payload", "value": "7cf00d1355c05c9f4cee02aa732e2cd8", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674929558, "uuid": "cdf8b7e4-31dd-42a2-8dc8-1d643a274f06", "comment": "Malware payload", "value": "bf921e4dc37f21c3e48b824b4349246804ad16cac3b12cc39d04fda9797a46f3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674929558, "uuid": "ae501025-3733-4f24-9612-7bbf9b478da9", "comment": "Malware payload", "value": "a6eddfb75a3fddb54e9f7f6d0aa982aa59d7bb33", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674929558, "uuid": "f6453d77-ec99-45aa-b1e5-bd87c65c8ac3", "comment": "Malware payload", "value": "f243ef68edc13ecb58331d0c11cd99d824895cfea142bbc324876cda4cd36521ccbd384ed049201ccfdc96f910110524", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674929558, "uuid": "b75cd197-f473-4330-ae81-756e77ac50a3", "value": "T13314DF627B83C432C99E4173D929CEE46EBBB8314575D84B37A40BAE4F703D0576638A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674929558, "uuid": "ed9fce46-0fc8-4ebf-af55-33f5a80bfd8d", "value": "e72f606dd0982c47d40a1b2d2827cdc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674929558, "uuid": "7710c1af-5301-4121-a740-2dfb665bbc61", "value": "3072:+BN4X3dEMwhM6L16WMSE5TCFxtPn9zfsVCVrTmAG1TRxRC68c:SmapL13MS24Z+VWnmjF5bX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674929558, "uuid": "3f366364-f623-4608-a7f6-2357ccace77c", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674929558, "uuid": "ae37c8bb-63f4-4c72-878e-187918d6224c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674929558, "uuid": "c5fc086b-b030-4889-8149-e5a73d5acdf3", "value": "application.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de884603-9ef2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674900147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674900147, "uuid": "1129135c-dab6-4993-8787-1596ee211082", "comment": "Malware payload (GCleaner)", "value": "ed50ea42e6998ecf8832c9f489876906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674900147, "uuid": "51a1283b-b3f2-4d12-8b61-79b3bf915747", "comment": "Malware payload (GCleaner)", "value": "c104bb0a9e54f626cc7e15978fedfb31c8dded65014fb0cbdd07e02cf122f15c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674900147, "uuid": "2ab7725b-ee92-4596-81e1-7cdcb72ca7b2", "comment": "Malware payload (GCleaner)", "value": "7d8341d4c9459763b6afb013cd1350d79720af15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674900147, "uuid": "7c3c2bdd-1244-461c-85bb-680fe003dbd6", "comment": "Malware payload (GCleaner)", "value": "e27e602e7c1da7cfc75347a0551c737cf4197f4f6388f0fd84c84ea8a1a6c20fb3596785077bb1bacdf0d3fc85a4a73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674900147, "uuid": "25ea2b30-d535-49e6-9f34-6e5fa4caba0d", "value": "T111B533ABA6D249F9D4A187F16634D5009B337F4B283D124637AD53AC6D2573020BB3FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674900147, "uuid": "99aa3630-7eac-4f58-8621-d80f72c61c72", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674900147, "uuid": "5ef256b1-52ed-427a-8f10-6606b606f0db", "value": "49152:okug+3Sz1KcsHzHdJubkjMqLnfLToDhLOvLCgv2MR:hug+3+oHz9Ubh0fLTBv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674900147, "uuid": "237b8614-c916-4dae-88a1-2cc96aeda7e8", "value": 2360863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674900147, "uuid": "a1e299a6-8d08-4614-88fe-1e3078c1769c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674900147, "uuid": "afd514c9-fe89-4281-9738-dd32e5c639fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9d84b5-9ebc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674876843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674876843, "uuid": "75519310-4e9f-4c5d-8d4e-57b7e8b1cf9c", "comment": "Malware payload", "value": "91112c5e4833d368185bd30cd96061e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674876843, "uuid": "f1fe4262-9079-48c1-bc1e-4a997f487db4", "comment": "Malware payload", "value": "c497bea606ca16a6576e657480b4b1fad672950a7a9c1eb6d70649116e091790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674876843, "uuid": "1a4c7d01-0eca-44e4-be7d-9161b8db11e7", "comment": "Malware payload", "value": "4f003af86a504ca935f4181ec32ac3d4515b8dff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674876843, "uuid": "26dfd12e-2799-4d16-9cc1-8aab97a0a620", "comment": "Malware payload", "value": "defa7c991ebe45616824aa3ffb074131c602ebc41d1847208abf52101994220f2b9b738363b7127095a33d610e99b9d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674876843, "uuid": "b901787a-0c74-4729-852c-dea816c6ee96", "value": "T1F7763321B6D4CDBDC6BE023A7481E7877138D1920C21C39727995F3A7E7C2C684F66A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674876843, "uuid": "d4e4aea0-a923-4a5f-af18-802179f8cfcd", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674876843, "uuid": "50c0f163-c2e4-4086-af7d-904a01671833", "value": "98304:91O7Zr+CJ2fn/GUtnj7gIbJVUed075on/oOtFISAgPXjiPa3UatC6Qgdrr1odHhx:91Otr5K5cI15jFIPa3hQ2r1GTREGa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674876843, "uuid": "a6c4e4a7-5e8a-400d-b29a-fdb0a5f5d037", "value": 7647480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674876843, "uuid": "101103bd-1508-458d-b067-185f18304283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674876843, "uuid": "9bac9ecc-c424-415a-b750-ff090cddba39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4548b7-9f05-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1674908040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908040, "uuid": "5f4bbd18-b6a0-465a-8af5-695cfaa3464a", "comment": "Malware payload (TeamBot)", "value": "7e09e121cd6142020c43a310c6af731e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908040, "uuid": "2ebaae5d-fd19-48b2-b71e-6d8b439aa87a", "comment": "Malware payload (TeamBot)", "value": "c53438ccb1e8344aa19ec131ab7330f4896c45fc03504c058bd0f4f917d134f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908040, "uuid": "1e9616d4-4209-4b4d-9510-65a5d7e01d02", "comment": "Malware payload (TeamBot)", "value": "b80f6fc8751567df1eeb4ad5d42bba972e296672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908040, "uuid": "dd8562fa-6633-43e9-ae0b-c42cf3c4e5aa", "comment": "Malware payload (TeamBot)", "value": "fc4a2bf3e869e97be72a7d30d7ba01ef6b22745a16cc9e284981c2503e72e741b9a849e2c3940fa1f86c662ce20007fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908040, "uuid": "c9fc8def-ad63-49df-847f-069c77b1499f", "value": "T1F5548D01ABD2BC70D926CA768E2EE6F4771EF4408D55776D1A049B3F18F11B7C9A222C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908040, "uuid": "8e7efec0-36e4-4b72-99ca-0a7be2de609a", "value": "02e2a6cbf522a2149390d29c2ff67ff0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908040, "uuid": "23c403ca-5238-43e2-911a-4b957ba4d5ba", "value": "6144:kxLVIuj7QiqOAMH56bBZdxKcqSwzIDMGJP:kxhLIOAMH56bBVFqSAeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674908040, "uuid": "4a145acc-966e-4a14-8552-157ae967ce09", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674908040, "uuid": "a036bdf0-e111-45bb-834a-b5c0eb212fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908040, "uuid": "95a71904-1c34-4d7c-8566-105714ca25ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349dec6b-9ef1-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1674899432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674899432, "uuid": "9704a12f-d456-4093-9535-499cffda94ba", "comment": "Malware payload (DCRat)", "value": "ae23ccbd31f96a4051015724d155f40e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674899432, "uuid": "12fc21a6-2430-4829-a9c6-956c7b215831", "comment": "Malware payload (DCRat)", "value": "c68a49ebcf23549fd40879c7e7d95737effd1c3d704689dbe1bba4959dcbbd69", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674899432, "uuid": "4f278d87-d513-47ec-b2eb-ee92fd4ab7b4", "comment": "Malware payload (DCRat)", "value": "799439e532b69c36f2e1fb5346ae7f93510c9594", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674899432, "uuid": "00fd2170-1615-4bd6-b327-ea3e34fdefe7", "comment": "Malware payload (DCRat)", "value": "4f1c6aeadf63074f23d2e06271ce07652ce2aabf6bb1ed1a1136c9050b112af9c196c3e3bb91d4d3e743d364d4b85478", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674899432, "uuid": "8f906944-f9ff-424d-afbd-048720d33713", "value": "T13305F7027E44CE11F0091233C2EF459857B4A9516AE6E32B7DBA37BE95123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674899432, "uuid": "d38f3805-e7e4-4587-afc3-983215b16326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674899432, "uuid": "c0fde756-9157-477e-8941-f0276a03243c", "value": "12288:23SruAQLbAfu30JfjobsOk4VJ4eCeIPrHyw735Mg2Ob/B:gcuA8bA/JfjoLkO4ea15F2OTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674899432, "uuid": "a69bf043-1865-4b26-a210-32abc5390580", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674899432, "uuid": "3dcdca2a-ee58-4832-9174-6fa69f4273b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674899432, "uuid": "527ba86c-9470-4322-b363-13410985ffbc", "value": "ae23ccbd31f96a4051015724d155f40e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ae1917-9efa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674903559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903559, "uuid": "5c068ccb-0acf-45dd-9d1a-ebd23b213174", "comment": "Malware payload", "value": "3c642dc5efcb662c25ea7c0e2640896f", "object_relation": "md5", "Tag": [ { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903559, "uuid": "68dd9a78-83f6-40aa-b6e3-565f196a2f9f", "comment": "Malware payload", "value": "c87a293f4eb98dbe303eb72bb3661f390ad475fe5229cd332eec4e6a3db333ca", "object_relation": "sha256", "Tag": [ { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903559, "uuid": "3d715863-7906-40f0-a728-8c6b38203c26", "comment": "Malware payload", "value": "79c7e86c570dbdba6b45fb3733f87c21027d262f", "object_relation": "sha1", "Tag": [ { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903559, "uuid": "7a3dd709-540a-4388-8a15-7c6d85c00f14", "comment": "Malware payload", "value": "4d6eda5727d292a027c44e0dbb62d7e63bf298020e0d7451b3eebc19c5ddcdd01b71b54576d981cd071e4333bf743f68", "object_relation": "sha3-384", "Tag": [ { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903559, "uuid": "55c53cae-dfa9-4c3a-ac79-3ace772311f4", "value": "T163B38C9E72B02479C06BC9B9C9F2019AD3F13C145B696BEF0151C5789F13ED4A839B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903559, "uuid": "2161b17d-48f8-41b4-af3b-6bd503b60e2f", "value": "eaadc9da9b502babbd7b655da11d6ffa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903559, "uuid": "fd0f1a89-e1d5-42dc-bc1d-8fb97227aa63", "value": "3072:gaSQaX5sDOA/npIbwB3EYBKkWjFbl1SkpY8:gFX58/q8pBKHzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674903559, "uuid": "a210d942-73b0-46ec-9339-228d1f480639", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674903559, "uuid": "1f8e5ec3-ecc2-4fef-8cc7-f5a01923c564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903559, "uuid": "89397900-c714-45cf-9fe3-bdd658ab77c4", "value": "rasl2tp.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0d408b-9f2f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674926150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926150, "uuid": "423f8758-2309-4cd3-a086-0c5cbbfa1b99", "comment": "Malware payload (GCleaner)", "value": "8e85c270fdaab8f69b13fdda7bb2b01d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926150, "uuid": "d9c3011b-1166-4551-aefa-675cfca3894a", "comment": "Malware payload (GCleaner)", "value": "ca60403411e64f71104b29cd9fae8deccd0652c78e6747dc452f2c9b1cdb8fa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926150, "uuid": "5d16fac2-1359-48b5-9d34-36b625fec6d8", "comment": "Malware payload (GCleaner)", "value": "0b2bc9aca2d978ab4d1ba9358775a3440de22c3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926150, "uuid": "d8d5138b-7f86-4aa9-a52c-c54082f4cc84", "comment": "Malware payload (GCleaner)", "value": "b41a77048a3e584fb457d1c44cf7334f9864a41e96154be844a1c0b8cde8f662f81117eeda0690e3ba4c96ae5a5605be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926150, "uuid": "5c9c0e61-428c-4b5b-8f5a-8acaaa443b3b", "value": "T1ACB53347B2804EBDC09287F2293850A09FBAFF5F243E14053D619B9D7F5E1B01979B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926150, "uuid": "4477472f-4ea6-4ef4-83f0-5f03b913e3d1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926150, "uuid": "b4ba5d19-8464-4a92-9b39-fcd385e71605", "value": "49152:okug+V/Z4EdxfyutE1sLeppzt6ZFD7W7Tv2GDVOLCgv2MR:hug+tW2xfyvZfsx7WPvJDVuv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674926150, "uuid": "fd4d4019-94c1-421a-904d-782c74a1c096", "value": 2342724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674926150, "uuid": "ef5a5256-c1a2-4bb0-b38c-d5926bb06e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926150, "uuid": "46871d70-d071-4ea9-a99d-2c6a54250657", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eef3d9d-9ee0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1674892228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892228, "uuid": "657562b2-637b-4c69-b2e8-2296b03f41e3", "comment": "Malware payload (AsyncRAT)", "value": "6d1b486e2835994f6a2765f4b446ce15", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892228, "uuid": "b66f6788-8171-45f4-b8c0-7daeb674adcc", "comment": "Malware payload (AsyncRAT)", "value": "cbc4d0b0f25e690141db2c88ecfe020cc482774aac114f2efa198eac74af5d03", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892228, "uuid": "f6548425-dd29-4c53-bcc2-8119eead1ea6", "comment": "Malware payload (AsyncRAT)", "value": "5b5edc422030b9078a7655d35adb611b5757493a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892228, "uuid": "aa095c41-d42c-48c0-8464-51e9b5113e35", "comment": "Malware payload (AsyncRAT)", "value": "8f2f6c7c302b51ef21cca533ac9167c2dd3740cc759e857e7c542614661ac0ebf9ac99ef8f801750bcd03454cc908265", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892228, "uuid": "4d3f1faf-2e72-46de-acb6-baed264713ef", "value": "T1BC9519007FFD292EF1FB5F75AAB6A5598DBAFD516B02D61E1010029E0872B00DEA1737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892228, "uuid": "529834ef-388e-44e0-8838-40e29a8065a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892228, "uuid": "0ccd4787-9b70-4528-8332-57f4fec2197e", "value": "24576:jlDd8RQ6oe5xvirGO7noO+8GL2la/U1cY5SPIygOCVQcAbhRppu8mPocHEwYUhzE:P8kyU2Y5SPIygOQQc0hRpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674892228, "uuid": "98f44782-cc52-4cf3-81d2-f133002c10cc", "value": 1919488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674892228, "uuid": "c56bc436-09ce-4f9e-9b2b-936616af20be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892228, "uuid": "e9f43374-3309-4058-af18-2d78b0941d3a", "value": "jEDWg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293324a6-9f0e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1674911868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674911868, "uuid": "4c21af06-c8c3-4d85-aacd-57a21c0d55be", "comment": "Malware payload (GuLoader)", "value": "1d15e13644a9e138db340228daa950ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674911868, "uuid": "6c202165-051e-4aa7-859a-9d5336677a35", "comment": "Malware payload (GuLoader)", "value": "ce6119448d3c3fd43de7204f3250367b46abc5b95c2230491166d8feb20398e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674911868, "uuid": "eec68e05-d84e-46c8-aaaf-56b52bf1a7b0", "comment": "Malware payload (GuLoader)", "value": "44901399559434beacc0f7f4dcf6385bbf9f6f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674911868, "uuid": "b8c7418f-86b6-4ccb-9069-86307c6175b4", "comment": "Malware payload (GuLoader)", "value": "7048509d9a869553cb74371dbed98972b7b5503bfacde83a6ebb04d96818ac396e57967db059c20a3a8f7b4ba115a87d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674911868, "uuid": "c1663fe9-f83f-4c9f-8d82-b651e34c2a65", "value": "T18D841247B3DC887FD79B14B898ABAE37E3788822102557034B121F99BD373975A2F542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674911868, "uuid": "6a896d95-e30b-487d-9e95-171675a8a026", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674911868, "uuid": "cda8488e-3677-4d39-90a5-0576fe7334ff", "value": "6144:fFuakLQKVZBUhYWVQqs2MMDLTLj2+5fc7DdeZjZ5j+adTSA3e5:mtKXVQZ2MaLb2gc7BejZF+U2A3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674911868, "uuid": "569e1eaa-55be-40c9-b4b1-58fc56d6e005", "value": 371553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674911868, "uuid": "b0b01a10-f997-4a94-9f97-8e77a14d4b9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674911868, "uuid": "72195949-f4f3-4fd8-aef0-073757184048", "value": "Bank Details Proforma Invoice FX2022212272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d218cc-9eea-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674896478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674896478, "uuid": "9d56d197-7080-47bd-9207-17b8ef135dd6", "comment": "Malware payload (GCleaner)", "value": "dbf1ff622fe13e1d688fd7026f56bdc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674896478, "uuid": "92888454-6ae7-4d7b-8082-dfe21e82d86f", "comment": "Malware payload (GCleaner)", "value": "cf7ffac8a57044a3fb2d8872496b97140417b21587d44b0788af55eceac570c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674896478, "uuid": "90c4e2d9-0a42-4aa3-bd4f-3c043180a8ce", "comment": "Malware payload (GCleaner)", "value": "cbfd88a49b5f563661c6dac9eee85910786f99bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674896478, "uuid": "3fc87aee-a6fa-497f-93e7-79f4a2cb0aac", "comment": "Malware payload (GCleaner)", "value": "4a1dd701d2a280b39abe9af0fc133db7b1f73831d7db697e401acb63c86b9c74a4c2613c88d0a86c98102c888df2b18f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674896478, "uuid": "39c9406a-9247-405c-b24e-ee39e83e8848", "value": "T154B5335AB694CAFDC817C1F97A34A554DBA2FF8F013D41263254B3CD5F2133094ABA8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674896478, "uuid": "bca1f087-04f9-4578-98db-b136e4373aa9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674896478, "uuid": "d1d95154-04b4-4984-994b-634c5d1c8a8a", "value": "49152:okug+u//0AkgsquxO/ME0YFnRSMVMc37VUjdGuFS3UUqh5LCgv2MR:hug+4/PkgsrO/ME0yRSkFGRNSkXbv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674896478, "uuid": "ab8e4b0b-0011-491c-9795-ade8bda8d6b0", "value": 2358864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674896478, "uuid": "639d7c94-13b2-4199-b365-fc26bcfe0163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674896478, "uuid": "1a6b41b2-5f31-4baa-b614-1c3af53564da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cad80e8-9ec4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674880226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674880226, "uuid": "4465d3cb-7664-4ff8-9f53-e88c673a7523", "comment": "Malware payload (RedLineStealer)", "value": "af6914735ff2f6678c426e07ab605fdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674880226, "uuid": "43b03e9b-f45e-495a-b250-e0e0bc66d691", "comment": "Malware payload (RedLineStealer)", "value": "d32467cea4090a736dbac1bd9ba41deedc9ca1556f63c3d9035e2a304da8b940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674880226, "uuid": "7c52256f-fa7e-46c3-86cc-79b568b93f19", "comment": "Malware payload (RedLineStealer)", "value": "6bd114c2b3cb489ebcef584b721ce875edd02eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674880226, "uuid": "7b663a7f-b6d5-409b-910c-1217f872dd80", "comment": "Malware payload (RedLineStealer)", "value": "6fd8159d9b0431bf7870129cf7dbb4a0d341f9e16f23acc9337561bc26deb20348d55538262cbef41db2beb381cb786b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674880226, "uuid": "2ef71119-f24e-4d61-a2a8-259cb001102d", "value": "T17184D0027AE47C58E967E6338E1AFBECB51EF9D1DE5523DA0208AB0F1DB05A1C563311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674880226, "uuid": "f8f619c5-a618-4916-8c38-200281113597", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674880226, "uuid": "16dd89c4-48b9-412f-8e82-7b40e5413070", "value": "6144:WNLKWdE4rhgWy1KwO1F4YhK9ot+7aXzzs3x9CEbnVno98dV:g2W+ohgH1+F4Yh9lXzI3LCWlo+dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674880226, "uuid": "ffa778c9-adf1-48f1-9ea8-bcc092395beb", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674880226, "uuid": "87c21ebd-7b1e-4bf2-b4b6-50bf770cc43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674880226, "uuid": "429cb36d-634e-4dc3-802c-01c5ec6c8442", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701d27e9-9f0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674910699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674910699, "uuid": "a901e982-b175-4f3d-b031-40bb125038f0", "comment": "Malware payload (RedLineStealer)", "value": "fb1b5fa2bb47f205cda6bb8e6dd405ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674910699, "uuid": "f4a95830-c1ed-47e1-b12a-887622bc66d5", "comment": "Malware payload (RedLineStealer)", "value": "d4444e8245f9dc5c2e49888bad1994ea74a20725128f4004abd46d27751783f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674910699, "uuid": "7afb7226-95af-4c79-ad8b-a6e47336bfa9", "comment": "Malware payload (RedLineStealer)", "value": "c5224ddfc008426ec2a394d345e17c7ce5b307b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674910699, "uuid": "69982af6-5d46-418f-a699-520e82a45ece", "comment": "Malware payload (RedLineStealer)", "value": "5288f2a5d684101e651a97591d0a79fe3a11088f23c00a260e2859a44296f6670a86a10d1a8f887f507f68108dfb8619", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674910699, "uuid": "9f8e1fa3-9f50-49eb-8d84-f5aa755071a5", "value": "T15695948BBB708E42E09435F2C0DF1A22A3F167B71773D146BE051AA086D67861F57B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674910699, "uuid": "2caa0965-fedc-42aa-a477-9c1886656c26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674910699, "uuid": "5093d501-bcd1-436b-b617-87102842936e", "value": "6144:aVLGsZu+aZ0DpsO4v9NSUrfxEyR4nKIgbIRTrlIY5eUoV69m/i47pHxdjn1IP:KLGmL2vHA6bqb0a4pHv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674910699, "uuid": "4f3e23ee-5736-41fe-8ea9-d5cce1368ff3", "value": 1969792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674910699, "uuid": "681139d3-19ea-4dc5-beed-bed845575d77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674910699, "uuid": "5ed7f5d3-aaa2-4653-8860-7aff459c0419", "value": "Michael-Martinez-Google-Maps-Route8.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9ef25f-9f41-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674933834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933834, "uuid": "31315bc8-c05f-44dd-8c46-70ba53b12f01", "comment": "Malware payload", "value": "ea50158bcef30d51e298846c056649c3", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933834, "uuid": "aaf1ad1e-a08f-4f41-ae76-c2a04487a657", "comment": "Malware payload", "value": "d50d98dcc8b7043cb5c38c3de36a2ad62b293704e3cf23b0cd7450174df53fee", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933834, "uuid": "ec8c22af-4b18-4082-ac3e-f7fb22bd4539", "comment": "Malware payload", "value": "6cf0cf4e216bf318b36017dfd168f561bd5f77a4", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674933834, "uuid": "18c47719-c7d3-4c3d-a5b3-ba669a390a51", "comment": "Malware payload", "value": "c53090a78bc81945a963c050f81705e45949c4212f324b48fdb0b8a215a87eb911f1fa5ef0b9763977827619c0e41547", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933834, "uuid": "32973110-6b2d-4ff8-8b59-e60ddfc085e7", "value": "T1150408013ADAEC5BE52221300E9ECF5690809E201FA4C92F355B3B6D9BBD16FDDE1B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933834, "uuid": "8bc3188a-c1f7-45e9-8b96-3997966923d4", "value": "3072:t54PrXcuQuvpzm4bkiaMQgAlS9gMFpmT6Cm1PwnbrQ6aQRB:8DRv1m4bnQgIS9g0pPonbrQ4RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674933834, "uuid": "ae7f4f48-b9c2-4fe2-b458-c94e1c071143", "value": 177195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674933834, "uuid": "6a8b8bf2-e7ef-4302-b1f7-1d7821e14336", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674933834, "uuid": "014c8d87-28ee-43af-aca1-084229bca57a", "value": "ea50158bcef30d51e298846c056649c3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9fa7f8-9ecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674883875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674883875, "uuid": "8745615a-0843-4f94-a117-bbbeb9f5ffad", "comment": "Malware payload (GCleaner)", "value": "6b0e799d41eb83e8929926f45983c791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674883875, "uuid": "731ca6c0-8c17-4a47-8835-d5087d7e185f", "comment": "Malware payload (GCleaner)", "value": "d6172db4fa8e9cb2dbbea9bea0dfd1c2150ff00c0ae290615f39725cc5a530f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674883875, "uuid": "0c597787-dfe5-4789-ab0a-6636aa8fd608", "comment": "Malware payload (GCleaner)", "value": "e4aa7ab8ae01c563d58cc48bc4edc6b2fb4a7a96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674883875, "uuid": "0855c8f8-0dc2-4b94-819b-6b777724be10", "comment": "Malware payload (GCleaner)", "value": "a6fcb59f47b4dd3f61e8c0216b049752c098574340e41d7aea58a19938a54d047ff1a6b1c4ea5ced4a3ad0fa3190bed3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674883875, "uuid": "41011044-73b4-47fc-b1d9-e2e2f474c00c", "value": "T18DB5338A70D1D0FFED414AF62530D640EBA6FE03707C60243398738E6D7667169EA5EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674883875, "uuid": "f4906d8d-92c4-4d54-95b0-a37f8ce627f5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674883875, "uuid": "b3c021a8-a565-4869-958f-ea10baf1f35a", "value": "49152:okug+BljrW+dYFuOyDQlIloCdBKWl8od7fn6VVyGCLCgv2MR:hug+HndYoPQlIloCXblddEwpv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674883875, "uuid": "a3265614-d310-44f0-844e-503727dd0621", "value": 2352024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674883875, "uuid": "2796c9c2-8938-4b3f-8b51-dfd5199ca34c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674883875, "uuid": "0665e7a1-6c87-4726-9be3-7086995b9c85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f1b8d8-9f08-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674909343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674909343, "uuid": "711566fc-1c9e-4b18-9b9b-3f7e3cfe2a14", "comment": "Malware payload (Mirai)", "value": "d58b8e9e4d5d46761991106414681987", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674909343, "uuid": "5c8b160d-9806-4c21-a58d-7c4f468239ad", "comment": "Malware payload (Mirai)", "value": "d656d81fa24d96b9e1c2c431c35a08e0e95d6d6fe86189b78b5c36ac8279cd06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674909343, "uuid": "ec2df323-3351-4c3b-895b-3f67e1e232ce", "comment": "Malware payload (Mirai)", "value": "6555f6aa05f3eb1a00f86fdd720cd4734cda85d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674909343, "uuid": "4ba2cf85-4661-4279-8c58-0eae2ae45f11", "comment": "Malware payload (Mirai)", "value": "c898444dffe5f7285a168d1e2a8a8b9ea64fd4cdacdbac1cb2f7318ee6b10596359dd1ac6871c95b20570534aae5930a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674909343, "uuid": "5b486a95-ae5a-46a9-847a-f76704eaeb0d", "value": "T1A992E0D981881259D9C52979633A68DF78E2D9AC477B479BAE0C6480E71309933F8FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674909343, "uuid": "87d17cbc-2917-40c0-9cb0-bd8f667fb13a", "value": "384:MWE3bK1bS74qrPaGt1DLj9x5d27slemrd9v1RO:HE3abSbTaGzBLAVmrvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674909343, "uuid": "19186924-dac9-403a-a779-ee4a339ea83b", "value": 20908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674909343, "uuid": "78d55b53-945d-411b-8520-1ae0145eaf19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674909343, "uuid": "0a5e16d1-a86c-40d6-84d1-a317514c4089", "value": "d58b8e9e4d5d46761991106414681987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a909bb1-9f42-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674934339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934339, "uuid": "5b7a6d68-c8ac-4647-bb64-fc5d528152fa", "comment": "Malware payload", "value": "b76b3e8da7e48a76a6df2ed3e9cd2b12", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934339, "uuid": "7cc1f148-9709-49c5-8144-945065aa044a", "comment": "Malware payload", "value": "d6c7397b00e572f9f17fd4388227b260b4eb26c24e9e5f5ecc5de92f424724a1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934339, "uuid": "e130c83c-2e78-475e-8f36-4fde115f5d2e", "comment": "Malware payload", "value": "7785e6ce01c5438276736365c8cec341674c52ad", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934339, "uuid": "2b4ef195-494c-4259-899b-07e1bf8e169f", "comment": "Malware payload", "value": "d0daecf3688bf9a02a86d3b62e94720582b09bc0635c86515efce4f0e6c464724ccc877b050e1ddc2297da66d6dc8a70", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934339, "uuid": "71fca330-ea88-4a64-add3-f703f2d4ed7f", "value": "T10C179E22BB8540B7D0AB8531856BD71AEF71BD10073186FB6281B75FAF327C29E35612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934339, "uuid": "cde6a493-3217-4b66-b5b0-0fc777fadba0", "value": "e3fe5431689e838ec60caffa762ddb9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934339, "uuid": "0e07a3e5-78c0-431e-96b4-9367dea6dd7b", "value": "196608:MghtBTYSOyCKa9+6Y7SOEibgR/ghtBTYSOyCLs7PVrDE:ttBpFgRqtBoshc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674934339, "uuid": "9371d41b-c6c9-41bc-ad6e-659fe3aea6bb", "value": 18725208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674934339, "uuid": "e43fd1ba-b6f1-46d6-bb97-4bce0d3cb021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934339, "uuid": "ae4c381e-6a79-4ce3-8ee5-54dcdd42ab51", "value": "WISPTIS.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635c1242-9f01-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674906382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674906382, "uuid": "76ecea9b-c39d-48ca-bae5-a59524b57c2b", "comment": "Malware payload (GCleaner)", "value": "60993c8efeeb4f6c98aa986685e3c3ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674906382, "uuid": "f38ded24-333d-43c5-ba7a-2c9f2e1b04c2", "comment": "Malware payload (GCleaner)", "value": "d885aa81d3f55cf6b22e7dcf53840749aa8d955e36425168f7a3df2ce558165d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674906382, "uuid": "9b32ac2f-bfa7-42c2-8560-94b1eb2320ba", "comment": "Malware payload (GCleaner)", "value": "905de873775d4df432a4592d799602f4ddbc5557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674906382, "uuid": "d702f3ee-9f88-49df-adb0-121a482d65cd", "comment": "Malware payload (GCleaner)", "value": "380e76b05cb3d1b5c8b51b0333d70e2e98f5817268ea02bd2bfceeb9a3283ff1b4d01fe82fc1be4c8eb2ca3935e8abbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674906382, "uuid": "1defcac0-a8bc-4885-a3f5-917255066ae9", "value": "T1D9B5239BA18583BEE917CBB73C31B484DF33BCC2A039115C7254526C4FB66A0687677A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674906382, "uuid": "e91ff1a6-9b1d-401c-aad1-c8d0cba1221a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674906382, "uuid": "0441d342-b70b-4949-beb6-34eada2a0316", "value": "49152:okug+t4FpEEGqIe6fm6mkogmCAHOJUrhRLN5kC067LCgv2MR:hug+uoElIeOm6br3IO4hRBu6vv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674906382, "uuid": "ffa83828-0feb-4c10-b281-d91a01d5f240", "value": 2344912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674906382, "uuid": "381cdcdd-649c-4fbc-abf0-36d8fbecd38d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674906382, "uuid": "1f97f99f-f251-4a6d-aca0-1a23898920c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed77e214-9eb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674872684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872684, "uuid": "373f3b54-c19e-4d27-9f16-2f7596622c12", "comment": "Malware payload (RedLineStealer)", "value": "46659078a8e155236eb59dce5f42baff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872684, "uuid": "a61b6f22-8e8c-426d-98e2-b7094580b445", "comment": "Malware payload (RedLineStealer)", "value": "dc6226d88472e78b79c967c3d151400f1b6e69d7618efd430b64d35b2e20df2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872684, "uuid": "e8ff3e7b-827f-4709-badf-699c1fc80a8f", "comment": "Malware payload (RedLineStealer)", "value": "a3b16f6d9d4ca219114984fd5dc3b4a115f4e666", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674872684, "uuid": "702285f4-a5bc-4a7a-bc99-4066d95cb60a", "comment": "Malware payload (RedLineStealer)", "value": "533c9aeece93ce998db96ee6f1314b6164cc566cc824f8da2fc0b57f7ea08bc720136416a305701b1ff55b4d9e6aeab1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872684, "uuid": "61ec75af-3e1a-4486-b0c9-415b679c9624", "value": "T1B474F246F6D94072ECF61BB018FA02870A36BCE15B74839B2781694E5C73BD4A97136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872684, "uuid": "7caeadf7-6888-4865-9284-e53b4af62850", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872684, "uuid": "c03b7d67-363e-422d-a304-01dadd7fe939", "value": "6144:DXp0yN90QEpMu4jfhblv9dOb06N+bWWIrN+4+AwkZ22QUKBHrz28WyKzHP7bug5:+y90XV4rhpvu06N+bWWIrN+4dwi229mE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674872684, "uuid": "0af47243-a692-4bd9-bed5-b47f9df2b917", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674872684, "uuid": "1296e9b0-cdd3-4b79-bd89-6079f72c6e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674872684, "uuid": "d66fc136-3039-472a-8c7b-99d16ba31d34", "value": "46659078a8e155236eb59dce5f42baff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938df51a-9f32-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674927509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927509, "uuid": "a10792ae-f528-4871-8b2d-25cf11e3192a", "comment": "Malware payload", "value": "bccef9ed88ba16af7c5484758bf366b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927509, "uuid": "dd84e985-cd9e-4ed9-90c2-50c67f0fa95f", "comment": "Malware payload", "value": "dc8566820cd54e237e1cb5e4503f79a717cfcf4f5be385501b79425b7071dab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927509, "uuid": "bb3c4b98-da78-4b1a-8879-c8e4c8b309f0", "comment": "Malware payload", "value": "0d19a0e1091c9ae6df0b5392885fa36c577f4d46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927509, "uuid": "90b90630-f995-4d7a-934a-5cc77179e3f8", "comment": "Malware payload", "value": "b0f0aa525017ee1d1c849d7dc0460858fc62d3e619b906a15de0e661698715db2fc6321b54ce83de9c7998f2704df91c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927509, "uuid": "a318090a-1417-4a67-a4a5-1d43c3f19932", "value": "T1CE0402E5279F998DC3BC38B1D8C98D76A9347799527D8F8323050257680BB6C7A8FC18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927509, "uuid": "c632eae9-8122-4d9c-9abb-8b8076ff5089", "value": "66b0e7d125cde526ede4886176cb0f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927509, "uuid": "04e596ca-4d0b-4361-88e7-9f2f45134de3", "value": "3072:/9wx6qC+33C4VXIBQ91bvZmbwaK/VCq1IqnzThTqgvwb85Po1i1Qr:VwQqP33fhIB0NRxDdDKJyVPMi1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927509, "uuid": "d0d78978-a1cd-4f97-8164-327896d39a47", "value": 176247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927509, "uuid": "b21889b1-8082-40fd-86d7-899c95c92e29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927509, "uuid": "3642c2b9-8c59-45cf-8818-dcdf46ed88b7", "value": "bccef9ed88ba16af7c5484758bf366b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b693fdd9-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674894926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894926, "uuid": "629310b3-906c-46b2-9125-4bd91419519c", "comment": "Malware payload (Mirai)", "value": "a3505c92d44e6210ba9328b74714c4d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894926, "uuid": "c63a3161-145b-4fa4-8c47-330aea7dec90", "comment": "Malware payload (Mirai)", "value": "dd3259beaeefe23bc797a2602b6d76a5eea8f34291705b0a07dce36013a02b17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894926, "uuid": "d1f20a87-fd82-433a-b936-f37bed35df10", "comment": "Malware payload (Mirai)", "value": "9e9e20fe9f958f75ce9c7f7f2ea9c44e4f5510fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894926, "uuid": "7fe443e0-90ed-49a8-8333-0c24cf01214e", "comment": "Malware payload (Mirai)", "value": "2117fbf51a743b0b4fc9e57a3fc3523cbedf615cd257abc11bdc0c9bbc8824419bcb176705385b48800c7faf4c7a0b0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894926, "uuid": "0cd6f02c-09fc-43e1-adfb-a7afb50741a4", "value": "T18EF2F12199BAE279C8F56E71F20C0727F2052A71D19B3402466037DABA27C01FFEE1C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894926, "uuid": "fea363e8-f3c1-428f-a433-9fbaa936f5f0", "value": "768:rOKqVyq4IaI+gmmJNBlOgyDyye3yv5YPN7y7LLWq3UIe:u4IaHgmgBlO4ye3Q5YPNm7LNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894926, "uuid": "87c2b0f0-319a-4883-a3db-70e864be490e", "value": 35168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894926, "uuid": "2812aa78-a07e-46f5-99d6-75e45e6302fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894926, "uuid": "9a80fdc3-1ada-478e-9987-ea49676300c2", "value": "a3505c92d44e6210ba9328b74714c4d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc56526e-9f05-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674908277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908277, "uuid": "7380dc4b-2f46-41f4-ab44-cd1c4e4daf08", "comment": "Malware payload (AgentTesla)", "value": "ec5692433b85b47707bfff2167a5895e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908277, "uuid": "255cbeb3-9402-499d-ad92-95e07cae130c", "comment": "Malware payload (AgentTesla)", "value": "ddcd37d08389026dc82b700b0c6f9e6e1d38bcbc6b99128bbaa319ae59b73013", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908277, "uuid": "72ce8add-657c-45e3-b86e-ee4ea665aa08", "comment": "Malware payload (AgentTesla)", "value": "410c8b0a5ce622be8c8c714ef85f1dc6d72e65a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908277, "uuid": "e723280d-8028-4a75-bfdc-32a259a79942", "comment": "Malware payload (AgentTesla)", "value": "7a4831b9ad1ae077f11a164ab28476c27212fa1ba06a0fde541e2897ede5aa02f2a73568db4a68a430dd6a3a0db81578", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908277, "uuid": "2ad5ca18-262b-457c-ac92-7ab2ae00ce54", "value": "T1CA251202BAC18A72C4B31932563A7B20B97D79101FA9CFDF63D54A6CED316D1DA307A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908277, "uuid": "9e8297b3-a9f2-4ab7-b436-8fd2a4c27c8e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908277, "uuid": "ba94898d-24f0-4df5-97e0-55e4477d99a3", "value": "12288:lToPWBv/cpGrU3yleL1MssWuAz4p9tn/2tUx6OMal2puaSaChEBUbgZtE:lTbBv5rU7LKssAKvxRMa2tStaBagE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674908277, "uuid": "5e4132d7-2a62-4957-838a-158f17fca4c5", "value": 977366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674908277, "uuid": "1e19b05f-08c2-48e0-bbd6-e2a15ad51740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908277, "uuid": "93b3313a-0270-4219-bfbb-f240ff4cd6bb", "value": "PO-0987654567-987654567MNG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8ea602-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674894909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894909, "uuid": "e436513d-90e4-4fb5-bfb7-724eef079782", "comment": "Malware payload (Mirai)", "value": "50b37346c9ffb953f76a6a1989c15f08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894909, "uuid": "48a73103-ee80-4011-9deb-5a1e62cb3b5d", "comment": "Malware payload (Mirai)", "value": "deaf41a720b9a11058f454d1bae02ea819b5f85438ef3dfe867c7a256b03962f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894909, "uuid": "716338e7-607e-420f-9963-a0b8c353cb25", "comment": "Malware payload (Mirai)", "value": "dc30f50f94685f57bd4ed880969882aedbb02fb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894909, "uuid": "1b28f79f-3d2c-42a1-82d4-85df9b2b8801", "comment": "Malware payload (Mirai)", "value": "bfa6348064a10c84ab54529d192de55800f73c09784c42ba81d59db47f3ed43a5d16f6881f35c6dc070987172444b412", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894909, "uuid": "01ee1e37-9ab3-4ff9-afd3-bf5bf81f9d1c", "value": "T198D2E078F495DA95FB7B0A781CC59FE13BF20ECA36A6ADD093466F449123C125620FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894909, "uuid": "278a0283-634a-4899-a372-a026b104945b", "value": "768:QFB0usUU6qSx1OBEbZ19yVLUIElJOx5g0glE4uVcqgw0RNWXU:QFB1sUjvOB27ISrlQ74u+qgw0bWXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894909, "uuid": "df72289f-f63b-48db-8891-5cf5b91faf29", "value": 30660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894909, "uuid": "5a47dd97-631f-4b93-bc84-8034ee593e0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894909, "uuid": "ebd95b8d-2365-4d9c-8437-e549f626c457", "value": "50b37346c9ffb953f76a6a1989c15f08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62286252-9f07-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1674908957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908957, "uuid": "699e919b-0da0-4959-9aab-a2f32145c821", "comment": "Malware payload (RecordBreaker)", "value": "0214c6968c4ad1dd4e50190b3fd6b192", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1231", "colour": "#B384E0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908957, "uuid": "6fb7f97e-102e-45eb-b0a6-466b7f8e36ca", "comment": "Malware payload (RecordBreaker)", "value": "dfb32a6b95918b4135fd31eca9310059c1516bff46851ab25addc2cc3ee90ff3", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1231", "colour": "#B384E0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908957, "uuid": "1f49c713-5c3d-4f34-ac86-753b9e8d75ab", "comment": "Malware payload (RecordBreaker)", "value": "14458d24b5e84d7bd1bfee87c9a51443bcf1e1bb", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1231", "colour": "#B384E0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908957, "uuid": "f8b71a02-f1af-4b5f-8453-4ae9ce73c717", "comment": "Malware payload (RecordBreaker)", "value": "94eec4872eb2debe208b54df31feb987f57bb94dfc2951f102da600b1baf1d85ca9f7d37ee7bd267dc72e3c0045f8457", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1231", "colour": "#B384E0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908957, "uuid": "4f1da552-51d4-4bcd-b3b5-6a81eae68153", "value": "T198663332FA72E12D644A77A70CED5E6DB942409EEB9C4ACEE451C9F7641A380C03E35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908957, "uuid": "ece95a6f-1724-4033-9d22-71bb2494f2e0", "value": "196608:6QRX2Hm3y49C2w+e+588KdLXK0K0NYQwvTjLg:6QRgm3YmKdLXKR0NCvTjLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674908957, "uuid": "73fc8180-5f6f-40f9-bb8e-4531f5bf9780", "value": 6525758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674908957, "uuid": "33329b1f-01cd-4124-a905-5dcef767595d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908957, "uuid": "ec4136b7-8d88-4395-af3f-eee522593ada", "value": "Adobe illustrator Crack.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192aab2b-9ee2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674892944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892944, "uuid": "4b71b3f5-0ff7-477e-8038-258e339abfef", "comment": "Malware payload (RedLineStealer)", "value": "716e0102a4b4b31c1aa3882572e3ecc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892944, "uuid": "b69c1678-f5ab-46fd-8e9c-279951d1eeb3", "comment": "Malware payload (RedLineStealer)", "value": "e07cf60f16b48299a5f08feb3d935bbaf9dd9b1e4cb72aff3aed939b69117012", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892944, "uuid": "ac6545a8-f2b6-49f9-a683-c57ada86ab2d", "comment": "Malware payload (RedLineStealer)", "value": "b142a48215a501b755893375cad41b2fb6310b14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674892944, "uuid": "78cab51e-9b4c-47bd-923f-f0ad67591ffe", "comment": "Malware payload (RedLineStealer)", "value": "3d3db3a84c837c7bb5395f7416b9c801201fe177de16cee957f89f3a3002f59c456d5d670c65420fa76195bfacaa62d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892944, "uuid": "c61d3475-03e3-41f8-9009-a8b0d2465fc9", "value": "T1B484BF0267E2BC60D925CE759E2AE6F4B72DB8808E05776E1A145B3F18F13B7C59231C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892944, "uuid": "24fd72d5-7ef7-4e70-971f-456e8fee0210", "value": "4bc9925dd568c221c7d9868dfc769dfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892944, "uuid": "f2030797-c767-4769-9c55-0caff5765455", "value": "6144:uLHLVfWv5lqUo39/ATuiKexgkTNMH9VdmqSwzIDMmmP:uzLlWv5lnoN/ZeCkRMNmqSAeMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674892944, "uuid": "fe97c9b5-319d-44e7-ba43-f62415bcf1a0", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674892944, "uuid": "f8f105bb-f9f9-4217-a3d0-667987303fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674892944, "uuid": "64fbddde-46bb-49f2-9208-88b755d2561f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63230aec-9eed-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1674897792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674897792, "uuid": "f2660895-e99f-47ad-8ae7-e4a310aa16ec", "comment": "Malware payload (Amadey)", "value": "cd2f1e7b48d9fb1b1564e0aaef254246", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674897792, "uuid": "0514193d-0a68-434b-82c5-1c9581b84e6f", "comment": "Malware payload (Amadey)", "value": "e115bc4b1111389c8394d798d55a95c2181ac088fbea26c62645d3d82884dd54", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674897792, "uuid": "7613d724-fdd9-4e8a-8722-7cdec632974e", "comment": "Malware payload (Amadey)", "value": "df4b3f90f2993d90c85130de5a0badf6140e4d0c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674897792, "uuid": "26a588a1-c203-4662-9773-f1187a0b5030", "comment": "Malware payload (Amadey)", "value": "331b8d15a309c626bcf9365fd610cfd89dcb1a9538086310ade7dafa44b5009b5682b230af01d90639f9cd72f623cd70", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674897792, "uuid": "3f340d72-8e09-4b42-93ff-bf9053b837b7", "value": "T18C160204205D9767F0B6DBBAE0BDD85A4C96AD014D03B361923242CFDD66FE89CF487A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674897792, "uuid": "637345b5-851f-4c54-a10b-585cd65b1a22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674897792, "uuid": "7e1c4d99-04a0-454c-b585-614739fe4c11", "value": "49152:ArbbfMNzahD7GluU7RY62QdYXW64Zf46bFIvpnJE5whSEVU427cgZQml1B3gc:WbKBlY6TdcWtQ6hIRy6hSEVI7cgKY1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674897792, "uuid": "a601de29-9623-45c7-903b-745363ab11ae", "value": 4066304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674897792, "uuid": "4bb3b03f-2aa1-4f5d-9e8c-2b50209c3141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674897792, "uuid": "3d60f603-9d42-4eb6-a7c8-22325e734739", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59fd8e6c-9f30-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674926553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926553, "uuid": "2df4572c-42ba-447f-855d-94a8c6246115", "comment": "Malware payload (Formbook)", "value": "56390adecfa92125980762fc0e8494a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926553, "uuid": "83918bf1-80cf-4f8b-a425-cdd3a87d0987", "comment": "Malware payload (Formbook)", "value": "e15ba8be78ecdfc804dba4fbce9e14eaef0d84ec4c9b82d5d8b109c64a566266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926553, "uuid": "63364143-a637-4455-a426-3ba3e1fbaadf", "comment": "Malware payload (Formbook)", "value": "d3c4dde030bcfc33c66e3a4753da01ccab190395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926553, "uuid": "b9bd64a9-112d-44b2-968f-41e1b6c122fb", "comment": "Malware payload (Formbook)", "value": "d61d2e3b8db1c9e05ba64814924539f5e296bf49c33bf314b02fcae68a571a45adec4d6022c147d86d671e9551d47768", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926553, "uuid": "d70a0b18-19d3-47cf-98f9-de25790108dd", "value": "T1B47412157AF4E3A7E6A64173653B57EC2BED980150B4DA8FB32047983F31302961BB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926553, "uuid": "392df716-bc85-474e-944f-f659b3f1733e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926553, "uuid": "4d0cbd65-740a-4fc0-81bf-ca687f383c99", "value": "6144:vYa6Gwv4JbsquWe3Jf+vNUY88npcc90c72Z5X2uWRN:vYowvh02L8pJ0cP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674926553, "uuid": "7aabbe75-ad55-4918-92b0-97e92b961ff3", "value": 359421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674926553, "uuid": "47d4a8b3-756d-4b7a-9c21-1d1cc1c29d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926553, "uuid": "ba841673-4d7d-4904-88eb-9dc3c7c7d7d2", "value": "Scannedfile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ab819d-9f05-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674908218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908218, "uuid": "deca8d44-8078-4fac-b146-fc8287f343b6", "comment": "Malware payload (GCleaner)", "value": "7c0c48f85abc166dfe4871daf0c5f64b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908218, "uuid": "3b616527-511e-483a-b0c5-a54bdbf6d786", "comment": "Malware payload (GCleaner)", "value": "e1cbe7a4c3837748d08e1521d840acabb9717cf366fe6f7943c0f45bee63df45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908218, "uuid": "5af1accf-dc9c-4760-b101-378dddbc6153", "comment": "Malware payload (GCleaner)", "value": "5e146e8bb827b795f1afa7dfb4553afe684a1eb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674908218, "uuid": "b4aeb6c6-19db-45bf-bb12-2c4a8d56443b", "comment": "Malware payload (GCleaner)", "value": "56be80213a6a3afc5c02a70768149f256e5ef7a5fa7884e20da0270205a22c17c6e8afe0b8066efe60559c8bfbbbe284", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908218, "uuid": "a423e6bf-19a3-4fee-9809-6e4e7b551af6", "value": "T11CB5334BA452DAFCE5538EBA2931A5458F33BC8A307D401A7285679F3F690B038D17BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908218, "uuid": "8212063a-f37c-4000-8b50-ae3c5225f427", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908218, "uuid": "2fec133d-1a62-45fd-bdc1-a93bc814b19c", "value": "49152:okug+ZBebcXzED8bRSjFANW7j+zRSojOg75VBDJ0DyNjKyci/rLCgv2MR:hug+TJDl8pln+FzjO253FqyNulsv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674908218, "uuid": "694044fd-5050-44c6-8041-b71b7e84773b", "value": 2382483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674908218, "uuid": "d6d7c489-041d-4924-b863-02e568ead1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674908218, "uuid": "8e810a96-7704-4351-ba98-dfe184ef82d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13f13a6-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674894917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894917, "uuid": "90a18048-8545-4cb0-8aeb-45c1afd3698f", "comment": "Malware payload (Mirai)", "value": "eb968083a44c9bf4d41d2dce2c46865c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894917, "uuid": "54de3f0d-6c0e-4022-bfb9-7678d028d04d", "comment": "Malware payload (Mirai)", "value": "e1cfa7a9fc3857b554373ac9e489b45bd2806b67a02766c4c19db1254e2db35d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894917, "uuid": "ed771557-9de3-4b1e-a179-849acadc0e22", "comment": "Malware payload (Mirai)", "value": "912eb04569d7aee92134ba6efe44c6d34d28661d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894917, "uuid": "4d657cca-e9a0-4789-817d-f9381ee8a50b", "comment": "Malware payload (Mirai)", "value": "d0283c8110e010d8d3680b93554b470c037f172e635fa671b18de051bc59b7277ed3821235957a7cb8cbc54c951fd0ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894917, "uuid": "b55858ba-1bfc-4a79-a806-c15824c0a620", "value": "T18C73AEA8CD5C1CA2C6AA0134A5D0D9B96323EE046A536FB4CE858F95D007EDC707E7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894917, "uuid": "aac1ff98-3649-4943-b5d3-d69dbfc642ca", "value": "1536:c/i4My1GYzDMaJgcHxsfd63p8/WnCetX:cau1JwkHxsfOp8/Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894917, "uuid": "417a821e-ed7b-432c-ad05-16145bde66d1", "value": 74916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894917, "uuid": "a3bcb138-fb56-4098-bb8d-bb64bb5a9872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894917, "uuid": "ab5ad3e2-176a-4b6d-8a36-33f760406e28", "value": "eb968083a44c9bf4d41d2dce2c46865c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb83026-9edb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674890237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674890237, "uuid": "a650bbbd-41e2-4203-b398-ef585389c026", "comment": "Malware payload", "value": "891caf246a962d67b9094a0dbbaddac9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674890237, "uuid": "209202ec-2eb5-4b67-b538-05f15351d175", "comment": "Malware payload", "value": "e2cac63bf32a0e4e80b2886b902d3fda4bb3de35dc9bec1c6eb954198c51e374", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674890237, "uuid": "303f5227-704f-48a8-bc22-fee254bf726a", "comment": "Malware payload", "value": "f9ff85d21c1746889a95421667944efa3a7b51bc", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674890237, "uuid": "899ade45-7eb0-4b6c-b595-1f885379052b", "comment": "Malware payload", "value": "2c51e1ab8a9af98952ac1823af6f91eb87bb4b8089bb1f8335e50bb7920e84bfa876c86991a148ac42c38a31edfd0306", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674890237, "uuid": "5ec00271-fe58-4660-ae85-af16b19ded20", "value": "T1CA13BF66AB833FA85FA25370D44E9F6DC2B16BA12321E7ED2C42B1C85D71643BD31435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674890237, "uuid": "0fd696a8-75ae-433b-aaa6-15f5c88f5af9", "value": "768:y03xlVCpwcZ4yft8xUFyKoNQWV9MtqLjz89KRI9FdFunvVdFMDCmAb:y6/V4wU4yIUUKZA2MLv8Ku9zo/LmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674890237, "uuid": "466cc213-b3fb-49ff-a216-0d79190c5e31", "value": 42454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674890237, "uuid": "fd21aa1f-7c17-40c8-a037-a0528e39f983", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674890237, "uuid": "5f2dd45f-6365-4d36-bff8-13a8be053c84", "value": "window.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4803d5-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674894932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894932, "uuid": "f9ab1017-3349-40da-bb97-ed8cc3deed7c", "comment": "Malware payload (Mirai)", "value": "c6893243c63eefe136b682a2da48e06a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894932, "uuid": "7a781d5a-90b3-4fe0-8ce6-ff6036a69e1c", "comment": "Malware payload (Mirai)", "value": "e37d0e4c76addb8d77673a1a5f60357010ed9af007dfa2616b179e4ab57ccebf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894932, "uuid": "6824625a-bbc4-49fa-9c51-d1289afbe6c6", "comment": "Malware payload (Mirai)", "value": "29aa4934d82bbf2a4cac16c5cdfcae8990ba3b2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894932, "uuid": "6ea9e676-dd6d-448b-a8ce-ce617bc321d0", "comment": "Malware payload (Mirai)", "value": "c17a72fb5ce1bd8e6dda05b42320d56d078131f537fcb4593e71cb6c0fe1c579bb7c9cfacf3aad80c034b3211af91acd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894932, "uuid": "16f83990-80f8-4a05-99b3-965800f2a349", "value": "T1F6E2E16EE0043289D44ECC3E846C2B73ED03F4B4B09D92C5A599CF85BB1AE4AF59F465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894932, "uuid": "52ee7023-1721-428d-ae82-33b81072434c", "value": "768:yDGeb7TBYoLn4jF2dQLQRmGBAWZzqn5Eirqv/ArhXa81WMN:yDGuvBvL4jF2lRmGSWZO5EirqYNaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894932, "uuid": "6f8d88a7-c367-4205-85a1-bb6b78bf23d4", "value": 33676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894932, "uuid": "301d1a6d-d1bb-43d6-a387-23669258fb18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894932, "uuid": "c8f95e16-0811-4b44-98c2-5986304d0278", "value": "c6893243c63eefe136b682a2da48e06a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ee1e86-9f2d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674925231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674925231, "uuid": "976dcfb5-f676-4be3-a481-34db9a64aa9e", "comment": "Malware payload (RedLineStealer)", "value": "eab7e57c624a7de4eea85523c67e68fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674925231, "uuid": "46eafeee-61d5-4c67-9bb2-6d552ad70517", "comment": "Malware payload (RedLineStealer)", "value": "e3fef877ba39f58aae663573bae550002aba3b576667881ddc3a3b48539eb1bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674925231, "uuid": "8ea7df9d-6ab6-455d-8e80-92a3069cab31", "comment": "Malware payload (RedLineStealer)", "value": "fc89fe0d7887d54f2bfcc5fd8f5d0fc06cbd12d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674925231, "uuid": "c461528a-f981-4d4c-9fdc-2b7fb2378230", "comment": "Malware payload (RedLineStealer)", "value": "c671c55c46dbc24a3c5d057e1be3b1e325fbab780cba25160bf697179194b14d8637eef5aa5f21a4b3a8642ca781ba76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674925231, "uuid": "4de9ce27-0ec0-42dd-816d-248e54c70ad6", "value": "T19684DF0197A2BC60D929CE728E1EE6F4771EF4508E15736D9A14AB3F28F11B7C5E260C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674925231, "uuid": "fdc81c57-932e-4527-a37b-3921d3708b9e", "value": "d191080c270d3118935d8b6a682d2ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674925231, "uuid": "f9054eb2-8fe1-47a2-8793-aeaa51eebc8c", "value": "6144:FLWYvdLEd03B7EU7CPPRjto3Gasmv5n/9qSwzIDMrkP:FSj07vGPPJCWaX5n/9qSAeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674925231, "uuid": "d925a791-117f-40e1-a9c8-1a1b6cc379e5", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674925231, "uuid": "2a74acbb-ad0b-45cd-89f6-a2d676d1802f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674925231, "uuid": "7c3bc617-3d5d-4057-a282-793b7a482218", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f705dbea-9ed5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674887732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674887732, "uuid": "136ba8bc-fb6f-4996-a332-071f5bcf9784", "comment": "Malware payload", "value": "9ade42d02e69e8d308d6eafe6ecc102c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674887732, "uuid": "9c979495-5260-4ffc-91f9-f714390a8569", "comment": "Malware payload", "value": "e3ff7be04b6f762b9f8000c438f3d8355d741da1e02fdf36d47370ac85bfa3d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674887732, "uuid": "82a8922e-c2fa-43da-b034-578489c0674c", "comment": "Malware payload", "value": "ff2279f2b82cb158cdcc82b2c995103759a35a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674887732, "uuid": "999b6d70-3a3e-4d28-ba09-c6c147f6aeac", "comment": "Malware payload", "value": "a6709a4b5fad56d7858c9d6229bc3a931c9bf03b968dc18e049eef0a55f726a8085aff5f355c48f7eddbc6d3d3784690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674887732, "uuid": "42cac807-3b4b-4604-acd4-c0b75fee431d", "value": "T16C759D2E7AA19077C13231719A4EE3B9F2ADD5315E75420366A11E3C3E385928D2C7BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674887732, "uuid": "f8f30c29-6ada-476c-bbf7-405ca9f3d5d6", "value": "179ccb92bf55b675a87c03a5c82cc43d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674887732, "uuid": "dbffcbc9-7907-4525-b358-e4deed61b418", "value": "49152:8RF5uakxP0KiF8mXlY+GOJL6o9PE8NkHEcdJRssS3Vqb4PnB7AnZh:aF5u/P018AY+GOJL6cPJQEcdJl48b4P4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674887732, "uuid": "f5b9d97d-f3b0-4dbb-952a-22d2eeeaa8ac", "value": 1626112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674887732, "uuid": "ae063f45-3d01-437e-a0bb-9a6670eaf2fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674887732, "uuid": "1f227eaf-4535-4c30-8b66-8f9f4b3f0bc9", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7535\u8111\u7b80\u4f53\u4e2d\u6587\u7ffb\u8bd1\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b0edfe-9efa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674903247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903247, "uuid": "579a179d-5cdc-4d0b-8e39-8c3f9a538bb5", "comment": "Malware payload", "value": "6263fcde1732f9d6ab7b8b65d1666fbf", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "rassstp", "colour": "#B17162", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903247, "uuid": "24a41ad8-020e-43e6-9ba7-f90b0cdab4fa", "comment": "Malware payload", "value": "e58377cc01153b6829bf71c45e5a6d75868aa455155b930dd878d668788fb02f", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "rassstp", "colour": "#B17162", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903247, "uuid": "108f38a8-a8e2-4a66-b886-8894e001fd5b", "comment": "Malware payload", "value": "b529a7a17decf56ea85e8d0636cd8d098dcc955c", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "rassstp", "colour": "#B17162", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674903247, "uuid": "0c4c8558-1ba3-4b3b-b98c-227818f3fecd", "comment": "Malware payload", "value": "1734676cb8724f8619176f44c73aca9e681dca691d82bea4064805c49266b452f0fecdc57a4d6ba7d40a5374521cfd43", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "assembly", "colour": "#A87AC3", "exportable": true, "hide_tag": false }, { "name": "driver", "colour": "#65C4FA", "exportable": true, "hide_tag": false }, { "name": "rassstp", "colour": "#B17162", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903247, "uuid": "1b5efa0c-99b7-4d1a-b10a-195be84191ef", "value": "T19F93296C6264247AD05AC9B898F511E5E2F03CB1AB3167EF04D1C336CF07DD96A39B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903247, "uuid": "72409d4a-5e93-4fe3-9c5e-db6da3371f94", "value": "8ea5f8e3663c1db12aec3df391569da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903247, "uuid": "a7bb3ee6-b95f-4103-a21a-8f4110c44998", "value": "1536:IpzDoTvOWmAXZGJ7xXgdYlUF0lRN5QV5Y9bd/TF9GA0fil:+DoTNmAXZGrwdYKOlRNe0dP+Kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674903247, "uuid": "2a3f6945-c232-4298-a9bd-be2fc30e1943", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674903247, "uuid": "c2019859-ecaf-43f8-bd25-1ac6fa5fe054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674903247, "uuid": "127f9405-7480-4c6c-81ab-a6bbb3b40ec1", "value": "rassstp.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04b1a13-9eaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674871346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871346, "uuid": "3609e97b-ab97-470b-97bf-086dab9bce69", "comment": "Malware payload (RedLineStealer)", "value": "bed1da074f5bd56fd5893e3abce7bfac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871346, "uuid": "d54c405e-6450-494c-9ec6-a69c5ae430ff", "comment": "Malware payload (RedLineStealer)", "value": "e68f8cde068df47dbbd8040532ccac127382fffa90552434cfb657df8a001e50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871346, "uuid": "a1a440d6-a42f-411f-9cc3-e96fa4ba1dc0", "comment": "Malware payload (RedLineStealer)", "value": "500a72f3f7d5aace9ba9346547b2af98952d2137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871346, "uuid": "60e18e57-9c59-4cfa-b4e5-f2feecc85f8e", "comment": "Malware payload (RedLineStealer)", "value": "28999e6e9df7e2466e3f27fb4261b71a626cf7d06bbdb683a0f97e6d662973236565b93cc56e7f180e767b9530b346fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871346, "uuid": "14eeee57-e223-4111-8cb4-a579dc1b5de2", "value": "T1D884CF0266E4BC45EB57EB338D1AF7E8B51EB998DF5423F91228EA0F19B05E1C163350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871346, "uuid": "d61a8a7b-5b34-4c10-8e67-4d6c49a7d5b0", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871346, "uuid": "74283df7-0cc3-4365-9eab-fed317bde449", "value": "6144:JLlEmSrAcew9vKb5pIIDcsr2EfV49x9CEbnVn897I8dV:J5Ev8ceEI3IgW8V+LCWl89pdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674871346, "uuid": "445ef3d5-be2c-43bd-9ded-2cffcc30a424", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674871346, "uuid": "e5838f40-3e41-47de-827c-92e643d5625f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871346, "uuid": "f2c7d276-4152-4313-8129-0629aec05373", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1c8489-9ef7-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674902131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674902131, "uuid": "e1cfedc6-b97e-4761-8ee4-8ab4bc887db6", "comment": "Malware payload (njrat)", "value": "c4ff7ed2fdd78e955169b2011d4c09c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674902131, "uuid": "de60593c-e5ac-44d8-9528-1f47096a0107", "comment": "Malware payload (njrat)", "value": "e6c31f794bffc65abeaffbbf3921f7f6a30b6b1f8e9247360d57e9d1e0ce5050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674902131, "uuid": "f29bd039-3275-4a84-98a3-cc7c52b2b730", "comment": "Malware payload (njrat)", "value": "d32b6c31b98a9c377c5d0f768db11e106c9c4b03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674902131, "uuid": "b802b721-024d-4480-b3bf-e062de8eaff7", "comment": "Malware payload (njrat)", "value": "3c2b0f89f92b82b5b4d22a1b9c1907e09d303a32f83f2440495fdc1109078df093b87a855f2488be6b508584df21c0b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674902131, "uuid": "3b5bbbdc-6ec3-431a-9c29-be6e86a8c357", "value": "T1C413E88CB694E174D5FF8BF1B4A2B2890B71A017A906D30F99F114D94FB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674902131, "uuid": "d30bc8df-c63a-46e7-9e92-afaf539390ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674902131, "uuid": "22de8a03-8d89-446e-ac5d-fb80a5257c90", "value": "384:1Zy+0Yz/wpa9GP4Uy2LLgS6SEc4lhQzIIij+ZsNO3PlpJKkkjh/TzF7pWnbuBgra:fJ0KR4gh2/gN646uXQ/oeup+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674902131, "uuid": "6d19206f-4d17-4383-97ae-4a07329fdd9c", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674902131, "uuid": "6c49cfb8-6e74-470f-bfb2-2358fc287999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674902131, "uuid": "77251526-e1e6-4423-9e05-94acfa940bfb", "value": "c4ff7ed2fdd78e955169b2011d4c09c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8859d3e-9eff-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674905693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674905693, "uuid": "98cf01aa-d50b-45c7-a4ac-f71711a93ecc", "comment": "Malware payload", "value": "a89153053350bb2e3484a326740e94ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674905693, "uuid": "b82b2def-e4d2-4d45-870e-03c40598db78", "comment": "Malware payload", "value": "e7543732bb14119b48d9b80558d9a494bbd4db34d5442cc0e4121ce858dbfae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674905693, "uuid": "5a0ac844-2bf3-4d31-8fb1-5ed0ff86e147", "comment": "Malware payload", "value": "eebce05d4b69c84541fbc1ddbe6343487c30c87c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674905693, "uuid": "48fc9582-5ddf-418f-b304-fd21ac4450e1", "comment": "Malware payload", "value": "ae515d3320a453cc0d99e5c3f2c5809724ac5bc03602142d93a5e182b6b8ea59c1b1f7644d538ceb51679b29e326b1b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674905693, "uuid": "2facf791-934c-4c05-ac7f-9d4429db3437", "value": "T10576334734E2CF79C8AC06B78FBDBA8DF9A5E1654C26001337889E7CBEE4D05521A764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674905693, "uuid": "f33cc9dc-a88d-4d98-a47d-27e301deea90", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674905693, "uuid": "48b5d2e6-fb94-47d4-b5b5-2fb1db0db78b", "value": "196608:91O2joANrY9V+GQ5ayFUaH2lcxygjphQ1e48Ku64Df/N:3O2j1Yn+55a8ClcxtjXJ3d64DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674905693, "uuid": "37da4e21-5d83-4992-a996-a36266cb7bac", "value": 7621711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674905693, "uuid": "adf4dfc9-ded1-4e19-962f-f99d0125bc7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674905693, "uuid": "f38df99d-e3a1-4b4b-af40-94297dc01af0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed958726-9ec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1674880845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674880845, "uuid": "366b4d8f-6d6a-4238-aa7c-e8aa45f618a6", "comment": "Malware payload (TeamBot)", "value": "3cc4a7678457376b7d19b95d5a9b7f8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674880845, "uuid": "ea933ebf-d53c-4b3c-8cf4-c2024be458ce", "comment": "Malware payload (TeamBot)", "value": "e7d3951aca4f72f403c70b897c53054adc2628413dca3f72c9268dc0349e4b1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674880845, "uuid": "f80434cb-b2b1-4d78-b71b-9848042b294a", "comment": "Malware payload (TeamBot)", "value": "35b231b2da92507f7dd78c24e22cce907fbe6288", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674880845, "uuid": "3cbd81f3-30cc-44a6-82ae-abb2913a54db", "comment": "Malware payload (TeamBot)", "value": "831e7c875681286a99370459de284ac66d4372ba5ae1b8131ebc0bf05333204ec6cb2e34a96832f59d918959bb9669f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674880845, "uuid": "a0892f36-1c4f-44be-800f-2e47982a650e", "value": "T17654AE0266F5BC88E967E6338E1EF7E8B51FF990FE5526DA1208AB0F1D715A1C163301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674880845, "uuid": "44f329e5-5ff9-4094-a86c-a4966d1c8f4f", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674880845, "uuid": "bc830fbd-33e2-40e5-b22e-05246cdb0864", "value": "3072:vD0RLwLlju5UHTPd3ir2jCgKrg8AnOl1Q+BCFyzF1go9ClANbFrZVngcsD8yq/dZ:PLljP5dCbtg+BYyBx9CEbnVnqn8dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674880845, "uuid": "405e60ff-65e4-4ef4-a1b4-9f806dd64893", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674880845, "uuid": "b3f99922-902a-4c3f-bc61-3943a5e31abb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674880845, "uuid": "6464c88c-7615-4b0b-b635-c8cf7e6f9ec0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bb8249-9f19-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674916740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916740, "uuid": "c05ce504-3444-4efb-aab0-72ea552c1da5", "comment": "Malware payload (Smoke Loader)", "value": "09ceda32241950bec35da440e548a44d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916740, "uuid": "99804a02-3e4c-4761-a863-06f7628ef91b", "comment": "Malware payload (Smoke Loader)", "value": "e872593defeaf60b674090731451e3d164062602e87e3b6c96ba775ff97af52c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916740, "uuid": "636ab640-42b5-4a13-908f-7232bb122113", "comment": "Malware payload (Smoke Loader)", "value": "85d9e6933ec514d9b131a2b3418dd158bc887f5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674916740, "uuid": "707ce201-e232-4b5e-bc1b-0beca0dcc339", "comment": "Malware payload (Smoke Loader)", "value": "43ab243943775d94f5aeb607485ca91741328b198c0625bc044503ec80d945306a68c1edc7ac805b7e55c48d042ccf91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916740, "uuid": "7fec5b25-a6c9-430e-95c9-ac8fdda7fe56", "value": "T1FC549D02A7E2BC61D925CE73AE2EE6F4771EB4508D15372E1A04AF3F18F1177C56221A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916740, "uuid": "49f087a1-035a-4e34-b795-b4e07a691c1d", "value": "d191080c270d3118935d8b6a682d2ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916740, "uuid": "2f9bd1d9-27b6-4340-95e1-7c9c7cad9b27", "value": "6144:n7LD8ZbOLBht5N58MbtovqSwzIDMAdNcSP:7v0Cvt5N3WvqSAeMAdNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674916740, "uuid": "776aefcb-76ae-412a-be87-0166e0b669a8", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674916740, "uuid": "a7945e3f-7a2a-45f3-8683-01fdd75a9e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674916740, "uuid": "65b4163d-3df3-46dc-9e8f-9871bc6d6fea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd9569e-9eaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674871260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871260, "uuid": "132415e0-9940-4555-946d-afab5e8b710e", "comment": "Malware payload (GCleaner)", "value": "bf459c46a8c8fe7f0c37017c74710031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871260, "uuid": "336be114-a207-4eb1-8d98-af0ceb699e37", "comment": "Malware payload (GCleaner)", "value": "ea23ab92a13df9aca400e7bdfc0ad6fd33b7e2bfafd6374f118330cc0f51c733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871260, "uuid": "9a7b4e47-62d3-46ea-8337-371396359e08", "comment": "Malware payload (GCleaner)", "value": "82e76103a5f8b719f5df79edd8c1c5ac0a008b81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674871260, "uuid": "f3eec611-249b-4b5b-9c78-24f7c906789b", "comment": "Malware payload (GCleaner)", "value": "f6e0a74133acd8554b9ccd7dd810ac12c5262cbc9f0516ad6d5d32543646958df9791b35977312adcf1728f6ac4900d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871260, "uuid": "39cb202a-edef-4328-bcd7-7b4c064bb375", "value": "T1F195330699D1D2BCC973CAF93A34A504D333ED8F15BE2505B65913ED2E3A6202DB32E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871260, "uuid": "ed21b74c-2f63-4477-b6f9-1ee4bd8d34c6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871260, "uuid": "0df6217a-0e6c-4b41-b223-ece1b54e7624", "value": "49152:okug+EIq/TcLA6y15UzIQWHu+GEi0WrExAXLLLCgv2MR:hug+ywB60I7O+2rK4L/v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674871260, "uuid": "d25847da-93b0-45fb-b4a2-744c1e63454d", "value": 2006687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674871260, "uuid": "5bda0ae7-c955-472d-9d24-abee235f1275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674871260, "uuid": "7ad0cb0d-6987-49cf-805b-71052473f667", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abe9ccd-9f4b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674938231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674938231, "uuid": "e889cd27-7659-483e-ac33-9daed44e7a1e", "comment": "Malware payload", "value": "74d07aabdba53cf89e623ed02bb0ea09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674938231, "uuid": "9e118ea1-8ae7-467e-b309-e84090f947b7", "comment": "Malware payload", "value": "eb8fd82efeca47327bd8ebac4cf96dc2074bcb3dcfc57f32c97ebf68d4a55fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674938231, "uuid": "86d6446d-4f9b-4fcf-bdfb-6725112f4d25", "comment": "Malware payload", "value": "7c72d942a5ee4c8a2ac7afb45e4c0361151fd5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674938231, "uuid": "47dfa170-1c4a-4899-be1b-93c58851cf8d", "comment": "Malware payload", "value": "ea0dce0e06c3334c562d635b94bdce381a0bf2219bdfd5b2ee3cfbf94135c1d450e02a4637718d585a6417173ac9a86b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674938231, "uuid": "eac97bb5-e5c3-4d51-bf3a-63ca0bf81156", "value": "T190547C0267E2B860D925CE358E1AE7F46B2EF4518E1477BD2A146B3F18F1177C5B2238", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674938231, "uuid": "7657eab0-b6f6-45da-b096-52412d3b7bd4", "value": "a5cda000ff4d200b1a7c245df76a958a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674938231, "uuid": "f358245c-d8d2-43eb-87fe-245c4d5f99c8", "value": "3072:n7UnILh8540K3kR7MXX+YthzQ+HzBnIyCSyxzID1C7hZWLTceNsiuNZ:4ILhF0Y77txFHlqSwzIDMa5sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674938231, "uuid": "7718ed16-fed6-4e52-9c67-7587648ec808", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674938231, "uuid": "8e690c61-b5e7-4806-b031-3dc6b91ccc60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674938231, "uuid": "5f77e511-1850-4161-b385-2ed50bb13ee4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d77fa3e-9f31-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1674926854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926854, "uuid": "407fbca3-ef66-44db-b1c3-6b0a39ab6441", "comment": "Malware payload (QuasarRAT)", "value": "ff489ab462ca00e089503283dd83888e", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926854, "uuid": "416c0103-d62e-429e-b0fe-695fd7302e11", "comment": "Malware payload (QuasarRAT)", "value": "ebf3394f6ce4969ede9d837e55859ad751e02b46f795eae697fabec92d3252a1", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926854, "uuid": "b60dd804-5646-4e33-a874-936df80552ec", "comment": "Malware payload (QuasarRAT)", "value": "5608b77b509bbfa4ae88c3a426591a0913fd1e2c", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674926854, "uuid": "5aa5182f-04c6-44af-8e61-c7d059c0c43e", "comment": "Malware payload (QuasarRAT)", "value": "9f1fb3264144cfe1b75ea3058ead67e7a49c86deb00c0943e583a23ba03719295d5216e971461e36c5a200cf4033cc17", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926854, "uuid": "91715e10-f4a4-4480-89dc-737054b7249d", "value": "T1E053F6567682C44ADA9847354CE2C6EA7B33FC918E7B83073254F72F6EB7690D903606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926854, "uuid": "49388507-3f10-4623-9373-44ec787c017b", "value": "1536:RrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAUPdbQ44Oh0C:RrxEtjPOtioVjDGUU1qfDlaGGx+cL2Qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674926854, "uuid": "23348d38-2cd0-4ea2-81c6-0e3bbf8cdf4e", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674926854, "uuid": "28784a29-f802-47a4-9790-15b23b5681e0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674926854, "uuid": "bab2c917-22fc-429b-889d-e38d3fe13e39", "value": "Comprobant.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c4445d-9ee6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674894889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894889, "uuid": "8d495ddb-8aee-4e10-a95e-4b90b1c892ff", "comment": "Malware payload (Mirai)", "value": "f36fd4093f2fd64b11b10e5f8a482bc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894889, "uuid": "52ae1fbe-bf2c-4e5e-8989-0ad92bf465a6", "comment": "Malware payload (Mirai)", "value": "edb0d6c1cbda8bab47647c8979578a572a7345ef12543ee73abf7d94446fa1b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894889, "uuid": "7e7b7346-fb6f-4b8d-9d50-fddf1797dc94", "comment": "Malware payload (Mirai)", "value": "42fe30ec3101521e71b33a85d8201a870aad8827", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674894889, "uuid": "4e39b92e-0e4a-47af-8e43-da52ee712acd", "comment": "Malware payload (Mirai)", "value": "47d7e91157a340708eab7a818ce6f29be1f50ee0d6168658fa46d72f532a116106729258bd839fd70c901d6b6f324fa2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894889, "uuid": "184053f3-fc34-4a00-9023-656e1fbaef32", "value": "T11CC2E1B15BD07152D5B01671F1380654532A8BF48ACB30F320BC466EEAEE416ABF9763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894889, "uuid": "82850e2c-e7f3-4726-93f0-45f642ac2bc6", "value": "384:bPg3/L9bmCDFw1D2y8HBLQqaGGZn2mcM+C3hNvJj2fOWz66WTohht9cmdGU5Ed:bPgPpbdxVv1ziImcGvyOWskhz9c3UO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674894889, "uuid": "74711155-e6dc-4d22-9f27-6e439416f2c7", "value": 25904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674894889, "uuid": "45ccdfbb-143b-47fb-adf7-d424d46df441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674894889, "uuid": "6e9ea6b8-bb9c-4427-ba11-3fb07fdaaca8", "value": "f36fd4093f2fd64b11b10e5f8a482bc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b53058-9f33-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674927992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927992, "uuid": "b07d59b4-6ea6-4a88-9a16-aeda8734268b", "comment": "Malware payload", "value": "f0f9a2836a9a890a8e448d0209ab33ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927992, "uuid": "81a46460-c189-456a-add2-87d6d0bff705", "comment": "Malware payload", "value": "ee466fc091b6357f496c73d8970b787adf36f81412e0c5e32e6487941613b500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927992, "uuid": "d986b488-de87-44f7-98e3-46534a14cdbc", "comment": "Malware payload", "value": "06d52d819b948d7034f8a016e490c5f4032fb876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674927992, "uuid": "7638d6c7-6f68-4573-b9f6-a7d83f38c540", "comment": "Malware payload", "value": "4221f6ef8c48d9875c269ef6c06100872e8254dc3edc03a9f84267d477566246a6e151a25d8ec2975dff264e40917f06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927992, "uuid": "b17080c0-5034-4b7a-8a9c-d3933247b115", "value": "T1D37633B279E0CC74C2A2153BCEB11B78A0E7EF141D2A1557A78186C87F79ECD9879702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927992, "uuid": "f86ad553-3b11-419d-a714-029b039c317c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927992, "uuid": "14497d50-c4bc-4780-ab72-8ab4badb3821", "value": "196608:91O9Wu4M+2WMmiZga9IG3jW12mleXl8qTPrMLhoGTmmeeq:3O9WI+8r+a9LEJeXl8qTPr8hoGTmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674927992, "uuid": "11e36e99-e99e-4dd6-93dc-7bfb29870b6a", "value": 7620561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674927992, "uuid": "0215600a-41e0-485c-9aab-fc451a1e8a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674927992, "uuid": "8b21542e-dded-4869-bd06-d7beec7c9f99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14751842-9f24-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674921282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921282, "uuid": "a68aa652-7b90-4582-afc0-8af481c54de9", "comment": "Malware payload (Smoke Loader)", "value": "033292eea92f116fd01a9543d0baac9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921282, "uuid": "ea274f4c-a470-4a73-9b46-feda32505aa4", "comment": "Malware payload (Smoke Loader)", "value": "ee4add6cb9612894713db05bd1e53ef93bb2426af5dbad4d7d22b6e8a473b3f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921282, "uuid": "91fa0519-ff72-4448-9c2e-e3f07e44107d", "comment": "Malware payload (Smoke Loader)", "value": "bd40c4afe760682ef7e1c636220470668a815207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674921282, "uuid": "9bb739fc-0b90-4056-baaf-ae430c98522a", "comment": "Malware payload (Smoke Loader)", "value": "d74c36fcafafeaed0828a105ad2dde89006fd417b28f4b5630174bccb7ffa3b044967475d2b5bdaf2088108ecbbaf48b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921282, "uuid": "e1785620-673f-4488-a4d7-cc2ad5d081dd", "value": "T11D548D0267E2BC60DB26CA768E2AE6F4779EF4508D15732F1A145B3F18F1177C9A3218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921282, "uuid": "db720005-d70b-4134-bca0-ac1d915c2831", "value": "d191080c270d3118935d8b6a682d2ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921282, "uuid": "3abb21ee-0cae-4e21-8d61-cf1fa7f51478", "value": "3072:8GxaLlL5AvLLWi996/qZuRXJ3kR/2GZp0R296bMv4nIyCSyxzID1C7hZW5aYwCsD:YLlqeia/qoR50MMpK29FAqSwzIDM2qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674921282, "uuid": "0fb3a4e2-1b37-4e78-a3b9-b7101561d348", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674921282, "uuid": "3cc2993c-809d-4def-8263-dd38e9f2d958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674921282, "uuid": "8265e3d8-aea7-4db3-9766-a292192d691f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4cb7e0-9f3e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674932521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932521, "uuid": "4aa39950-ee76-4cd8-ad8e-281059079e3e", "comment": "Malware payload", "value": "d0cd8f1da1f1fe30516040c67b5412c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932521, "uuid": "3acf686d-758e-4dbe-a601-1153a88a0a9a", "comment": "Malware payload", "value": "f22b3d20343d09a34c564fa70f34966f300594fcffce130b7b9a01164c654b91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932521, "uuid": "da42a65f-be43-48a1-8104-1a444e7b58f5", "comment": "Malware payload", "value": "79bf3c1a723f92920ee154edb6687aa005e8a0cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932521, "uuid": "9dbeef7f-1f2b-419f-b49b-64b3824914e1", "comment": "Malware payload", "value": "00522543d6f6303e5254a867042ef2bb91b39bf9245c60698c664e91d93ad24b6726264b84b5c281ccd84b324a53d16f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932521, "uuid": "0dc9f0c9-a7ba-454b-ba0d-d36ecc7908be", "value": "T16C7633953CF364F0EB8105730A2CEAD5AAE8A1504F66669333FD174F2D7D09AE069E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932521, "uuid": "c97f6875-0895-4b11-84e0-f867a728d0f8", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932521, "uuid": "5127506c-81bf-499b-8e74-1d749a285e12", "value": "196608:91O0Lw7aozMwbG5bcupLJ0KCRBrblSShEh5:3OEwRzibnv/CDrIShEh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674932521, "uuid": "a127a519-da75-49c7-98fa-2ca289114b20", "value": 7606717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674932521, "uuid": "e5c3b01a-9a75-4e37-b3c6-0b778def6bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932521, "uuid": "f9b355b0-1dba-495d-87d8-f58535bbf763", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754f5688-9f3d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674932182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932182, "uuid": "576bbc30-c721-4b31-8ea8-1ee711f1a655", "comment": "Malware payload", "value": "43e377046398e6a7b6c26bf829b996ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932182, "uuid": "2fc8656e-0dc8-4862-b821-fb1e00889634", "comment": "Malware payload", "value": "f24a4c53dae682ff8bd08b226f9f4b685840153c27b6ef5813290d38434949ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932182, "uuid": "bf98b56c-c9c4-4638-96e2-0b42bb3e0210", "comment": "Malware payload", "value": "cf1f5d1d54f3de0b09d508aded8f7a57c9f9ae07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674932182, "uuid": "1e5eeb3c-ad4c-44a7-93cc-122751e6348f", "comment": "Malware payload", "value": "26fce1983c3a630ff24ffaa61a886a2ff3658939b8aea97612fbb71134eafe41ca1dec74ac9e98be7f8e63232601dd5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932182, "uuid": "1a021af9-ad09-49f1-9095-88d090683164", "value": "T1BBF36BD1A5D2E5E3C79945F0E048F5F8A2FE7C60C62C01CB168A3E06B97FD99D936206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932182, "uuid": "49e9c357-b5aa-443b-abdf-0e8e6035a3e3", "value": "78347e8ca7a80658201c5366a8b9706e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932182, "uuid": "d7b678db-6b2c-4b33-a40e-5f6ac0aecc29", "value": "768:Dz6Gwy7E2OreQTFwf32MVnZbmQNLk7mtlqWGG9Lto8hecAD9Grp/2mPYHfMDy4IL:ZyrRqf32MXb38mSzuhPAK/23kTktXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674932182, "uuid": "64e34d12-055a-4f92-a47e-29937505dd38", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674932182, "uuid": "16c3f522-fd1d-4b5a-a82c-6e2ce8c171c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674932182, "uuid": "77e4c6df-aa43-4497-9558-3bc052a33363", "value": "43e377046398e6a7b6c26bf829b996ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b089a03b-9edd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674891050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674891050, "uuid": "27fe704d-d14e-4917-996a-99ef2e7aac57", "comment": "Malware payload (RedLineStealer)", "value": "ea59ae45add9a30f2c01bd87b6364e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674891050, "uuid": "fdaf0f9d-7d8b-468f-9df1-3686dba69d75", "comment": "Malware payload (RedLineStealer)", "value": "f3cd17e1015ad1bc732bab0651969c1b9fd5aa062b09227cc66a033d96737263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674891050, "uuid": "dc44a27f-9462-4849-8c49-7db3eab86579", "comment": "Malware payload (RedLineStealer)", "value": "780fe34554c50f00e8b97c33a1c29a794fbf02da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674891050, "uuid": "32e60191-52f2-49b6-ae62-466b5b9907a4", "comment": "Malware payload (RedLineStealer)", "value": "739bd7365e0e0c21d3deff2354e128e05179561c97177979ce5f5c31bc986d1b9b3d100370b34cff0dec300a493989e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674891050, "uuid": "5a23bc84-41e2-47dd-a868-518c6253356b", "value": "T1A284D00276E6BC45E757E6338D1AF7E8B51EBA80DE5527FA1208B60F19B1DB1C263301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674891050, "uuid": "6286cef6-330b-4580-a073-949d977364a5", "value": "4bc9925dd568c221c7d9868dfc769dfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674891050, "uuid": "0d3775b2-8ada-40f7-a5ed-f1b46a7e97e1", "value": "6144:hgLpBdfOt0SkXmkDE+nEUQI37DoegQcex9CEbnVnB8dV:C9Bl0UWiTDrceLCWlSdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674891050, "uuid": "1c40bb34-1cbf-436a-8c1b-c17dd312c0a7", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674891050, "uuid": "c11417e4-15a7-49e0-8788-0d6ba2be505b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674891050, "uuid": "68801a51-92db-4600-81e7-d273cead733d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8467e507-9ec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674878521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674878521, "uuid": "13234ea8-705e-436e-b0d9-83d99406d8be", "comment": "Malware payload (GCleaner)", "value": "5d1a16927fa4e6566e168569142eb098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674878521, "uuid": "0a716e4a-4455-4edf-a0a5-10b3830203a5", "comment": "Malware payload (GCleaner)", "value": "f53022c7e0c9707ae32aad534583d07bc6c7cf0c83d143a924170b364f9abf0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674878521, "uuid": "a5896fab-97be-4df7-b6a5-8fb85912a684", "comment": "Malware payload (GCleaner)", "value": "42b2c1b87b48942bd57f9cd9a834fe0ed6f9d015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674878521, "uuid": "f95b22fc-960d-44ea-b936-2e1785c90569", "comment": "Malware payload (GCleaner)", "value": "10ae8e97f08abefde9799bc43d008646ce128d5f7b1b083af86e428ed811ff187945be3684a8393d69ef4011cad1ac6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674878521, "uuid": "54975c9e-a371-4184-b444-81b84ba451d3", "value": "T143B5334BA681EA3DD863C5B9E1358540AF71FD8FA07C0618B76853C90BBE1B185B3397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674878521, "uuid": "ea50bee8-b5fe-43c9-bb22-7dd2e9468857", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674878521, "uuid": "e49f0fcd-49b8-4875-8828-c6e33d91b144", "value": "49152:okug+2GEMpS9xQg5Q4fezu8conGhG43orp3qCX2LCgv2MR:hug+h/s9xQgBezuv7hG43qRlmv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674878521, "uuid": "d36efbb4-a577-421e-b9f1-1fa456d24edd", "value": 2339536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674878521, "uuid": "1f63eec7-21c0-41df-aec7-f957cc8dc3ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674878521, "uuid": "2c41bd65-eb6f-40d8-9f47-b06981b54606", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cad979d-9eef-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674898533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674898533, "uuid": "75f5f97a-0767-4eff-af1b-3b0496c03b37", "comment": "Malware payload (njrat)", "value": "adb4a865b7fbf70cb75e71705c81984d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674898533, "uuid": "7a924236-ad8e-4a99-a7eb-da45b19459b8", "comment": "Malware payload (njrat)", "value": "f61e44d666b00fa9c0838349af8ff5fca503f1c2d880db8fab96bc8004fcf1ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674898533, "uuid": "e5242689-9a76-41a0-bfbe-aed162bbe05a", "comment": "Malware payload (njrat)", "value": "fec049b1cdbf20d1e28b475a73e6a3aacca75c7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674898533, "uuid": "60242d01-a981-4c64-b6d6-e29b73a570aa", "comment": "Malware payload (njrat)", "value": "08fe5369206cd65c3b9da17513ab61c7adf0661a288dfa82507ca8ea20d8be12de84fea55323057031928e28f69876a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674898533, "uuid": "76a1d2d0-0124-4c81-9657-edf31a6b7727", "value": "T12CC2D006A3D6B2E1C9254EB713B383516AE06315AA271F7E19900E8BFE93F960C597C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674898533, "uuid": "81828574-89ac-4ca6-b167-ff0b7d903dcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674898533, "uuid": "576f2cee-e949-4e1e-bde6-0d71bf78b80a", "value": "384:sv3ZIBEA1wAOKeZYrHfeDgj46iB9Vcp0F9h2HbmdPvo8I6CQdxR8HhrODvFmV:svpRA2446WDMiBQpwgwvj1CyqHhrODt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674898533, "uuid": "98d8c9cb-0e33-4bc9-b9a5-e06347233af6", "value": 25986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674898533, "uuid": "2fd95fe5-77c5-4344-b616-6b409d21a81b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674898533, "uuid": "a86630be-3de9-4a4c-9f1b-132a321d4926", "value": "adb4a865b7fbf70cb75e71705c81984d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c9b14d-9f43-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674934758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934758, "uuid": "7f67154f-ba5a-4387-8bfc-d0fe7a08836a", "comment": "Malware payload", "value": "d0cc5d745e2dc7c1e696bcc5c2abea36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934758, "uuid": "26c81fc2-5ddd-4862-a6d0-fa64be31243e", "comment": "Malware payload", "value": "f75dc57cfde7efbde644182de35e99b08e4d7e90aa6117953df02e773e00cb68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934758, "uuid": "13e9bcd8-55f5-4a13-91f7-45e94c1a4b20", "comment": "Malware payload", "value": "d1df1eaa82ea31c18a4c6071c75e9f004eefb317", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674934758, "uuid": "badddff1-fa83-48cd-9102-71f6d7fa9cf9", "comment": "Malware payload", "value": "04bfd8d47597793ab7cd3e716f4a00b0f5fc6ec3918ce7a7ef9c02b1d604b7ec8689eb5335f27add5b6d76c07fb58d67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934758, "uuid": "fbecf13a-e2e2-4e0c-b0f0-3f3d6f48a10b", "value": "T14C611ABDDC84CCC9ECE9ADE7C896FC8E8615761464E93083E11457A3061257ADC3B462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934758, "uuid": "d38b2f41-af7b-4d4e-8c14-0fc9d3e4c41c", "value": "96:9WnUEzCVu33ahSE/wxJ2KQsA76ZdRRdca/RYSf:kUETnpewxUKRy6Zdx1pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674934758, "uuid": "f4d85a56-f9aa-40f0-b29f-6cb78292ca52", "value": 3380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674934758, "uuid": "474046a2-8fe8-4df7-a5b8-7c5bde1d7733", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674934758, "uuid": "e0cefd86-38f7-4b20-820e-78cae8ae82d1", "value": "inf.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad7bcf1-9ec3-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1674879900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674879900, "uuid": "685d0dc8-44ce-4329-b3d8-1817386e5888", "comment": "Malware payload (DCRat)", "value": "e14d3c54fb43442b8c99febfb7007d71", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674879900, "uuid": "a20869b5-df1b-4b38-9c0b-bf39d6de9604", "comment": "Malware payload (DCRat)", "value": "f7954923c8a110188d24e4d27e68e57d7d1781882644386e57fbfb183b94b366", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674879900, "uuid": "fd7a1ab7-dda4-425d-9009-775131d8677d", "comment": "Malware payload (DCRat)", "value": "5f2872a705eb75516e491b0a3e57d8fd945a23c5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674879900, "uuid": "e5283c51-3970-4c67-8026-d56d7f18a191", "comment": "Malware payload (DCRat)", "value": "1be985198f0ccee5d75f4c5f7b01a4069badf6d51cff9d5e35313a930f9e4c26c32d3eea5d7d67c8f4b0d2b0264a3e39", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674879900, "uuid": "d0ec26f6-3e34-494f-b6c4-4a025e74b846", "value": "T108B5F08B66ADC905F184917EDE27E1F52E212C84D4DFC207B2A0FE7A3A7134DD9221D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674879900, "uuid": "65c837ee-7101-4deb-8414-c3dec45fa252", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674879900, "uuid": "a60e2818-a411-43e0-a291-b03687599e64", "value": "49152:JmYP7zNGoWl6NcM8HLSqHmNMZkWHkF+H:JmYzGQWJrtGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674879900, "uuid": "774a1ccd-ec21-4607-b967-2c879de7a29b", "value": 2286768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674879900, "uuid": "442ed479-c39e-4577-bf59-56f14c77e6db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674879900, "uuid": "049de9a5-3e4d-42fb-a00e-df79c1910eb8", "value": "InstallFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d11793-9f58-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674943991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943991, "uuid": "22bff265-5f3d-42dc-9f33-95168711fa62", "comment": "Malware payload (Mirai)", "value": "bd666448c39b0e995b7446d60d3438c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943991, "uuid": "e5a2ff1e-bfee-4e82-a5db-aff6246907a3", "comment": "Malware payload (Mirai)", "value": "f7aae4c520e124aeee0167a85ed00375d66c943279909e0378db3cec0e4a8d6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943991, "uuid": "498ca6c3-a75f-4fb5-9616-2d007fd425a5", "comment": "Malware payload (Mirai)", "value": "6416002b0b1f07b9f872ac9347f85af7db2feb65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674943991, "uuid": "80f8ede3-08a4-4a56-ae9a-bad1563bd221", "comment": "Malware payload (Mirai)", "value": "7da6a0c7d7c9892f3cea38374ef417647aae10cb9231fa86762b9caa4ada60625dcead98c38b0a18be515feef2222bb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943991, "uuid": "9624c1ef-1229-4925-923f-8430becc2d8a", "value": "T11AE22B47C883E9B9EC1145717067AF728A7BF62A22A5EE83C39C7532D902602F61774D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943991, "uuid": "532f47df-5ce5-4fd1-9559-725e57072902", "value": "768:KO2CPhcN+JGLkuoPI5JXbwFreC6QQmVUC:KO2CPhU9QObwVeC6TmVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674943991, "uuid": "09fcb187-0130-4902-8aee-c400f2586349", "value": 33552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674943991, "uuid": "f70df998-641a-4663-a993-1d8d40dd0679", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674943991, "uuid": "0af520c3-cc27-409d-bc2a-742f98a7d2f6", "value": "bd666448c39b0e995b7446d60d3438c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c74a382-9f5b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674945052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674945052, "uuid": "c51c5d74-773f-4ba4-a522-83d7a8f2ec9b", "comment": "Malware payload", "value": "cc4b4bc6b614423b12778524d030cc3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674945052, "uuid": "e0d1fb8a-2c3a-4e6d-94fd-3cb24b6adf7f", "comment": "Malware payload", "value": "fa3cf7d9a814596ad4641e906c2f524eff3b948c2dc36460d0b477030c307314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674945052, "uuid": "2c385476-1e7e-4c19-ae3f-91d614497116", "comment": "Malware payload", "value": "06903c66b69ac4c59a74c53cb2ebb5dd1bc91871", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674945052, "uuid": "a91b5774-f2cd-486c-bcc1-ae56456bde22", "comment": "Malware payload", "value": "58621ea04f43fcf948a93f86e98c5cde9f2f7d2c7009997e6bdb1cf3865bf0cd7ae46a6c9cc343a674b41ea1a1f06940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674945052, "uuid": "2128c550-dc0a-44a1-a9d6-cd7222d9f55c", "value": "T1287633043BF146FBD3928B3699251EF1E135C796871CE5A327EAAD3DED3D0A08C24694", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674945052, "uuid": "d275b2a4-85eb-437f-88a8-16d3a6e387a6", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674945052, "uuid": "f9914117-5bbb-46f1-b1a5-91ef492903ee", "value": "196608:91OPx8rgnvA6N0Q+kSPTvIoToV1rELv9h:3OJEqvL2Q+BTvIoToV0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674945052, "uuid": "3b5d3638-1a91-414a-9328-c7539e129cf5", "value": 7644551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674945052, "uuid": "983cad17-9e04-4569-8e03-8a920d161fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674945052, "uuid": "8653ed08-ab0f-494e-8996-1d0906a0b8ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcdce5b-9ea7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674867802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674867802, "uuid": "4716a023-9317-4afd-be71-8c0b2c6165af", "comment": "Malware payload (RedLineStealer)", "value": "6533b285317933a9008b1de6be529baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674867802, "uuid": "1411eb88-6a4b-42d4-a3fb-61be2ad35678", "comment": "Malware payload (RedLineStealer)", "value": "fa923f02952ab4879d190b7c6ae7da875c9bf3cded9471c05601828f14803d3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674867802, "uuid": "838dade3-141e-4cf0-9698-16cf7919ab6d", "comment": "Malware payload (RedLineStealer)", "value": "c1ddf18bfe5695742eef5b9b8dc674fbc73fee1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674867802, "uuid": "7cb4e943-f6a8-4f03-bb9a-3c18dbf4618e", "comment": "Malware payload (RedLineStealer)", "value": "74e30543d3b918bcef770b24dbb157e03051a389230a0291186ed644883431fc2b1c1902b5dc3a91895a03cdc9e916aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674867802, "uuid": "92d584bd-43f0-49af-8f2e-24900d8ebbb6", "value": "T10984CF0277E0BC45E967E633CE1AE7E8B51EF9D0DE5522D62208AA1F1CF15A3C663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674867802, "uuid": "06271328-c0ae-437b-adeb-c4152690603c", "value": "91bad5df5f4993944370e46a47a36cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674867802, "uuid": "20a3c14b-b289-45bf-aae2-a42d9f5231b0", "value": "6144:0QLfEmHUurEvI6EYlOp48OLlaU+o0Mxx9CEbnVnT8dV:FzE9wz7Rp3OL/X0ILCWlYdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674867802, "uuid": "b467192b-d225-4b9d-98ea-6738bca49237", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674867802, "uuid": "62f5e330-e32b-487c-af3f-34453b849a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674867802, "uuid": "e9a5b4f7-aa44-430e-b3e9-2ef8eca838c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c6e5fc-9f2b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674924427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674924427, "uuid": "857309a2-d3bb-4efd-b498-4fe75cbb5449", "comment": "Malware payload (GCleaner)", "value": "228149d9f262a4a5f20b5f78aa017e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674924427, "uuid": "772afdaa-fab2-43ec-bbc1-cc9ae642f67f", "comment": "Malware payload (GCleaner)", "value": "fa9fe747b301fda13399985bbe72a96ce0f6729ef0cf743791da7f63276608ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674924427, "uuid": "e5d31a3d-2c5c-409c-b300-eb81728eb6f6", "comment": "Malware payload (GCleaner)", "value": "2bf7ecd6b51c452a9bc1a659656c191ecef96b3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674924427, "uuid": "6e0c4b5f-308f-413b-8bdd-66496dc62582", "comment": "Malware payload (GCleaner)", "value": "d8e2a30abc9f8dccb124e5973073c3527159029c1b5fb5ef0c50968c71d427574b316cc50592b07379993aab3c1f403f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674924427, "uuid": "00b8f2df-07b5-4c4b-b3a2-487f13063299", "value": "T16CB5330B525285B9D2F30EBA2A34E6816F236E4F303D26103F05374D1DBA5B17AE57B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674924427, "uuid": "debb7692-f66d-4e2d-9d7d-63e2a6b4f6ca", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674924427, "uuid": "9085034e-db66-479d-a833-ee2a2171091c", "value": "49152:okug+CkdzooooauN1CuXN4RpYnOpeKlOAPrRVaEbRTnLCgv2MR:hug+PdzoqauN1CA4QnOp6AvamTzv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674924427, "uuid": "a76d18d1-3a11-4b8c-996b-0574a21c1e38", "value": 2340940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674924427, "uuid": "fc643997-1a6e-4708-bc23-8162dbcc6c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674924427, "uuid": "77c4de1f-d758-428d-a903-0b9d44462f1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7350c86-9ef8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674902711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674902711, "uuid": "959fa894-70d2-4700-beea-45d3a34752c8", "comment": "Malware payload", "value": "f65863411713c3975a42502ef9267d4e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674902711, "uuid": "ee452dec-369f-4064-ba14-dd8338087a92", "comment": "Malware payload", "value": "fb2fe4ef38622e9b87f52377e046605776f0ae53a60ac60607daf73d61a95fa2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674902711, "uuid": "8da39807-f404-46c5-b1b1-cee2553666fd", "comment": "Malware payload", "value": "71f9e0ef7b145619006c7a5e6e2c0c76e0bbc058", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674902711, "uuid": "b4257228-7e6e-43c7-a16d-16dd8ac6d4bb", "comment": "Malware payload", "value": "e611f75acf4b743c273c75c2a28bf3e44fc7ac4f5472ffb10fe7bee1a4b63e97f477033acbfa143cd44878c71e4bb9bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitmanpro", "colour": "#E0BA4C", "exportable": true, "hide_tag": false }, { "name": "service", "colour": "#D1EB43", "exportable": true, "hide_tag": false }, { "name": "windows10", "colour": "#6D44FF", "exportable": true, "hide_tag": false }, { "name": "wrp", "colour": "#BBEA43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674902711, "uuid": "aaa3913b-6692-48df-ba97-ac9552455600", "value": "T106159119A3F80059F5B79F75997B11159A72BC662B31C5CF2180C13E6EA2F909E38F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674902711, "uuid": "af7df1ee-0757-4c92-82ea-d5714ad7051a", "value": "a2009548941f1fb9f78f77b55514d553", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674902711, "uuid": "f802645d-c5c6-4b17-b321-4c030007d893", "value": "12288:3zW89VfwtPjsuu0Ij+brzKhc7J0G4NMAmXYGpGbL6ltiBz:jWMfmbsG4mrzKhc7J0DMvYGuQt4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674902711, "uuid": "ad3b8f82-5fda-4c06-bde1-0f2eadf8248b", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674902711, "uuid": "8bb30b10-dd23-4094-92cc-e7f4b3814619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674902711, "uuid": "98c462b5-8280-4d5c-9008-af2e6c967106", "value": "netlogon.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700479e3-9ead-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674870326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674870326, "uuid": "cd05c1f2-8733-4fea-a41d-05d8d2145723", "comment": "Malware payload (GCleaner)", "value": "6cfc43563a1c955dd8e3bf8c49b1c0f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674870326, "uuid": "e274401f-c1d1-429b-a5cf-0c92a8c1885a", "comment": "Malware payload (GCleaner)", "value": "fd7cf3b6831247f15f70b4e38db8003cac2eb3713c5d7608472db4ab7547791e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674870326, "uuid": "4f84ffdf-8fd5-4f8d-bc83-75c453e2b3de", "comment": "Malware payload (GCleaner)", "value": "8a012fd52beacf44fc38f4a17a17e9d4817b649f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674870326, "uuid": "243a4a3a-f97b-4796-b808-d7a8ed942544", "comment": "Malware payload (GCleaner)", "value": "4e88da4653f712a70f7b213d198304f4bb120158319b5fc877f3bb8b00fe78d19348e56dbf9f315eca83afc5a7153d7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674870326, "uuid": "5d12dbbf-0aa9-4728-9334-5c5f09517b59", "value": "T19A953306B58485BEE40A46BE1B306980EFB6BCC3753D2552335221DC4EA62E17DBB5FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674870326, "uuid": "e8ef86b0-ab16-4740-a043-8468939ec492", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674870326, "uuid": "e3d763f5-4205-4929-9325-e0abb0fd442c", "value": "49152:okug++X/NsAYIb9dxaJK/fG7+ivgsL02pwLCgv2MR:hug++X/NsAYIbvxaafCLYv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674870326, "uuid": "01472293-f868-466b-8212-b2b818b4742b", "value": 1981900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674870326, "uuid": "eaa032b5-ccff-4879-9c4a-2757e3cc18fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674870326, "uuid": "a15bdcc3-5886-4c6a-979d-aa0e165d1eab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }