{ "Event": { "published": true, "date": "2023-02-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-04", "timestamp": 1675555381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3e5a02b0-fec0-4d0f-ae1a-909809099778", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f1ac52-a4cb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675542787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542787, "uuid": "b8395320-5aef-4fa1-907c-4d04ae85ca55", "comment": "Malware payload", "value": "2493707c0ac2088517d2b3e47a3422ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542787, "uuid": "a2965b6c-55b5-49e4-8a54-bafb58afd4e6", "comment": "Malware payload", "value": "005ecef22c9d3efe8d775e29d02e78cfec2792f6b5a3fc04a7dc3d4c74b51ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542787, "uuid": "968d8363-c8f0-46c0-afc7-a35b2b60cc3d", "comment": "Malware payload", "value": "d6889c3fc4da08eb27a697169d4c526686482a25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542787, "uuid": "19b5bf5f-69da-4a64-aaee-fbd6797e002d", "comment": "Malware payload", "value": "75e43796f6a8246939ce24a14fdcef2454f2a2621ed76fed78c136e2cea59ad8534408d0f86760713f42eb45c000e354", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542787, "uuid": "84db5474-2c9a-4844-893a-4640f342a188", "value": "T12684F23136D0C032C96A55319C24EBA16BBDB83151B68D57FBA40BAE1F306D09BFA357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542787, "uuid": "b7d856e4-2b9f-4dc9-b6bc-76032ee0f4ec", "value": "847f96cdadc895b3547edbb7a505a62a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542787, "uuid": "f95776af-e770-4f86-bc9a-f6e29cf75435", "value": "6144:u1dAkz6LqDDYpEf4yFFwP4KEcXAItZ0qWx0ruvNT4Rn:u1dksDlfJXk4KbACcx0CF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675542787, "uuid": "88ff5daf-b90e-4d02-9bb8-b9ba9bbd9e77", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675542787, "uuid": "c4a5725d-8ea6-4c6d-a155-d5b71d9a8153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542787, "uuid": "c4887901-41bc-4717-8f97-b4afb31f60b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f97f978-a4e0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675551802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675551802, "uuid": "8207276c-709b-4d12-b70d-5c5a5fd63a85", "comment": "Malware payload", "value": "79568869d79d30e7ce82aafb8bfb3567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675551802, "uuid": "d766471e-61e2-4acb-8092-193337c7c230", "comment": "Malware payload", "value": "0112c984a879e8992279ca4e4462930cbc4b96af5d098b2a69544050ef0d83d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675551802, "uuid": "3514c0f2-189d-46a9-b7cd-aec4c5fbcd23", "comment": "Malware payload", "value": "c70313798aa09ce353bf36470ba6e4f6b64308d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675551802, "uuid": "f192d5cc-a54b-4355-a025-05312e3902c5", "comment": "Malware payload", "value": "06874bb008d9b3cd4dcd32cce8647f8bb56d7038e314acd65636f5c3366a52ab6bf9beb4a5d0ab17bcf5afc2e4ef57e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675551802, "uuid": "2feabab4-a432-42e1-83bf-a86a8fe63c88", "value": "T14C76332034F6CAF9D9582131CEED19D1D658DA0C0C1949F3B3BEA50F0DB56E8E712EA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675551802, "uuid": "ec4e9326-1d88-4959-88c8-a4d99aa52dcf", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675551802, "uuid": "d86239ae-41db-45d5-9654-877da53c7813", "value": "196608:91OL6z1f78wZUbxvfEq7QnOxGDsFaNr46mVaO0AQy:3OL6Jo+wpfn7QOxGweUnN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675551802, "uuid": "3afae8bf-956c-44a3-bd4a-a6c69d620d9d", "value": 7580050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675551802, "uuid": "24f2b062-9174-4fa3-b5d4-72f02b1b3148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675551802, "uuid": "b1fe9acf-8477-4aca-aa96-70c4938759b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffb846f-a482-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675511726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511726, "uuid": "079d0b54-9158-4c45-be64-83ff7e665579", "comment": "Malware payload (Gafgyt)", "value": "0479b98f60c1555a1994a744204f1adf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511726, "uuid": "189661ec-3b5a-4206-bb4e-f77673ade673", "comment": "Malware payload (Gafgyt)", "value": "01448c94e83fb1287cfbfc38355df918697130e3ad739523246b074b72d747ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511726, "uuid": "cec0fd9d-53d0-4286-8822-3c18275715da", "comment": "Malware payload (Gafgyt)", "value": "28930dc84f936ccc81294f6b79b5c60d5330860f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511726, "uuid": "c08c1d5d-83cd-4c37-9df1-83a194b110f6", "comment": "Malware payload (Gafgyt)", "value": "47985a10a0ebd9b08fc62c5e75767cb4e5ad2b5efcabb167516a309368a24a7f4610c3236793e7ae48eed8b3356f07a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511726, "uuid": "1f764479-8252-4024-bc2b-311c955c0a90", "value": "T185B3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511726, "uuid": "462683f9-3974-4835-84cc-cd3901ea6bed", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2OJN2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUreINTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675511726, "uuid": "8f93a268-a20d-4db1-9273-cd62eba1d5c8", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675511726, "uuid": "7c8bdeef-cf49-49ad-af50-5ca98b2663c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511726, "uuid": "63292fa5-06af-4f6c-aad9-e8dd50c84522", "value": "0479b98f60c1555a1994a744204f1adf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe819119-a49a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675522112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522112, "uuid": "9481c55b-0e4e-4f09-819d-a9efe09d25b5", "comment": "Malware payload (RedLineStealer)", "value": "3e0bc3bf6087599120095c83924b10eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522112, "uuid": "d3a04eb2-0d6e-4fbd-8ece-347b53ed6dcb", "comment": "Malware payload (RedLineStealer)", "value": "02341b4bb63ad4f99261e12c7f70fb9f503ef094ed14ab308d7e8aa4d015a4f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522112, "uuid": "c3a90cdb-a283-41fe-bbf0-8422710443ce", "comment": "Malware payload (RedLineStealer)", "value": "ebd68b578b7ef26ca23e926eb5d7a9ef9107170d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522112, "uuid": "ef259b08-8edf-4f8b-a377-9d16874c03aa", "comment": "Malware payload (RedLineStealer)", "value": "06c4412ee1f46087f3c5c3316186fd7303733f933adc42d3f009fd0fabda778ce4a4d28b7d4bf23ebcc0324f29c12d7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522112, "uuid": "531a02de-43bb-4997-bcd7-6a1ca5dd9d3c", "value": "T159D412223661C4F2F13A64301414DE787FFE753506A58E87B3EC1AAE9F207E1663B256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522112, "uuid": "2571158f-b892-4183-8b39-a034c2f58574", "value": "be7581a01c1ad2f53e81adb31665eb55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522112, "uuid": "52dda197-68f3-4a13-82bd-1fd9c7ebc25a", "value": "12288:yiqMFqi1VrEpCotyUk0RcdKTNF7rUIjXwY1HrKSSU/i:ySqi13otyyReOLVjXwYCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675522112, "uuid": "6dc45733-e842-4a97-81bb-59225c563de0", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675522112, "uuid": "b5f701af-737a-447d-a0fe-491e1462f8aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522112, "uuid": "1dad8717-f7f7-42c7-9fcc-c750ae016e5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5472d27-a482-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675511788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511788, "uuid": "f2c1ff37-6a0e-45a3-9af4-149d55f983fe", "comment": "Malware payload (Gafgyt)", "value": "b64a7ae19c42c212ed390f25ddce8938", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511788, "uuid": "990921e0-319b-4a43-bf9c-6469274913f6", "comment": "Malware payload (Gafgyt)", "value": "0580dbd0fbd90be88f0df7f5c4b13664ad9c5d3295a44cebf5b3b8f549b0ad3d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511788, "uuid": "be1d85eb-c4c5-4b58-8ccc-7793e6fc1ff6", "comment": "Malware payload (Gafgyt)", "value": "10eabf5c07033f1738f64c6ffad1373a057b97bd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511788, "uuid": "39e00723-a623-4a14-9318-a5037bf6943c", "comment": "Malware payload (Gafgyt)", "value": "59d6b61a37876f3867a5e51e481fab9e0a0cc7b664ca9ecee227eb674247ebb1ea0abcddbc0b56437b05e7b6d5ba2db0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511788, "uuid": "0000ec9f-8b1a-47b8-88db-6b0f8a4d8b14", "value": "T1A6836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511788, "uuid": "bbe47e08-c733-41fe-a9bd-33263b95e08d", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3XQuWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4XQuDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675511788, "uuid": "ccb5d8ca-211e-4633-abe0-663defe1bbdb", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675511788, "uuid": "eb442cb8-d8e5-4fca-bd7f-90e22c715876", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511788, "uuid": "4bf1fb29-f9d4-4a3f-9c25-81a9123e23ab", "value": "b64a7ae19c42c212ed390f25ddce8938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d72955-a4c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675539728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539728, "uuid": "6921ba21-4914-47e8-b1d8-188162da332a", "comment": "Malware payload (Smoke Loader)", "value": "387a0398c7ee416a83ff936ae9dec546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539728, "uuid": "20e7a347-6d53-4f02-8490-32ed9aa3d432", "comment": "Malware payload (Smoke Loader)", "value": "07ca09a1b05ea6b7c9f20d6de6e81118b3085f4a58bdd3dee832aa98ef89b720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539728, "uuid": "5a18de93-016e-4fee-8f4e-7eecfe334998", "comment": "Malware payload (Smoke Loader)", "value": "6e19835e87252e9040082fb88f6e20e2e67e8628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539728, "uuid": "0a42fb93-7666-436e-b42f-e6437aa1224e", "comment": "Malware payload (Smoke Loader)", "value": "b96532952eabf057e2ecae971443eae2df462bb8266e7ae93195be6342cbff8d05333edcf5251a840dd01c5fa0a0e0fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539728, "uuid": "dd1403c6-d5f1-4f69-889f-e4d335ac49ed", "value": "T1E614D0323AE0C073C36A15305C6CE7A5AB7EB830967589577B5817AE5F202D0A63E377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539728, "uuid": "8d572812-eca9-4163-9add-4425c2ed1b2e", "value": "847f96cdadc895b3547edbb7a505a62a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539728, "uuid": "8a1a928e-ecfa-4b38-b03e-cb998376e4a8", "value": "3072:Kguo1m9TnXLQtouNWPPD5P6SFYYwyDlyLLfbBXfANGW5VwDrxog:Kgq5XLwTNe6p+wz/W5Vu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675539728, "uuid": "df4f6fde-30c1-4b3c-bd30-e5a6a9e02811", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675539728, "uuid": "125c26b1-23a9-48de-a2eb-7743190e5c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539728, "uuid": "de554685-2620-44f4-9f05-153d14352377", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd0667c-a46a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675501333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501333, "uuid": "3a0d751b-a878-496c-b4ec-9c6af0fcbb33", "comment": "Malware payload (RedLineStealer)", "value": "d59ec9541a7f99658d524628d4c19afa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501333, "uuid": "0dda271d-d382-4943-a069-75962259864a", "comment": "Malware payload (RedLineStealer)", "value": "085ff00dc3171b24aa36b377bbdf4d3c6ca8a159b69e680180605a02c104affe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501333, "uuid": "57743721-4e71-4624-acb7-e309a3f43dd6", "comment": "Malware payload (RedLineStealer)", "value": "73aeaf167ef3077648e8bab049a374f4c9917422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501333, "uuid": "8096225e-de31-416a-8acc-50cb209b1064", "comment": "Malware payload (RedLineStealer)", "value": "d8abaaec122f1f46943737b45f3a2bfa623c7ce07bbf25ca6c85c288b91a01c191b687c06675c983db05952f108da2dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501333, "uuid": "4c0d3708-d3b9-4f60-8916-a0be1e0b9061", "value": "T17884F1233BD0C072C57A69346CA0DBA97BBDA93095359D0777E81BBD0F306D0663A25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501333, "uuid": "5e7a3d90-f526-42f1-ba45-4b92a644bc89", "value": "99cebe82e9a09163c3069dbc31af6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501333, "uuid": "74e6f337-75aa-478b-b445-04f926348467", "value": "6144:2m79ZLpUdhFzOECfuik0ZO1didr13753bqQ6hX:2mDidhYJGioUdr13dcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675501333, "uuid": "8e5b6438-9e35-4fa2-8513-6342840f731e", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675501333, "uuid": "335899de-35ff-46a8-b800-3d482e83fe9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501333, "uuid": "55a97a6c-d3bc-415a-84fb-7dbacee3c931", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9998734f-a459-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675494025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494025, "uuid": "8c303a74-cf85-4663-9234-31a0e6f85cc9", "comment": "Malware payload (RedLineStealer)", "value": "4eec3536f4a097e4fb7c388a7c149587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494025, "uuid": "ffae4c02-0cc1-4c65-960d-366d2dd6436d", "comment": "Malware payload (RedLineStealer)", "value": "09b749cb035fd17bc749c1738d1f35f35500df7b157552f26f7570d80f8acde1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494025, "uuid": "1e54e705-3207-458e-9cf1-990b50029d6b", "comment": "Malware payload (RedLineStealer)", "value": "588e6041f46bd653881cebaa369607af4f372931", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494025, "uuid": "c4b612f3-59eb-45ef-a049-483d912e62c7", "comment": "Malware payload (RedLineStealer)", "value": "814f2dbe48893e3345036c1dae8c8e1ff1eb858fb6bf33aedf2e42c110d9b35f8fbef6929dcb06d40caaa2e003e7b183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494025, "uuid": "cfe9a847-0ff1-4c97-b258-4984f7ee9c7b", "value": "T17D0512337A80D072C63A18701865DF397BAFAD3128B9491777990BADEF313D16E3A146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494025, "uuid": "b8e9976a-1a2e-4320-bafa-8b6328a0d621", "value": "99cebe82e9a09163c3069dbc31af6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494025, "uuid": "de1ea5e7-d85c-46aa-8f1e-f7ff912a752d", "value": "24576:+1l0VbiL11BOHriXMmEaxVhqjSbO+06n:+s9yIrivEax/qObO+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494025, "uuid": "2e8ca1d7-9a32-4a9d-8900-8ac4e88c7e61", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494025, "uuid": "1a3803db-d5c7-46d2-bae5-8b690fd80b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494025, "uuid": "2b6669d1-6076-4d29-b6f0-c9608d40351e", "value": "4eec3536f4a097e4fb7c388a7c149587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af8a660-a46d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675502510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675502510, "uuid": "61025edd-9eb7-4fea-bac6-0269af8bec8f", "comment": "Malware payload (RedLineStealer)", "value": "61ea289a7eb0c9b6ba94cec1a097b9d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675502510, "uuid": "94128de7-27e8-4b0c-92db-8247c36480e8", "comment": "Malware payload (RedLineStealer)", "value": "0a74c0aa2b21b8ff3595292e868a360009294f2d722de28109013992a8954465", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675502510, "uuid": "9c01261d-8cd2-466c-88d5-b47f7cf3ed33", "comment": "Malware payload (RedLineStealer)", "value": "96236f4f12cc1ce464a8b5c4e9840871be812e80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675502510, "uuid": "d9f6f9f0-3670-4bf8-a7a0-fa11933551b4", "comment": "Malware payload (RedLineStealer)", "value": "462694d1ebc87322fe88edae8e742b82b468e8c3044113f1ad61af857ba2f34a5f209d817889227ef9157b7ed505a062", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675502510, "uuid": "b9d00641-aa89-4b8e-969c-5c660055f371", "value": "T129B412337490E1B1C4562036096CEAF8BBBDA43044798D5BBB5E9B7F4F316D0293B25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675502510, "uuid": "915f32cb-c1ca-488d-b2cb-657b985c5bfc", "value": "aea30aa8311fa7a3ea56995ee020184d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675502510, "uuid": "03c456bb-63c7-41ce-b76a-246c9ef29274", "value": "12288:Lblq/tXKCVuVceVJsBktnrorPwu1irOp07o:L6AVJsBT7za38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675502510, "uuid": "5f41bdef-8fcf-4671-8af7-6a060b02f733", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675502510, "uuid": "bb02ea32-a259-474d-9338-f3e658b57d07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675502510, "uuid": "163f390d-a031-4e96-8586-3e5cbfabdb63", "value": "61ea289a7eb0c9b6ba94cec1a097b9d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562bffca-a427-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675472437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472437, "uuid": "21febd03-89f2-4970-a302-6c680386391b", "comment": "Malware payload (GCleaner)", "value": "d3aa1d472179897516d4cc8e85a0103a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472437, "uuid": "15340d24-f327-4893-8401-2e4b156442bc", "comment": "Malware payload (GCleaner)", "value": "0abffe90f7df043c0f0242ec70c0977524c38cd9da4e944527fc5816edc908a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472437, "uuid": "65e3bfa9-deae-47c4-9b0b-47de410fee6e", "comment": "Malware payload (GCleaner)", "value": "ddead6c85ae79438559b71ba26ad76b05bec30f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472437, "uuid": "d9b3d3d9-d7a3-4b51-9488-47bd17fa003b", "comment": "Malware payload (GCleaner)", "value": "c3ee4b4207999c5dc4e89ec4140f2a983ea380bf8a2ed385801a15c5506b194671f2fbff813539a3a2fec3c9b70c6729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472437, "uuid": "de2a71b1-b6ac-4c51-bb8f-21f1d0cc630d", "value": "T13FA53306E2658F3BD092CAF90C75860C553B7EA93D3A610AB09DE41F2A5F1587C8F736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472437, "uuid": "ebd14868-c957-40d6-9545-874602cde209", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472437, "uuid": "99200dd7-5b09-4181-b595-7da3c5562a70", "value": "49152:ygHDNYaSiHIYQC3E6Heb4/e3+ZhCiLk1GzbIazJmbi8vkwcLCgv2MR:THbhTQt6Hl/LhrLkTatmbi2kDv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675472437, "uuid": "74d5193d-25be-4f63-b086-1307d452c9cc", "value": 2087535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675472437, "uuid": "bc77b3d7-8040-4835-8dfc-cb1478b15dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472437, "uuid": "aa4bc406-727f-47b5-aa4a-ce93487dda1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb01373-a4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675546105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546105, "uuid": "65a1d3ba-3604-43d0-83b8-4f0e2f83c64d", "comment": "Malware payload (Mirai)", "value": "5bb6850a69fe6106da9b5ed89a39fd04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546105, "uuid": "81149fd7-ba93-48d7-9d9b-5e9c30ca551d", "comment": "Malware payload (Mirai)", "value": "0b8fbb671cf4f37d87f343a4ef39c0ce8d407c7164fff6af8600a01b006f3efc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546105, "uuid": "29e8c3c6-29ab-43b9-b38f-1858eeea6200", "comment": "Malware payload (Mirai)", "value": "483cf97bf08e0813b32d0afd454e39800e3b9650", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546105, "uuid": "48ebe9c8-9ef9-448b-8893-df929f2623c3", "comment": "Malware payload (Mirai)", "value": "2a502878a7091e0f84ab41858d2758894b782b578d5b2fde48598cf9c790e563310eccc4ce80b91b34572b9847a67346", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546105, "uuid": "722ce353-5547-4a6a-8042-52b201a66b79", "value": "T1B7436CC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546105, "uuid": "b5c237cf-1073-4feb-b660-5934ceccf0d4", "value": "1536:JeESt/basV2rcZhG6yNN7naERe9xzWOIaEjrqM4s:JeESt/basVTgZ7naEw9BtXESb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546105, "uuid": "b3677093-69bd-4fcd-8a25-02e1ad6bd077", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546105, "uuid": "83604626-0130-4f48-a811-3ead338bbfd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546105, "uuid": "cd75b6c9-b75c-4513-8f13-d3e42317f6f8", "value": "5bb6850a69fe6106da9b5ed89a39fd04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5327ba9-a431-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675476945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476945, "uuid": "9d657fd5-db51-406c-bc70-e1e5afb019a7", "comment": "Malware payload (GCleaner)", "value": "f8fb75b3ddd11a55c7bb4d0cefc8a64f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476945, "uuid": "81edd538-7a52-41e4-8263-4df1d9088132", "comment": "Malware payload (GCleaner)", "value": "0e4b63e68003c8702754fe4498c2899b0e586af989e672a9757482f9762b67e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476945, "uuid": "eb2ae551-14eb-4321-bd9f-f7fe894606af", "comment": "Malware payload (GCleaner)", "value": "360213f496dba3c16b783b3eb4b2950538b326cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476945, "uuid": "cdb128b2-7ec9-4202-a50f-51b34f77f361", "comment": "Malware payload (GCleaner)", "value": "af8b705ba2143a6cb7fbf8cedc83d481010e2e1aa86b7e0fb6e25ca22231198ca810332306472c39ade643e0b6d32e7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476945, "uuid": "82e1974b-14b5-4f8e-87ce-f93d0aa983b7", "value": "T1A695331273FA4A3EE342DA75521A51E5F927BF322464230D381D5B0DBBAF3B2146C74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476945, "uuid": "f34c186f-0c9a-4830-86cc-ba8465646617", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476945, "uuid": "f5d26fc6-8376-4014-b9b9-50db7976c809", "value": "49152:ygbh0Jhl3JaFHjohAtzGkSIcsxlejZx+UrVCsqWIc0PLCgv2MR:Tbi8Fq7kSITx4jZM/w8v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675476945, "uuid": "1c18dae7-deae-4307-b407-9ee6d72cc53f", "value": 2029362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675476945, "uuid": "12562032-0cad-42d9-8203-b8ada86996cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476945, "uuid": "00ae722b-f371-47f9-9ae6-dcf9be5229e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc21f75e-a45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (PandaStealer)", "timestamp": 1675494566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494566, "uuid": "028a0564-70d2-4c13-95a5-dca846b283ba", "comment": "Malware payload (PandaStealer)", "value": "9ef762f37d18159788b6f1ddedd432c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494566, "uuid": "05be5689-54e8-49f4-acb3-4a1158828ed7", "comment": "Malware payload (PandaStealer)", "value": "0eb87a3705190f81e96901e1376d66657c704915ff88e4ccc954128ba6a7efe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494566, "uuid": "1b3e9f2c-ed6a-4444-bd24-c2c23eee8f0d", "comment": "Malware payload (PandaStealer)", "value": "83349f9a92bba8d297a8bd63b8cebeeae13fc3e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494566, "uuid": "c835802e-2cf7-4b41-a98b-c6faa4906434", "comment": "Malware payload (PandaStealer)", "value": "1cbc2a1925ff88ff9bd727efb92c8ab583b87e7f00430df3e15dda0bf80e59072fa0bd444892da49e57ebd136ada58b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494566, "uuid": "ab2eccfd-92f4-43ca-94c2-612118a68d51", "value": "T11835CE9377F19862F6CB10B514283B8C1FE07103BE55E25BAB3B79C097059FBB698252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494566, "uuid": "cd260aeb-fe52-4792-bc15-8e873e466a10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494566, "uuid": "d7ba9ff4-c52d-4382-92e0-6738482fc3d1", "value": "24576:nwJJuwUGkdSemfmmgO59i3LuKR0Zd7lzMdJGrqG4yPas:wJJPlQRkmc5sdu71Usc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494566, "uuid": "f0be62ac-6951-49aa-9952-a9f796dfef78", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494566, "uuid": "b3e4a604-d440-4614-b1c0-a1c85fc32390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494566, "uuid": "86ce8c92-aa32-4c41-b496-6d542a0f9aa8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4b1d33-a468-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675500311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675500311, "uuid": "de178069-f4f1-45af-9ea3-c90106524af7", "comment": "Malware payload (GCleaner)", "value": "cbc96ec7e898d7daaa6e751545694cf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675500311, "uuid": "7aba56a1-6f15-4d2b-92f8-2165afe34b7e", "comment": "Malware payload (GCleaner)", "value": "0ed53b7b14d1ad11cec56933cb9ef328621f89ff1a1a550aada6f8435b3d83d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675500311, "uuid": "4fa14df2-2188-4aa7-aa88-7c80d7d62dc9", "comment": "Malware payload (GCleaner)", "value": "3b295e2adf2315d343f9227cbc440b965100ad61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675500311, "uuid": "6ecc791d-be94-4f82-96bb-1a36c1d631e6", "comment": "Malware payload (GCleaner)", "value": "1e4e6b63c62fc86f934693854faccb63e3807911df2112ba12d4a2c4fdfa851827e3bde251b53f596a5be7a95af50e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675500311, "uuid": "3fdbf8cd-85cf-46e8-b261-b4d2d05ee895", "value": "T1ACB5DE465CA8E467E1C98F70CCF75DFB4D01ED79D4B9092791043EFA3A32E022C96A69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675500311, "uuid": "b02a88f2-0f2f-4ca8-995b-b0916b3caa26", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675500311, "uuid": "e3af155f-9f46-47dc-8eb0-82d13f3f76bb", "value": "49152:d3Z7kUOHN4EdlgnJ1hLlcndVy0U/ehCTXLBPGjwSwni2BLCgv2MR:X7k9l0Jf+dVk/ehytPxn/tv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675500311, "uuid": "89691757-1c91-4178-98f5-8bc9ddf39584", "value": 2332689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675500311, "uuid": "61bf2848-e8d5-4dae-9478-a867eaa45844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675500311, "uuid": "a4947c1f-85d8-4851-9542-fd7268f35af8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f609e4ae-a49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675523815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523815, "uuid": "5b26536d-7a39-46a6-8fcc-3c70e352ab3b", "comment": "Malware payload (GCleaner)", "value": "b342724316e09b5202c34987583fe0d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523815, "uuid": "9b0a58d9-74c7-4df0-85ee-b3994c4ffa46", "comment": "Malware payload (GCleaner)", "value": "0ef3fcc6aa34956c10e6454490c43bc7352770cf5d05a2b11b8e9c41812dfbc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523815, "uuid": "5c04aa4e-e142-48d7-a4ed-37e4b489523c", "comment": "Malware payload (GCleaner)", "value": "50524d1812e06c9810132d8bc8a0b08abb2d63ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523815, "uuid": "bc344c2e-e360-433c-969b-7d73b620cb34", "comment": "Malware payload (GCleaner)", "value": "ffe8b83afa69569781eb5b47382e8207f56914aa89dd4ab3f304de219eacc1971cee8e3d3df23b5edb5489ec17e5677f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523815, "uuid": "d531e701-230b-4f45-b002-81967004c19b", "value": "T1D0B5DF125D98E1A7E0C98F71CDF35DFB0C11ECB9C0B8481795183EFA7A32E522D96629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523815, "uuid": "fa391268-b40a-47c3-a275-1889c39dfc72", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523815, "uuid": "1b6fd984-0bcf-4241-8ff4-fb494c63ca68", "value": "49152:d3Zy1X7RRi/S8NwWSyJi2bnTwYRNYDdLcgh4YdJLCgv2MR:XmXv8xSWSK5Ruzxbv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675523815, "uuid": "4d0d7e2b-ad48-4a43-aef6-62f427aa1bbf", "value": 2271162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675523815, "uuid": "35c9e0b7-d15d-4ca4-8f05-8ce43983f50b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523815, "uuid": "6b724a3a-7727-4e6c-8571-6b53baeabec1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4802dc81-a44c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1675488305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488305, "uuid": "edf8ee05-f126-40af-9f1e-84aa5202e221", "comment": "Malware payload (Chaos)", "value": "2c6f8e680a400cb2b5426090ccbdea93", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488305, "uuid": "f966175c-e8fd-40ed-a31d-96a0aa1f7751", "comment": "Malware payload (Chaos)", "value": "0f3d700c95b21e5437c0aedb3cacd787ce6701c49180d8d564e4574dffc42190", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488305, "uuid": "4fe7510e-10a4-4fa3-93f3-597c3405cee5", "comment": "Malware payload (Chaos)", "value": "47a691c438547b27fac9896f3783026d8be4dbe9", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488305, "uuid": "ed890b72-51f6-4c12-b6a1-5e52df071c8c", "comment": "Malware payload (Chaos)", "value": "eabce0837a7f2aa3198903fe4f993307c24b76e9e6c39a905b38d9fee52060b9be12472c99ff4fec5bd8ae88b1083b47", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488305, "uuid": "14637105-bdbd-426a-8510-6102586ce048", "value": "T1F4950F343EEA502AB273EF799AE475DBD95F77A33703984D10A1038A4623A42EDD143D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488305, "uuid": "7ed1bd9a-0b2b-4ea2-b45e-b138fc7bfaa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488305, "uuid": "43d347fd-4bcb-40ad-b4df-3d26bdfa9281", "value": "24576:CSndG2iSNjN2w9Os9cRfO/d8mT6c6aVqwPhUMel84Mn:HfJqsgXmgyJPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675488305, "uuid": "51a135c7-7229-4e9b-8972-245ba392097e", "value": 1993216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675488305, "uuid": "7c092f49-4c04-4bae-b7c2-f229f81e68f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488305, "uuid": "495e8b58-26a5-48e8-a7c3-fa143294dc72", "value": "2023-02-03_2c6f8e680a400cb2b5426090ccbdea93_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7678c7ea-a449-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675487094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675487094, "uuid": "f07142b8-fc0b-4e9d-9fe5-a2ec06d30479", "comment": "Malware payload", "value": "4b781634e683df9f9d4c8afc1ffe137f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675487094, "uuid": "0b55cfa9-c1a7-498b-94ed-694c3ca20871", "comment": "Malware payload", "value": "0f46ae9f262896d0b87c648150a2344d0023711c9afa829eedf49f0b7c02ba5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675487094, "uuid": "13d583a3-7134-4463-818c-c76895e50dbd", "comment": "Malware payload", "value": "5b6b71115c82ce28af12c4dd1ced9ce2f5d9db7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675487094, "uuid": "4b8abea4-e755-4c00-8a3a-23d6e31cffe2", "comment": "Malware payload", "value": "89aa036ef160cc6298246ee9f2dbd84581820781d392ee46a71cc7b6ee9dcd39456c3f6ac7e4722666bfb44c954d2309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675487094, "uuid": "3266cb16-18f0-4fd2-8427-fdbd44f60adb", "value": "T1C617339D57A85CE6F9A6A13B4D2FD018E99BFD050368E18F039846460D67BD13CBBF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675487094, "uuid": "d879fdec-905c-4a98-a134-53570c0f7ac0", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675487094, "uuid": "b531790f-6b72-4f02-b435-ecaceeec71a1", "value": "393216:BPu7L/OtASFuldQuslN/m3pDl9AJ4ZoWOv+9fPV4aBLGbUOYFp:lCLuFydQu4KRS4ZorvS3zhr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675487094, "uuid": "33e5c7b6-ee99-47e4-b48c-830919d01930", "value": 18594390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675487094, "uuid": "10210ad6-f5ff-4fd0-bea6-c438a1ffc795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675487094, "uuid": "156a891e-e8a3-47c1-bd17-73d62cb89037", "value": "yeet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a28881d-a4bc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675536439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536439, "uuid": "7a8931df-955b-4346-a314-6b6d56dbb14c", "comment": "Malware payload", "value": "f697468aa351d34c499103f01339bea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536439, "uuid": "6b39c7ad-359c-479f-a7f1-05fd32ed3ed0", "comment": "Malware payload", "value": "0f9dbf050e487cdbe7020127ff967733317dde22890cab01f70248b710273668", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536439, "uuid": "37cb6cb1-78d4-423b-9af9-deb8c2cc70d2", "comment": "Malware payload", "value": "f8b6cebf8227891f721ab9442431aeb9ae7fb9e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536439, "uuid": "048ce671-c432-43c1-8809-5c72f7853f7f", "comment": "Malware payload", "value": "9ba4d520b6bde8de0f39843a18d8a6790b5ed8249057491cf8310efe1956e6ffbb030e9dac1eddfce6db40cd823231ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536439, "uuid": "3d835996-2671-40b1-91d3-d117e71afae3", "value": "T10E76333276D0CCB1C889257AC9711BA7D8B3F2F64D34997B47A9196C4CBAE84DC67302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536439, "uuid": "d0703225-2792-4ab9-a345-2d94e13700e6", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536439, "uuid": "2754e67e-ab61-43bf-9807-c334648d7854", "value": "196608:91OiATXUrcHvoY/BH/akiSK9kLySwr0aX5D0fCRl77L+:3OTUrwQYJaYK6LyRrnlb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675536439, "uuid": "dc410f85-9b4a-4ee6-ad85-9fb9e1072e1c", "value": 7623753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675536439, "uuid": "58987f5a-3dce-4466-bd89-bde9600476d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536439, "uuid": "e5eb8354-c711-4913-bbcf-61077231ead1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecaec1a1-a470-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675504043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675504043, "uuid": "c75f35f6-628c-4e05-b52e-3b5eff14d59f", "comment": "Malware payload (GCleaner)", "value": "04cbb0f0b4791670298a5810fd2a3c9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675504043, "uuid": "c4efcf57-0de9-4ded-88fc-5ae9b31036c0", "comment": "Malware payload (GCleaner)", "value": "10246bed3019c46779826017e5c3ff354d3117fc8eac76a2a577f9fe665e69d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675504043, "uuid": "5527cce8-e1c6-4dfb-bad9-df70436a817c", "comment": "Malware payload (GCleaner)", "value": "b83bb9b282ac06cddeb058db69425596798c6fd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675504043, "uuid": "b4ac6460-d3d7-481d-9852-c3797a898331", "comment": "Malware payload (GCleaner)", "value": "9131685d0ef5b04acb05245baae076d064aa6be7f54bc345b3d7927e6e3106a5e6d3afe20b5f53a1cb95502b8f09b0d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675504043, "uuid": "c75a1e81-d758-460f-b58d-bdad0ca11657", "value": "T1C0B5DF161C98E56BE0C58FB4CCF36EFB1D15ECB9C0B8491792043EFB3A35A522C56629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675504043, "uuid": "ecae8576-a9da-45c0-b4ff-0c81f0b84c7c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675504043, "uuid": "8cd9ec05-e1a2-4e0f-ab6b-dcfcab18cbfa", "value": "49152:d3Zr1epXpQZbbtvVgrk5GmPWT99uR/NLCgv2MR:XrRb1KggHhcR5v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675504043, "uuid": "1648b3e1-1238-421c-95e6-3f11504f7e3b", "value": 2284746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675504043, "uuid": "8ce7a282-83bc-4fef-a660-2a9e73265706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675504043, "uuid": "071c220d-9432-49ce-b5d0-21909d7b1698", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06975bc4-a4d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675546177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546177, "uuid": "3659516e-c466-44a7-9bdf-e2d4eff44dcd", "comment": "Malware payload (Mirai)", "value": "04d1beb6db07ed5143b8a2f2f84b7ad6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546177, "uuid": "f7f4da05-1b8f-43e0-b8cb-134c6bc0cae3", "comment": "Malware payload (Mirai)", "value": "10bd505e31b040bf4a94a2bb4235747e7dcc80874f357143c9a828c2b1994431", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546177, "uuid": "56182a77-a916-4a61-8d40-6c510b0d8226", "comment": "Malware payload (Mirai)", "value": "c554c1f3d5368e8f96157ca8dba8dca5b88bcba7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546177, "uuid": "d2c532de-d749-41d2-83ad-9edb451d2e11", "comment": "Malware payload (Mirai)", "value": "79330a1459030256293d663471c6f0783cfdf7aa910aaecb4b49a588a9bff2eddcd389f29513ddba19dbd58b28da57ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546177, "uuid": "907495da-a281-4a54-a9c1-c620cb0c680c", "value": "T1B8633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546177, "uuid": "ab405564-2e2e-4a87-842e-4dec25a19488", "value": "1536:lGRaTYmol/hGIAs4PNAARQGGm75123tStal:lya7h+4GmVD4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546177, "uuid": "549d8304-20d8-43ed-9241-cef9eba3efb1", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546177, "uuid": "1ff7c5b9-0a79-47db-8f44-0e8161ce81a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546177, "uuid": "72c43406-866a-4ffa-a233-4619fb0954f4", "value": "04d1beb6db07ed5143b8a2f2f84b7ad6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db12e40a-a4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675529783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529783, "uuid": "07c8fafc-2a43-4bf8-9bd9-1b912ab00fbc", "comment": "Malware payload", "value": "d0d36f169f1458806053aae482af5010", "object_relation": "md5", "Tag": [ { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529783, "uuid": "27d9d939-3c8a-4cb4-a94e-18e083762e75", "comment": "Malware payload", "value": "10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459", "object_relation": "sha256", "Tag": [ { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529783, "uuid": "5489d019-8044-4b34-9979-25b6aa621af8", "comment": "Malware payload", "value": "e603944aceb5c0885a8627de12f36b159bbf2f05", "object_relation": "sha1", "Tag": [ { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529783, "uuid": "6505e94c-afef-4f3a-b532-a591e3bd0b2d", "comment": "Malware payload", "value": "a706861503fe8f8c849799c520050ae8037b1db162628c3367aae84013858b865524a8cc3c78a4464716cb0f3c1b8cf2", "object_relation": "sha3-384", "Tag": [ { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529783, "uuid": "ed85cf04-bebc-4846-a9dd-349dfb51918f", "value": "T15E71CFC7F141EDB45C8C94B6AFA6BC5CE44A61481C097B04B64FB129F7CCB8B369A11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529783, "uuid": "cd959451-10e6-4d58-9f2e-70c99857c66c", "value": "96:BsBwsYLuB+o6Kq/1IFozRu92EFqGaX1u0:aBwnLuB+oad1g92wqG/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675529783, "uuid": "f79272fa-d971-4b56-b87f-d7073f0d806d", "value": 3685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675529783, "uuid": "12122d37-1b9d-4334-92ba-00ab6c7738c7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529783, "uuid": "c519665f-61d6-40fc-a503-d50c329f2cb3", "value": "10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3495a2b9-a45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675494285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494285, "uuid": "d646baa7-2bb3-4367-831b-e471e56dcbb5", "comment": "Malware payload (Amadey)", "value": "9221a421a3e777eb7d4ce55e474bcc4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494285, "uuid": "72a6b26c-e83e-4b91-a2cc-1ab7fce77f5d", "comment": "Malware payload (Amadey)", "value": "10ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494285, "uuid": "33015683-2b35-4636-b96d-aaca409fd65d", "comment": "Malware payload (Amadey)", "value": "c96d7bd7ccbf9352d50527bff472595b3dc5298e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494285, "uuid": "0dbc4c50-cf9c-43dd-983b-7cba4771537c", "comment": "Malware payload (Amadey)", "value": "52a5afc47966e7a3ce84611ec305d7d4df4933ef7ba4dbf25efbfed223691c1f67059039b5ec1cc95ffd3206b778972b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494285, "uuid": "21d4675c-8897-4e3e-9c85-aaeb41a9c461", "value": "T140935B1030D2C471D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494285, "uuid": "0dcd28bb-eb5b-4a81-80a2-1f004467f6c4", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494285, "uuid": "1c3b2740-7f97-49f0-a59e-02561aac96df", "value": "1536:8o4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUouaB89p:8oUCWbBNpplToUs1uNhj25LJUraB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494285, "uuid": "98c9d49a-d0aa-41f6-813b-3b5335cf0b0b", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494285, "uuid": "eda8ba87-13ad-43c7-9f26-6d1eb05f581f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494285, "uuid": "2ea61737-ff6c-42dc-96d8-6d18afd7e066", "value": "9221a421a3e777eb7d4ce55e474bcc4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d671c794-a4df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675551680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675551680, "uuid": "b08184f1-6d2a-4aa0-87e6-f47d09e018cc", "comment": "Malware payload", "value": "26b03417f947a4342b430cebf56d27b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675551680, "uuid": "c852b307-12b3-423e-a442-9902b480499e", "comment": "Malware payload", "value": "110f6b4243da0a1ba2a909eeb0a2f39e4efb01cdf94aad949b8745a0e4677ea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675551680, "uuid": "c53a563c-00ff-45f2-9c40-c4c890c9ce3a", "comment": "Malware payload", "value": "ba7d6f0c1099014a69a8a7b28bf4630603e6cfb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675551680, "uuid": "4c50b73c-f322-4b12-a8d9-c405c6b78967", "comment": "Malware payload", "value": "7b45f26cc0eda6543582db52650ee2c7ad216c34f1fe10284997af7f369006300092aeeb5c3e3e7bf908308a219ce76c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675551680, "uuid": "fc5a1625-41d5-4cba-b11c-5a91ed388e1f", "value": "T152B5DF165DA8E067E0D88FB0D9F3ADFB4C51EC79C0B8181791047EFB3A35E522D86629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675551680, "uuid": "54cf2745-84f0-4d54-9477-427069680f0e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675551680, "uuid": "33dc53a5-388c-4a9a-a947-8399e1d5fb7e", "value": "49152:d3ZqRkAur8Aldy8WHPzgm7uc3KWc2j9VW2vnAc7fzYLCgv2MR:XqRkVhXiPzgmHK5K9Xfcv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675551680, "uuid": "334e3811-2071-4fc8-a879-3c573ef09b40", "value": 2448820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675551680, "uuid": "a3463673-fefb-4c94-9b74-9ec2e7001124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675551680, "uuid": "d4b2e624-3b18-4548-a07a-d19d2acdb1de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c464ac6-a427-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675472501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472501, "uuid": "f071cf7d-0755-4f0a-bdb0-dc458387889f", "comment": "Malware payload (Amadey)", "value": "f59cb46c4abb16e89eb50ec981152327", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472501, "uuid": "7667b435-c7b8-48b2-916c-057b7643dc02", "comment": "Malware payload (Amadey)", "value": "11aefe9d546c991bf082a68329de23cf9b084e2ec23c702308a905d1dd7bf218", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472501, "uuid": "2e7daed2-6799-4296-b387-116aa7ec2602", "comment": "Malware payload (Amadey)", "value": "2b0eef5bee126dffc3bf99ad55bc63fca6177ba8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472501, "uuid": "f9be41e0-987d-47d7-9ea1-07c511ae25d5", "comment": "Malware payload (Amadey)", "value": "7822718fd7687feca247948ecfcb220542031c726d0ecd8acd3974aba5dba14d4d6e9be905d71fd720a5d57bb6c240d3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472501, "uuid": "c06e32cf-8b65-4ec1-a1b3-67ddb9982c13", "value": "T1CF14CF3236C0C072C53A44304C64EAF46BBFB931C6B99A5BB7A807AD5F316D1672735A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472501, "uuid": "a37cba62-230d-4371-adef-803832d26f17", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472501, "uuid": "0f6bacf6-b4be-4eb9-a79a-3d786d7881e3", "value": "3072:Xlk0+ca16LNIc1lh3wWja5SpCqytclF8G9sqrO8:Xl9L11n3wkpbytclFfsqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675472501, "uuid": "4ca16ada-0652-42cf-be1e-8fd5db932c9a", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675472501, "uuid": "bd3ddfd0-88ae-4d3e-b656-c3eae2277f1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472501, "uuid": "4a801e45-c497-435f-bf71-ac7c4b923cd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e111368f-a4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675529793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529793, "uuid": "fa5eca84-286e-44e7-b893-b8cbf65dbc47", "comment": "Malware payload", "value": "87b010bc90cd7dd776fb42ea5b3f85d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529793, "uuid": "c476d7d2-46c1-40a0-9d6c-92725b6474cd", "comment": "Malware payload", "value": "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529793, "uuid": "bb6f0e68-5088-48de-9477-0b378c56dfe0", "comment": "Malware payload", "value": "f25846f8cda8b0460e1db02ba6d3836ad3721f62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529793, "uuid": "1d8d527e-72e2-44ec-a2cb-a9f00d385c26", "comment": "Malware payload", "value": "de0371f2e3a83761618cd27912bf1da20a298de37efe01087d2dd82901acf5d2339ffe669b23089218431aeca4350c1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529793, "uuid": "048dc2e5-df9c-4413-a4cc-2b9625241213", "value": "T15423B31F5352062AD09762B3C68B3173E55367B04024098FDAB41A7D5FBE7EF9A292C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529793, "uuid": "0154926e-f440-4896-b359-1f239f128aeb", "value": "768:wcxBGBTlCC4kh9RL0kvRoRzY+0kwKlG8HP6eQPK2:bBJTK+0kwKlG1eQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675529793, "uuid": "be14f30d-c539-49ef-9070-925ee7742c56", "value": 48694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675529793, "uuid": "2e604b7d-c87a-43b7-a856-5978c24fdb24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529793, "uuid": "e0647e68-8bde-4c8d-b9ba-0ff7c963eb36", "value": "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346f7d24-a41f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675468944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675468944, "uuid": "589044ab-e2f1-4de9-ab38-59c650ac1c49", "comment": "Malware payload (RedLineStealer)", "value": "e892624285a71d5e2c6cee6d7821a54a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675468944, "uuid": "e19e7f9b-0f7d-4fa7-a4be-8f2f93944cfc", "comment": "Malware payload (RedLineStealer)", "value": "129a15105ab0e70a13c5fe33c99dcf118072a879b3eda7f2cac51a490960b799", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675468944, "uuid": "b87251dd-eb90-464f-9c20-4463be8577d6", "comment": "Malware payload (RedLineStealer)", "value": "f0324d40edf82546313d09ed76c7414a39ef9a92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675468944, "uuid": "220e0501-ed0a-42b4-b680-d74302929441", "comment": "Malware payload (RedLineStealer)", "value": "3e0e97d798de2aef19a17812d08effae4c219d2fe6ba5ecbb5326b21ea5c67f6a7051bcfb5e178b3a5f46d003241a654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675468944, "uuid": "a96a4582-5d55-40d3-a121-c4101d58a63c", "value": "T16254F1223BE0D072C56715349C24DBA9ABBEA430897B99473B650B7E5F303D16A3B347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675468944, "uuid": "5a1bffd9-3a3f-4cc0-a6bf-49751adb114a", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675468944, "uuid": "db35faa4-183a-4d86-b007-9b80c53623de", "value": "6144:5lGaWLnON5/ORM6iRHBYaxyAASAWvqWoH6Iq0r:5l+ba5/WUYTfwqP6It", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675468944, "uuid": "520001f7-e4f9-478b-8a58-1e5214d5b8ea", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675468944, "uuid": "2631657b-c46b-43a1-b6b9-06b7dd079e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675468944, "uuid": "6462bd47-0602-4a84-bccb-edef62cc72e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b112df27-a427-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675472589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472589, "uuid": "526c0f89-376c-4511-807b-b8302f51777f", "comment": "Malware payload", "value": "be82680f164a2322ac9ab397647d48a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472589, "uuid": "78156eca-51fd-4411-aa7c-a0e60de9cad2", "comment": "Malware payload", "value": "13b6d247203e1d4af089d34d83786f96112e1c776cbf90c9863ba84d7ba70512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472589, "uuid": "34996a3a-68eb-4054-91d3-9c945cb8f8d9", "comment": "Malware payload", "value": "7e004b25b3ee682617f6903b8ec25322d45dac39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472589, "uuid": "1c6d0dc8-567e-4d1c-acc8-8ab8cd6c53c5", "comment": "Malware payload", "value": "56eefa7c99a1ae8ef11b264ad4d7c46989d53d191a9adb8fe14b8ab5127082c26cf6d31835bbfae503456563f3c06b1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472589, "uuid": "b5f293ab-4f6e-425d-9c35-6bbc7b1bc54f", "value": "T1FB7633A075F581BFF77B52724D682EE7A2FAC3560F38C82362908FCE5674900D85668D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472589, "uuid": "a070e923-fd41-43c3-a0b5-58fcedb2fd2e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472589, "uuid": "cab90a7c-cc84-4f90-8f8e-616358e52af6", "value": "196608:91OC0c6aRLS6ob+8kLs+o5jkmtl974VDc1:3OC0uRdob+1A+Sr3Ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675472589, "uuid": "d4829a24-fbdf-400d-96b9-ec86042be9b7", "value": 7583064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675472589, "uuid": "113a07ca-6329-4016-9368-12cc13f34103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472589, "uuid": "45b6cd80-5e28-4893-815d-f36022c3579c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf7a594-a4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675530753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675530753, "uuid": "104e1f9d-f14d-4c5e-8b6d-1f1e2a482967", "comment": "Malware payload (Smoke Loader)", "value": "cb232a042cec8217fae2f9e4b091c509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675530753, "uuid": "3830df25-6485-49d0-a078-70a44ee6e594", "comment": "Malware payload (Smoke Loader)", "value": "14813f3dbc8538502f4bf591b088ae293cb06c5ab9b15126127ca394d5baf7f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675530753, "uuid": "45049acd-81e3-4d56-add8-0f52349c133e", "comment": "Malware payload (Smoke Loader)", "value": "a06df77411d6d59c10563994c5f8175e19d6b60e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675530753, "uuid": "708e4e43-d241-4f3f-a246-c1590ab845aa", "comment": "Malware payload (Smoke Loader)", "value": "6acb37365ea274cd1eef7372eb23a6a107687d4908dce79f470787c60fdb7b38782c7208cc6ec17cbca5c0923ad22eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675530753, "uuid": "a6e3a0a7-77c0-45f0-8d2e-0763f79e3d81", "value": "T10314D03332D0C072C16B15319874EBB57B7EB83196769A0B7BA4076E9F302D16A3635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675530753, "uuid": "355cbf9a-59ab-44f9-8d39-f34c81113ab4", "value": "d7c1b4fc37e4a9f47e4b98f16dcd9a1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675530753, "uuid": "eb975359-70d5-409d-8190-43674857f21b", "value": "3072:lRIVTXCrLKv+j7TlWsRQ5ZTChurf3aDRNl8fIqnMrxPK+wRA2FKW06aIk:lRTLK+3TlS1L8txC9RAdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675530753, "uuid": "48944bcd-1f98-4459-b19f-9ea881fcace8", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675530753, "uuid": "0ad18473-a03e-4972-9dc9-1d87217b5370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675530753, "uuid": "c245eae5-2809-44a1-9d94-7c8cf664cdd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b39fec9-a47d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675509409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675509409, "uuid": "97c7a74b-9fc1-4084-93ca-cbd944a9c4ea", "comment": "Malware payload (Smoke Loader)", "value": "9da1b25f025805f2c63452ab01c5f2f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675509409, "uuid": "2f249c4b-d78b-49a3-b38c-de10c4753516", "comment": "Malware payload (Smoke Loader)", "value": "15c5a8dd841448d96c145d60b0d292cdab780480e966afaac7bde09edc8d05d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675509409, "uuid": "4abda0f7-74c4-4b8e-bb8b-0da7145bb645", "comment": "Malware payload (Smoke Loader)", "value": "3c4b6f47efc45a9b72d6958a81ac0a1f0ed83645", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675509409, "uuid": "b34adf02-eaef-4353-b70e-751caaee0705", "comment": "Malware payload (Smoke Loader)", "value": "4aedc45e614c0682c5266f15bfbb172c10087182eb0779d86267f326c92112977d5665a578d0d11b65d45f1130afcb89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675509409, "uuid": "b87de2de-2af5-4bf1-8871-f7a05efde20f", "value": "T1C414D03236D0F372C0AB14344864EAA46BFE78315675894BBB9817BE5F317C0563A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675509409, "uuid": "36e800d8-34f3-4a29-8e01-2b31bdca6740", "value": "aea30aa8311fa7a3ea56995ee020184d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675509409, "uuid": "204bffa8-9df3-4591-b086-1bf2e419fe92", "value": "3072:9fryK7xh4QLjylMPWBX5mwtDf+Zv2nhnTzPaPdewJqBorPc9hmT6c:9fdL2WPtmk2nh3yPdZeorPaUT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675509409, "uuid": "d8dd45ed-2922-4aa7-90ad-515bbde5f672", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675509409, "uuid": "11a0e1f9-a93a-422d-92c3-cc9e969a7534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675509409, "uuid": "18000029-d176-4095-a8a2-f544855c724f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fef533-a483-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675512028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675512028, "uuid": "dacbcec9-1248-4e16-ade2-6efd527841b4", "comment": "Malware payload (GCleaner)", "value": "620a54a2f4fd5e635c624e97191c75f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675512028, "uuid": "d345b452-4164-494e-aea4-b0f28f79cc5e", "comment": "Malware payload (GCleaner)", "value": "15c6a1040dd99ba66ce6ddfe56298edd3ef8dff6aeae6dc95df4a332712efcc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675512028, "uuid": "fa487abe-7a2b-4244-a5d8-0567fa8c1f36", "comment": "Malware payload (GCleaner)", "value": "fdd8d28c06d16cca61332abe4dfffb7bd1b37b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675512028, "uuid": "bceff677-4e18-4355-9140-1eba71d70462", "comment": "Malware payload (GCleaner)", "value": "317be30809fe64510ac11a3b2c91fc0e6add80eddf402f82ea8138b896be7a59ad39719f3e860ed7fd28b55a0d710ffb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675512028, "uuid": "323adaa1-4652-40b2-be68-f9f2bb4025de", "value": "T126B5DE126CA8E067E0C88FB0CCF36DFB5C15EC79C0B5095791457EFA7A32E522C56A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675512028, "uuid": "0d3cd4dd-0ace-46e6-a587-4eacd33f2587", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675512028, "uuid": "d440b606-2e45-41c0-85dc-aff0ee669ee0", "value": "49152:d3ZnA8ktSfLm1TR3jPHGtSy7VvEFr6Kj2DQbSb5iO3vMNPUBGVALCgv2MR:XAADmrzmIyB652DQq1MEoov2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675512028, "uuid": "f226e8dc-6666-4628-bc38-663f25c48b50", "value": 2340688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675512028, "uuid": "9102b39a-d977-4319-9925-8e51a82a30bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675512028, "uuid": "46531773-0c94-4010-bb4f-3415c32ba502", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448cfa0d-a435-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675478420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675478420, "uuid": "03925eb9-d314-4279-93e9-77e7a5714baf", "comment": "Malware payload (AgentTesla)", "value": "46b709feecaad863e9877629978ecef0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675478420, "uuid": "49c445cf-bb12-4384-9636-ca2ccdb2abc5", "comment": "Malware payload (AgentTesla)", "value": "18fcbcf0abcdc8ab3bbcebd6b8a7399ca9909f45bf915adf8e55c33171c48f9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675478420, "uuid": "738ddc5b-6cff-4c7e-ae19-a58c87aa23dc", "comment": "Malware payload (AgentTesla)", "value": "1270d543a4057eb557fbecacb71d47a16fe690dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675478420, "uuid": "1112a1cf-ed18-4d98-b87e-433fa91a3f49", "comment": "Malware payload (AgentTesla)", "value": "37d5677f827cbc8032496aa9c91e3091f091dcb1e8da48f97b0c802d87c134e67d18893bcbc3c609779698ac5dba349e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675478420, "uuid": "27eacc0b-ace4-430c-9206-fe254cfc6697", "value": "T1FEE4E53D297717E6C338F97186E18420B6EEA1923703E969DDEA1AC14F026C27DCE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675478420, "uuid": "9a8bd5d8-5ea5-46ed-b355-bd8a572fe672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675478420, "uuid": "b335098b-357b-4c9a-a56d-05d03188b832", "value": "12288:HjQaZ9++C+2SlLVseHKNTn7tunA+/kSLFDR8uVTdczDFRFrBwklnfGP2Cm7ljwX7:H5jseHKNTn7tunA+/kSLFDauFdcvu05E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675478420, "uuid": "f8e1d246-698f-42e5-8c1a-e661c784e18d", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675478420, "uuid": "127537f1-fc9c-4ff1-801e-abab823ca783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675478420, "uuid": "13242397-7c7a-400c-9b2b-90de56855fb9", "value": "updated statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1222465-a45b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675494923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494923, "uuid": "6305e855-2135-42a9-b122-74db7d7c738a", "comment": "Malware payload (RedLineStealer)", "value": "842f06930cf3596a3c1b6d980d6ccdc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494923, "uuid": "6eaa18db-b54e-4a4f-963b-47dc14ae1802", "comment": "Malware payload (RedLineStealer)", "value": "1a046c1f90dc038d7ed54cd9f37e456ea4f5ff927fba8ec327733ade25981e4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494923, "uuid": "ae2997ac-ed4f-4cd4-98d2-94cc341edcf5", "comment": "Malware payload (RedLineStealer)", "value": "356a2764f6a17071b5115e640b3bddf2d3661167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494923, "uuid": "12ffd1db-d18b-41f0-9a97-ea8ad42a9991", "comment": "Malware payload (RedLineStealer)", "value": "1e7fb6c0a8d7ec2d321dc39f4c740ee51174839bf89f2807eeee625f7cffd9e9491b35230e2047a0b98a73ae0fa10992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494923, "uuid": "5d902cb1-e9b5-4980-8ecd-c3f9b5dd803a", "value": "T1BDC4122138D0C177D47252706914C1B67BBFED329AA6E6937BD80B6D5F703C26A2630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494923, "uuid": "dfe7eef1-9134-4513-ac82-da8df3aaa685", "value": "d8db521c1aabdcc02e1c1d2a0eb59db9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494923, "uuid": "3d375beb-7478-4a76-b10b-a8b0bcc264d0", "value": "12288:Paa8xjAoz5fTtP3sdk+D9+1mx+8ozCDw:PsjAoz5mk8Tw8tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494923, "uuid": "44173ae9-ad96-47dd-9e35-e305e21ea574", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494923, "uuid": "464f814d-916a-4609-a079-8d5c1c5481b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494923, "uuid": "1fa8852e-c42c-4799-bc55-71c166857927", "value": "842f06930cf3596a3c1b6d980d6ccdc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481a18a5-a446-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675485728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485728, "uuid": "b85cb47b-1df3-40b4-ba21-e52327cd56e9", "comment": "Malware payload (RedLineStealer)", "value": "dbf6954a47c2b4ee5f2b9abe34c49ae8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485728, "uuid": "394f963f-eb3f-463b-87b8-2e44a16c541d", "comment": "Malware payload (RedLineStealer)", "value": "1adabdcafef5e2c6792df2390ce22151c46f03203bf529a708d776809710b83f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485728, "uuid": "c70a81f4-a8e5-49c5-88cb-8b38b3728104", "comment": "Malware payload (RedLineStealer)", "value": "5f8a8e434274fe41de96e7ec91c3aac83243497c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485728, "uuid": "4948037d-7e31-4901-9fd5-27e0cdc7929d", "comment": "Malware payload (RedLineStealer)", "value": "6faeb752c01035406b20e007e60a36019da350a999325fa81bb6cff9366bb9a2bbbd0eec26def025231e4b86e7c125ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485728, "uuid": "fd0aeca1-86d1-4839-b214-ffb7db8f535f", "value": "T1F504C51437FCCD11E1BA1A3F6961A05087BB9802AC52F65B76C367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485728, "uuid": "80a8c618-8327-4fea-a51f-03027399b109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485728, "uuid": "798cd7ff-1e02-45ce-a9b0-f0c421ea0f8e", "value": "3072:MxqZWFtaKUPLvYjdIaZvFGnem5AdhtbxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUwy:iqZLYxIycsdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675485728, "uuid": "23fe95f8-d129-4df0-94f7-703b8b8385fc", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675485728, "uuid": "471bce66-ebbd-4e05-a350-6cbae5000306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485728, "uuid": "6c98c3d5-fd78-46dd-8465-cb8617448034", "value": "dbf6954a47c2b4ee5f2b9abe34c49ae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d186d3a-a44c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1675488313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488313, "uuid": "49e098c0-a1d5-4e33-922b-25a1721ff51c", "comment": "Malware payload (Chaos)", "value": "fa06e6aadef2365052156f12c92d7b09", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488313, "uuid": "72b1ecde-308e-4739-8b64-c25e3f797881", "comment": "Malware payload (Chaos)", "value": "1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488313, "uuid": "3707c465-919e-4874-9b05-8b39a286b3c6", "comment": "Malware payload (Chaos)", "value": "82de91795547028be327e75cee0fdf082352bfc9", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488313, "uuid": "6f7db219-7409-4b07-af18-ff63a4c158de", "comment": "Malware payload (Chaos)", "value": "b719e1050d9017c3f5a986013e9c223af52783468dfa9b8888ba195abf716fdb9e78c9f309d8b3bdc486db47af508f85", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488313, "uuid": "efa9eec4-2f43-4654-b552-2962b9cc23de", "value": "T138A50E342EEA502AF273EF799AE475D7D95F77A33703984D10A1038A4623A42EED143D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488313, "uuid": "47513603-6278-4b67-9be5-6d6e0f3ef4da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488313, "uuid": "d28cf19c-1192-4e47-9cd6-c182e07d16ca", "value": "24576:a5SndG2iSNjN2w9Os9cRfO/d8mT6c6aVqwPhUMelU+V:aMfJqsgXmgyJPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675488313, "uuid": "38cc7d81-4390-481d-9133-21929e6fa148", "value": 2083328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675488313, "uuid": "a8aafa0e-1ad0-4f39-b8f8-8423a697fbcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488313, "uuid": "2a17e762-fa9d-41bb-b75d-0843eb0f8166", "value": "2023-02-03_fa06e6aadef2365052156f12c92d7b09_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9abfa88-a487-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675513889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513889, "uuid": "3d5140ee-9a07-4528-92c2-c5d85fa82ff8", "comment": "Malware payload (RedLineStealer)", "value": "178787ef7817f8bdaf3ba5b62d5307e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513889, "uuid": "4f8eb2d5-5626-4b03-9fe7-752b54db8b67", "comment": "Malware payload (RedLineStealer)", "value": "1ddf877ba944c51f831c7d2053fce3a220fb00e0c99b0c58dc2c01a9edbc94f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513889, "uuid": "048f5cc8-2a26-49aa-955c-25643bc8ded8", "comment": "Malware payload (RedLineStealer)", "value": "62f9f7127ee51f873b13ed6c17a900df0339c114", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513889, "uuid": "6692e037-47a8-4f1a-8a9d-55a21eabade0", "comment": "Malware payload (RedLineStealer)", "value": "7f7cc87bf05e3f2ada3382f0ce49ffaf4c61aaf573aa8b5b075faf9bab08fbc4a4fcc1f6e2197a69169cdcdf69f82efb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513889, "uuid": "8f23907a-0eb5-46bf-aa5a-af56ce3fbe80", "value": "T1DF5401313580C472C5AB24304D78DA66AB7EB531A27A965B772813FE8F307D11A7734B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513889, "uuid": "6a4b72a8-d237-4000-86a3-6437a54c5a27", "value": "3a600fd555a59cd5911cb26c6ab55d55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513889, "uuid": "48d25562-0603-4a86-9d8d-d480edf6bc96", "value": "6144:/FebLLaCkD9PbeANEMfefT9uwIUu+vvWovIL9:/FebCCQHCy4puwIyvWos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675513889, "uuid": "69d6ba0e-65c5-4267-9f7e-4f0804b5b1eb", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675513889, "uuid": "8f8b8f00-93a2-44f3-9e15-d28f3c0f3ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513889, "uuid": "b5aa422a-6234-4f43-8704-b4eaf6c83901", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b00b60-a44c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1675488294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488294, "uuid": "3c3c4e36-a262-4556-8c8c-865232c84fc0", "comment": "Malware payload (Chaos)", "value": "f0fd67c94f25de71c2fcdff4af0d2889", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488294, "uuid": "67e79f37-4e60-484e-baba-d75adfd98a0c", "comment": "Malware payload (Chaos)", "value": "2005110ee806a4fb40e00fe6c76af3527e3d66cd828723ee39529942812b8924", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488294, "uuid": "9312a6a4-400c-4231-adbf-a023d764d290", "comment": "Malware payload (Chaos)", "value": "2f4884f4e241d0bda353dc074ea1752e0b79af8c", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488294, "uuid": "ba0b509e-7693-459b-bf73-8840c546b7ed", "comment": "Malware payload (Chaos)", "value": "7b5eeede856d3baccbc7ffefca215d6fa7c01523bb6e6eadeb8e39cf563b7cfb8958786c1d7d0f1bd402f6f0e6b6fbbe", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488294, "uuid": "987e0a41-7d09-4b82-b903-82123068ae1d", "value": "T1669500343EEA502AB273EF699AE475D7D95F77A33703984D10A1038A4723A42EED143D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488294, "uuid": "537b4b2e-5035-4732-a2bd-798bc219116f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488294, "uuid": "943d2927-1a85-4e05-9394-25c7b075bc6a", "value": "24576:6SndG2iSNjN2w9Os9cRfO/d8mT6c6aVqwPhUMelv1:/fJqsgXmgyJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675488294, "uuid": "fbd035b6-5625-45b0-88e9-e5ca623a2e78", "value": 1967616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675488294, "uuid": "a520fe47-ca66-4bff-a633-8a90ceba4a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488294, "uuid": "6ba3d645-30ee-4d2c-8ac0-f64650f9872e", "value": "2023-02-03_f0fd67c94f25de71c2fcdff4af0d2889_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce00dacb-a4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675531050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531050, "uuid": "97c8fabf-70af-4f0a-96ae-22ed4ff03bac", "comment": "Malware payload (GCleaner)", "value": "3913c37cb446780af58f1bf4abf7d4a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531050, "uuid": "389161c9-2987-4141-aea9-a399abf15f81", "comment": "Malware payload (GCleaner)", "value": "20364ae5aec92f7ed48715a4a31d1e6cdc37d34d13f54b0e4f8067fe7af7a54e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531050, "uuid": "8a5bfe80-a3c4-4a04-8593-f6a26a0bc07d", "comment": "Malware payload (GCleaner)", "value": "ab9fec3426fcaff8f1aa87f144c6596a013aac51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531050, "uuid": "bee08dec-d2f0-44c1-9caf-737dacdeedf4", "comment": "Malware payload (GCleaner)", "value": "418a8f1e662e79c4e24e4f250bb03fee0a0c714e707ae5750d26a5442cf3027b0267f1120d61619ae1e4b3bb6d218b76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531050, "uuid": "521122ec-7e69-4e62-83a3-9ab67b8b8871", "value": "T194B5DF125C98E067E1C98FB4DCE36EFB4C05EDB9C0B91817D1447EFA7A32E522C46629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531050, "uuid": "3e2a7f01-a796-42d4-a578-c21cfe448290", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531050, "uuid": "b2b3a02c-42f5-4419-975c-7cdf63e613a7", "value": "49152:d3ZBW4fKfSnp228xBETppi8F/SgxBT3LCgv2MR:Xc4SfSnp22tSgxNDv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675531050, "uuid": "25e9f97e-4597-4277-bc6c-851f28c85061", "value": 2317281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675531050, "uuid": "ebab0d98-f132-4483-87da-ab90055881b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531050, "uuid": "8280758c-8d9f-4887-ac4c-6161fa194f16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca96cc23-a491-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675518159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675518159, "uuid": "aaee56ef-72c4-4f64-88ae-6ed3e929e602", "comment": "Malware payload", "value": "047c2c2ff58e1afa71473ba3addfcc19", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675518159, "uuid": "14e57a47-0727-4099-a1e9-06bcec053680", "comment": "Malware payload", "value": "21d46c7438ed4f0f04de9455e49f53a96480e6a9850e71fa954f19934e0c2ba7", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675518159, "uuid": "121159c3-85b4-4c20-8631-67472dc78655", "comment": "Malware payload", "value": "dcf26d0736a095271fe6a83a48f48fa67821c9b5", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675518159, "uuid": "e0fc3cb7-74ae-40cf-bec9-8f8270c379d9", "comment": "Malware payload", "value": "ba808001dcd811eab7f5e4629767b7d53dd72bb101ddb60374becb7a27b6aa3f84ca38b0a8365bf2a6b692ec2ece2b5d", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675518159, "uuid": "ce74a315-6013-45c0-b004-793ec81f3f7a", "value": "T1C8555B5D21A841B8D47AE0B9D69B5603F23238000FB19AFF97D511925EAB6F05A3FF13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675518159, "uuid": "0e4acfc5-49a5-4223-ae2e-b2c2495a4eda", "value": "f1f05867c4b61080ff93e14774ae9ef7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675518159, "uuid": "48286a38-312c-47d5-945b-391573a263a1", "value": "24576:lv/tdRXhovLSXG0dacmW2ajzHtL8D11Jg5T/McYZ7UO3sS3inDdgj:5tuLSfaaFL8D11Jgp3BO3sVDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675518159, "uuid": "59e6149b-6307-483b-8b54-fe68335fb439", "value": 1334272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675518159, "uuid": "82ec3861-06c5-4671-a02f-63e46bdff062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675518159, "uuid": "24a54f3b-250d-4f7c-88f8-72327d227668", "value": "TnyavnTosGTA5ModMenu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cad0035-a4af-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675530913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675530913, "uuid": "c8033445-410f-4b79-8ac2-21e2043534b2", "comment": "Malware payload", "value": "814355146c80a0621508ccb76b1722b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675530913, "uuid": "34a9e1f7-50b3-4dc6-9dd8-c5e4286a6f3f", "comment": "Malware payload", "value": "22ada2212b1f914792503254ce9308b30f661d83a4c48efdf14a824f5e674fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675530913, "uuid": "d9498a71-eae9-4526-82aa-56a757f06e53", "comment": "Malware payload", "value": "db36a41b6e01382c6c312ab10885e9fc47055be9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675530913, "uuid": "ad55e4a0-c002-482c-a795-1b8eb52196d6", "comment": "Malware payload", "value": "d6aea17c889c76166d3884125cb6b5a722e694c9fb245ad3a5cf358ba4898ce6c2f625fed89e9b74c467ae975748185b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675530913, "uuid": "a49469c4-6f1d-4c1c-a4ed-4387950cbf44", "value": "T15E7633203AF7CDBBF47BA0319DE17C4C51D7AA414DB185B773B484262FB81968A62873", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675530913, "uuid": "b4c41139-a344-4a1d-b7c9-72a29682781d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675530913, "uuid": "cf5e78d0-93d9-4f4d-a713-d96f79ae21ca", "value": "196608:91ORmQ4C7W+LNR8JYQNs4sSROq+zIj2MOTJhre9Bor:3ORmQ4goY81+8SMO1xm+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675530913, "uuid": "ab69373b-ebb8-4bb1-9172-f07728bd71ef", "value": 7635171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675530913, "uuid": "5881fe3d-85cf-4ad5-b0aa-d37b0aa4039d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675530913, "uuid": "a43311de-0e14-4f16-b8d7-65c0376af183", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f01eab-a4b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675533848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533848, "uuid": "7652915b-0b00-4253-9499-01e31a7c207e", "comment": "Malware payload (Smoke Loader)", "value": "89ac37037ea8c2b468e5446316e7075b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533848, "uuid": "754cc4df-dce9-4060-8007-e3525368a94f", "comment": "Malware payload (Smoke Loader)", "value": "22c3bc75bc08b897f679a81b16e9fdb8a7420046b102ef5f2159b617eaef011b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533848, "uuid": "2278a7c1-ad91-442f-9d19-3142d7f2970c", "comment": "Malware payload (Smoke Loader)", "value": "964db6d6e5397266c40c10c471391a494573263a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533848, "uuid": "53743704-aeb5-4e3c-a09c-3755f56a5cdd", "comment": "Malware payload (Smoke Loader)", "value": "6ba6f9401c3fda71dc6bfd20676d6731b567af7d99e243dee49f47e4efbd27864aca183108f5c71707fffbb93fc203cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533848, "uuid": "d4c0c868-ddea-4d5a-bd09-42c975af0cf9", "value": "T18514D0373190C032C1AB15374C64DAA85B7EBB3C56B5895777A81BEE4F702C1A63A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533848, "uuid": "98cc5ab0-5527-4dc7-aa63-6345a503b109", "value": "158a612a52d4365bdc88fe279a20e1a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533848, "uuid": "a737b3c4-5ce9-4801-844f-2c06fb451d19", "value": "3072:3RMjnWmCL2uVB+anW5985rI6eAF5tBUNvgn0ZHLIHJhJ3HWXsSk:3RfL/VYanbI6eSCJgOHgh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675533848, "uuid": "c71a532b-883f-4e75-909d-176dbb888868", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675533848, "uuid": "8ee25108-612e-4ea0-859e-4e0b0ffd4065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533848, "uuid": "fccbb030-78e9-479c-9288-9ac91d2f3fe0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68885ee3-a4bf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675537751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675537751, "uuid": "a0def7f4-aaee-49eb-9656-0632e559ac8b", "comment": "Malware payload", "value": "00b471bd631a06fb4b21b345effb880b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675537751, "uuid": "8cfdc2a5-8353-4d0b-8505-f0e1a003e817", "comment": "Malware payload", "value": "22cb2fba2dde578f61c82ed450c88c9060629fa7736bb7e27a584c97473c0883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675537751, "uuid": "8772c7e7-402b-49e9-92cd-acafd4f4ed33", "comment": "Malware payload", "value": "b6e52506741ba627a96e681cb381db90c3fd21ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675537751, "uuid": "69479213-0d3b-4aea-af99-275a6035d8f9", "comment": "Malware payload", "value": "1a6a4548d11938c8b7c8788cce6ef0cd43eb17242ba7c293b3459f03caafde543ec663db0705c61863cf296b2255b651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675537751, "uuid": "e5526271-9b9c-4d18-9b63-5f727e4fb5ff", "value": "T126F633611BA848DBDCE5213BC90FD86D55B4BC121794D18F81A9A30D2F73352AE3BFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675537751, "uuid": "16707399-8df4-4915-bb0e-0bda30adf6d8", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675537751, "uuid": "c80de7cd-33fb-425a-8306-0a552807a576", "value": "393216:GxAlnAT6K4/m3pWFqyoBgsSI7oeCMJf0:XlAWK4K91p75CMJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675537751, "uuid": "4b7c3c75-12ad-4962-9bc9-9a90114e5bf0", "value": 15620263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675537751, "uuid": "a35d4497-5bb8-4c2a-88d5-0acc3dfdb27b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675537751, "uuid": "74cf84b9-5a6c-4890-9c7c-3b4ab604e7df", "value": "Creal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bd36bd-a4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675529588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529588, "uuid": "7227f699-856c-4092-bc46-932d97a564f7", "comment": "Malware payload (Smoke Loader)", "value": "de3d660d0d9a4caa93e1acd84ad8ba31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529588, "uuid": "4c678ebd-6679-4536-9aab-087ee9a106c7", "comment": "Malware payload (Smoke Loader)", "value": "24c0e9366580684e8ae1d591b36ac50599fc8d6dfb2486ce4ae8d1fff679de04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529588, "uuid": "d3011690-cdbf-493e-9348-cfbc8ed259c0", "comment": "Malware payload (Smoke Loader)", "value": "35b3fe75c7f3de5f83d7c90d53eef33065538532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529588, "uuid": "965fe1b4-922f-4326-887e-63e6d849fffd", "comment": "Malware payload (Smoke Loader)", "value": "9994d85b851da5f604bc72212ddeafeef56219f902f4f83ef5b954dd7c08f698dd05f917c299402b69466c6393a1d631", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529588, "uuid": "5f216300-7aa0-47c2-9907-1dce30fc96ba", "value": "T14B14DF3235C0C072CA7B04305CA5E7A5AFBDB93155759A5B7BA80BAD9F302D0A73A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529588, "uuid": "11258cca-cea8-4ffe-8390-ad45814a6bca", "value": "be7581a01c1ad2f53e81adb31665eb55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529588, "uuid": "494fc120-aaf9-4738-9084-6866677ba668", "value": "6144:neV0L4UsKWfT2qRQ4ptoyM6cJNbkGyqCF:neV0s9KWfT2wtoXjNwBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675529588, "uuid": "b09e8e74-0e62-4d56-8b66-2287ea547377", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675529588, "uuid": "070ddbee-00a0-46b2-8e4b-6f27003c3929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529588, "uuid": "bb371c8e-6160-487d-987a-17e6f9de10d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6357b07a-a4bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675536454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536454, "uuid": "54bd2256-2e88-4930-aae4-86949413104d", "comment": "Malware payload (RedLineStealer)", "value": "9b790aed9dfa3ed79130326d22ace870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536454, "uuid": "82089807-0b9a-4f26-895c-799237e6bb09", "comment": "Malware payload (RedLineStealer)", "value": "2523f26462ec436f120228e9299429a27b42cd871c861245f2e7b093f33ceaef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536454, "uuid": "8121134c-3f58-4f35-8ff5-cf2947dbf9e3", "comment": "Malware payload (RedLineStealer)", "value": "1120c90033502fb01c7c55f41394f9e5bc8ff9c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536454, "uuid": "0bdb855c-d2c5-4b08-9384-0bdaadc53726", "comment": "Malware payload (RedLineStealer)", "value": "ea4d9b1b7ca8765a2df82e501a6a9aa7c0600f3946d3ca9afe9483d019c6e79c69d0bff1e571eb8a502adf2471927ceb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536454, "uuid": "a7460e20-69f3-4dd6-bb5e-4810017ff938", "value": "T11604C51437FCCD11E1BA5A3F6961A02086BFD8026952F65B76C367CD0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536454, "uuid": "635a8b95-bf99-4d94-b032-84466127146d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536454, "uuid": "4549a267-2f57-41f7-b351-e7657992c29b", "value": "3072:ZxqZWVNaDUSkP/58ZlBeN5FrhZ3xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOu6:LqZ8x84rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675536454, "uuid": "8803c08a-e770-4f45-83e5-c7ead799050d", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675536454, "uuid": "bbdefb0b-d3de-4c6a-87b3-43b6f432e108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536454, "uuid": "8be53b1d-722d-4e8b-ad13-bf374d0de7e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c9ee39-a474-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675505595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505595, "uuid": "02f99156-fddc-49c2-8be3-dcd973704d15", "comment": "Malware payload (RedLineStealer)", "value": "17a3134bec3bb923a3209146fd8d55c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505595, "uuid": "919d36b9-6e63-491b-9612-56841b79879f", "comment": "Malware payload (RedLineStealer)", "value": "25ea96abd59cfd5a1773b73dcd925f242df0865e17bf71eb04f7972244556c4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505595, "uuid": "ad419aec-620b-491a-9118-e955b21d4677", "comment": "Malware payload (RedLineStealer)", "value": "781f63e40e7e978b1f361f1f068073685e80f594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505595, "uuid": "91b755f3-a09f-451f-b0b7-c492d21014ae", "comment": "Malware payload (RedLineStealer)", "value": "b2a4d49c651a1768991dadcd91c895413363be48a9a02d338b4aab3390b3ddce77f8395481bc3c7e050d361ec9830b31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505595, "uuid": "fb8f457b-0f9b-4ee2-81ae-f1de3601ee15", "value": "T130D4123236E0D131C17B15752425EBAABEBEA830437883A77FD846BD6F306C11676E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505595, "uuid": "1f663c47-de91-46fb-b4ba-8ec0f3e5673a", "value": "aea30aa8311fa7a3ea56995ee020184d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505595, "uuid": "29122e94-2a9d-4e60-ab80-446054016e10", "value": "12288:ibtBVre0c/uP4n2eOWBOzTKVegCBNPsIr506lO3DBb:iRFP4n23zTKL0RrdOzBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675505595, "uuid": "3122cba2-e43a-4888-b91e-b85a88b57d38", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675505595, "uuid": "d6192537-ab8f-4b2a-b03c-4cb1814c5145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505595, "uuid": "f83c06e1-d1a2-4319-9363-f8ccc83e8b59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069cc495-a430-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675476169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476169, "uuid": "a0f4839f-1aac-485f-b020-13c82af2d311", "comment": "Malware payload (RedLineStealer)", "value": "932ea179cc4662ae6bd627aecc5ed45b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476169, "uuid": "fc5b9b38-28c1-451e-b1d0-ab0a17836970", "comment": "Malware payload (RedLineStealer)", "value": "26f1e9a74a141a40ee0076a12cf42d652a21311bd56a6fb724ea40853d4b1a72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476169, "uuid": "6f5dcfdc-931e-41ed-888e-bc2de603d0ab", "comment": "Malware payload (RedLineStealer)", "value": "c627894fffde31cb835aea7418f176d2592bfaea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476169, "uuid": "fac9a632-9e15-46a9-bbe1-6571237b97c0", "comment": "Malware payload (RedLineStealer)", "value": "e3ba7b8f31c7889f7b40e6cf0568de045c82ad7b146a232013278eb9eebbf6b60b4b397b1408470e3ab8cd12511cf068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476169, "uuid": "6ffda3b1-c83f-4291-b469-91183a0e41c7", "value": "T1ED54F1223AD0D472C47B21305C20D6AAB77DF43196B98A8B7B64D6BDCF201D06B7B356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476169, "uuid": "c17f5bf7-d14f-494b-90bd-789466ae29f3", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476169, "uuid": "7f8e271f-f726-4dca-bad3-34012c57240e", "value": "6144:4l0LAs7wtgb6CVkqxc3lz/kbqF1e0BtkkqjgoBE38Hp:4l0sqwtk4z/0qje0vu+MJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675476169, "uuid": "8896b4c2-2a58-4d71-9367-a29ae7de4c42", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675476169, "uuid": "83f36037-ab8d-47d8-85f1-cd8d1e9dbf81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476169, "uuid": "666f5ccf-e7df-49e0-8278-d72450651786", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4058c41e-a467-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675499888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675499888, "uuid": "dbd376eb-4d14-40f0-99d8-01555675622c", "comment": "Malware payload (Amadey)", "value": "092d5c057ec1984ba68b0df33d468326", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675499888, "uuid": "ca77aa35-3a60-4ef0-96e3-e9799e3127fc", "comment": "Malware payload (Amadey)", "value": "2b3f4f65716c1ccd9d91efd400749173ae2b96f2d847bb43da7d2cec2cd2dc05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675499888, "uuid": "470d8de5-e4a4-43f2-9f1d-3ead3c5d88e7", "comment": "Malware payload (Amadey)", "value": "eb9951cb7d501ed9e7187422f929c41c15aa5c06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675499888, "uuid": "83ad0c13-6608-48c4-a739-ca18e29d0b27", "comment": "Malware payload (Amadey)", "value": "2ba98880f9e1dc0f50e050100c7da3e325af93c29e4284eb21c0e0674d16af6458e9da5b87007a0f6fcbc9f1b0bac9cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675499888, "uuid": "eb7de446-a9fe-45c0-925d-6af909af7ddd", "value": "T1E3940247A7E94432D9F517705DF607C30A36BCE2AC74826B6786A91B1DB3284D83273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675499888, "uuid": "63d4cae3-5650-4eb0-b447-6406a5c2650d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675499888, "uuid": "55f026c1-acdc-4402-a048-01bf75500ec3", "value": "6144:VhEN7+Mp0yN90QErnYp8MLfMR7jrufJjfWQBK2Gpzws1fLsPYM0l1rdhQEg:VG7sy90ULfYjqjf5BK2GW0LsgMi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675499888, "uuid": "b7feda13-31d7-4ae2-847f-49a754e7007b", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675499888, "uuid": "d3008914-eec9-42ae-b6b4-75694def0f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675499888, "uuid": "74222226-af2a-4eb7-a47d-4288a055975a", "value": "092d5c057ec1984ba68b0df33d468326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca31cf0-a455-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675492285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675492285, "uuid": "b5997101-c037-4530-88ee-583237c5cfb4", "comment": "Malware payload (RedLineStealer)", "value": "80241f693eb8fe2f1553fe484b8db594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675492285, "uuid": "18e985d7-c98f-45a0-aec1-3a7570e6294e", "comment": "Malware payload (RedLineStealer)", "value": "2b88a61f07c8142b05a4fb771d44890e433999a6bd9fd1b9f7808a6c275ee9bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675492285, "uuid": "a2bef13b-ae15-4bf2-9d8f-804dd0f34015", "comment": "Malware payload (RedLineStealer)", "value": "003f013a62fabf38b591f6cb24368736812d6858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675492285, "uuid": "9142acbf-346e-422d-84cc-3bfc53137304", "comment": "Malware payload (RedLineStealer)", "value": "c8937427e4ecf4e430a93d2c9c5700766601dc6085ac0e5f0793f5a58d0654e4240f0448a9412091259155795430fc3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675492285, "uuid": "761617cb-7d78-4860-836d-111344c33f1f", "value": "T14854023276F0C0B2C56B01746C24DBA9AB6DF935427989177BA70B7D4F702D0AA3B316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675492285, "uuid": "76abe7bc-ff65-4a8f-a0a3-ffcbb76a3081", "value": "99cebe82e9a09163c3069dbc31af6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675492285, "uuid": "a42485d7-d28f-4342-8db1-83eb12a1ebfa", "value": "6144:lJULJ2bn5bCYw6vRcQX6bvu7RC8RxvhuewvmIbyTUOf:lJUQb9CVKR8bvuF/jRwv3bI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675492285, "uuid": "07f22f15-8431-4fdd-9d52-d41e86a43d29", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675492285, "uuid": "d7bdd9f1-9739-4eea-b7f8-919928428dc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675492285, "uuid": "e0e4737a-e20e-4baa-9c9c-ff3650d981e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa55bc6f-a4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675546156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546156, "uuid": "bb78fa68-b15c-4b97-8a84-fe04fb61f55b", "comment": "Malware payload (Mirai)", "value": "f5f645f31ee097902e403dc7f79a285d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546156, "uuid": "76593845-0ba1-410c-83ab-cf1204b0f5b2", "comment": "Malware payload (Mirai)", "value": "2c7b7bfae6cc57df31ba38226ee61314aa26e894e5b4ef12ac5e42e4dcf1605d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546156, "uuid": "79ee06cc-59b7-43a2-a487-e921b5d09dcb", "comment": "Malware payload (Mirai)", "value": "937dddc84babd5034616b379c79673e89fc4be41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546156, "uuid": "f001aef6-706f-48a4-9095-fb305b1ca0fc", "comment": "Malware payload (Mirai)", "value": "f0032df88d14014567cca27cb0119bcc0cfa3afeaefa4fe8da6e601344be05e9b3a63436c9d2e9f5a3c5efb94265c8c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546156, "uuid": "828baff2-85ea-4b9b-bed8-158b84226a47", "value": "T1CB633BDAF801DDBDF81BD77A4453090AB630F3D512830B366397B9A7BC721A91D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546156, "uuid": "4d46a380-4b4f-4e63-8010-33985875b02b", "value": "1536:nYwtYY1wQuDYHJu8VBfy1MxeS3VdJTbAdhmq5Q8N:nYwYYm3EHJ3y1meSV/vq55N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546156, "uuid": "eec4b26d-f862-4f6e-9821-852a12b3ca52", "value": 69640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546156, "uuid": "6f2a3a93-93d7-415f-8347-cef94813f281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546156, "uuid": "a05a8d59-3991-4d2e-bcdd-84d0e1c9d800", "value": "f5f645f31ee097902e403dc7f79a285d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848bb6d5-a44c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1675488406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488406, "uuid": "fd5464f3-acd4-4b84-a661-15940a5cd5dc", "comment": "Malware payload (Spambot.Kelihos)", "value": "a59e12fe21bb6df9384f18a30ec5f5d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488406, "uuid": "8e274d63-8d1d-41ed-8464-cb18dfefc714", "comment": "Malware payload (Spambot.Kelihos)", "value": "303e0a54b1ec43bcb7f0608ab138ff072325c8b1d1a17beb4c5a1d86029ffc89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488406, "uuid": "df7eafd7-d10f-4478-81a4-99dcdb52d6a2", "comment": "Malware payload (Spambot.Kelihos)", "value": "539c7f98d917f06c24581a203bd9d26e2e2382f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488406, "uuid": "1bb655ba-8e10-4b40-9e07-48bac05cf3d6", "comment": "Malware payload (Spambot.Kelihos)", "value": "6bf3db7ab4cdc4b0c455f53788e516b6f2fabf6128ffb93c5bbf95e48a3cf7a978b5e035592e22b27aa73493449fb6fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488406, "uuid": "fb5f08c2-8387-44d4-bc5f-55e0ca946fbd", "value": "T163557D48B3719A0AC5F3AEB49CC525F03ACB6A1C797BE2F652052C7BE07D606C660DD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488406, "uuid": "6062feca-3df4-4b44-85e2-c34b034ea59c", "value": "df49f61531d81eac8283dff3bdfa51f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488406, "uuid": "5e463476-3926-4b37-a8df-09f3afd83564", "value": "12288:XXofoFKDWqTG4dJJy8/eDyhPxtDz4XE8/x2KYhstBYX8+kf+nfkDp9otCmk0rjxP:X4gADtTdqbx3YhstSXZkf+f6V3WFQRJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675488406, "uuid": "28d8acde-4a0c-4333-afde-ac18218246e6", "value": 1301416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675488406, "uuid": "57929240-1b52-4a13-a4b3-b41391772d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488406, "uuid": "df77c798-ffbc-45f4-8a01-e95e4ddf029a", "value": "a59e12fe21bb6df9384f18a30ec5f5d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b818342-a4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675540816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675540816, "uuid": "7f2cb560-dff9-4e7c-952a-8e96861c1287", "comment": "Malware payload (RedLineStealer)", "value": "ef4b3f41e142a0ab062d4b87025b3aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675540816, "uuid": "0035a01f-eb15-4459-9c05-8ac8ac389efd", "comment": "Malware payload (RedLineStealer)", "value": "30e97c94990818f89838bd96b3c90c411e89cf801198a0be961944503b1329ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675540816, "uuid": "913c3c1e-1f7d-44fd-a121-12eeb69461ae", "comment": "Malware payload (RedLineStealer)", "value": "d00f8704bfee43abcda24391bcf012d218053db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675540816, "uuid": "e659487a-b27f-41ca-88d2-fbdda39dfd83", "comment": "Malware payload (RedLineStealer)", "value": "71034e5f5c4b0684da6e817d39573b134a436caf3fef6896dbae470630c526b209a349be9f4661e3ca04996594c3f0f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675540816, "uuid": "c1962a09-50d2-426f-adcc-d6be4c937b4d", "value": "T12604D51437FCCD11E1BA6A3F6961A15186BF98026C42F25B76C367CD0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675540816, "uuid": "9218e5f2-6bb2-41e0-b8b0-75260af1f0ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675540816, "uuid": "46cbc3af-51d0-476c-ac06-cfce77737781", "value": "3072:bxqZW7naxIF63+kkIier59khFLxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwd:tqZj+k3lkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675540816, "uuid": "5ad69ffc-6c6c-4063-be43-5b51a1d219ae", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675540816, "uuid": "38792fbe-ee96-4f0b-b4a8-db63c238ec9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675540816, "uuid": "1b86e44d-e2f5-4c5a-8c3a-a5b6cd632356", "value": "30e97c94990818f89838bd96b3c90c411e89cf801198a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af52897-a441-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675483505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483505, "uuid": "2e1053b0-5a04-4bb6-a95b-702d20a7e6f6", "comment": "Malware payload (Amadey)", "value": "cb3c1f9611fdf6cc78a5e16ea5bab483", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483505, "uuid": "970691c0-4578-4ed9-8443-654b80c175d7", "comment": "Malware payload (Amadey)", "value": "317618ef12fa752d88f9de1c08291231f2496e33094329501d9a1e56b468be2c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483505, "uuid": "67aca9ef-5def-4b55-a792-b9752c506f5a", "comment": "Malware payload (Amadey)", "value": "ce0a1bf07b044b3bc0cec83b30a7f6c50a4011b3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483505, "uuid": "7776d868-0cb2-4f94-81d6-e7f06d04ca80", "comment": "Malware payload (Amadey)", "value": "3cea81b615b8699054cf8f8f51991455e3c613042bd0a550a0178be21b8120a67dfe45ce5b9c549948a54a5cfb9a5835", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483505, "uuid": "c798a24a-4dea-4c55-834f-0fa608c54bd6", "value": "T1400522313781C973C17B26386874EAA963BEE43227751E2F7B5ACB5A5F102901D7630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483505, "uuid": "e77547cd-42dc-450e-9c3d-38ef5138a60e", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483505, "uuid": "4aeb9d49-fc7d-48ab-a7ce-440f3fd8ae30", "value": "24576:uwBCQHVgtKvP8EsTfRey3IJfpoa+rf5hKwF:u/Qac8EsFgfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675483505, "uuid": "f45cef37-e2e0-4ac7-a7b3-3da9c17ff827", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675483505, "uuid": "3dba0905-8cf8-40b1-bb84-e9ed509515e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483505, "uuid": "91461470-79a3-4e65-ada8-f4baf0120244", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80df569-a4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675530986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675530986, "uuid": "109d9942-6b2d-4061-9fc2-21f848e2943b", "comment": "Malware payload (Amadey)", "value": "c08e3b5280f724bd7a650c051a3ed4ad", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675530986, "uuid": "8870bd86-a91b-4893-8caf-ac442207651b", "comment": "Malware payload (Amadey)", "value": "325a41b4dfab6ef08cfd83e2fb1ae1b1bbf1631cc8c2fe53ad29c78d657abfca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675530986, "uuid": "bbe56cb7-0788-4b95-8f8a-d74787634a96", "comment": "Malware payload (Amadey)", "value": "4dc7760450fb29b8c0e8af4ccaa701dc4eb58f50", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675530986, "uuid": "5d979e9e-9ea5-411d-a97b-616d597e5cc4", "comment": "Malware payload (Amadey)", "value": "6181304c0e133dca71da632f835f640f3c125274c0bf501c8e70aa65d88a07ca5259e09e8af0ca3c7abfe3424f167b56", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675530986, "uuid": "2a3a4ea2-f97f-4953-93cc-2ff719aa821a", "value": "T16B34D056ABD88433DCB11B701CF603C32A35BDA19DB8825B27896D5E0DB3680E53677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675530986, "uuid": "1ea04554-ccdb-45b7-977c-1372e869e647", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675530986, "uuid": "6c67e92f-0567-48ac-a531-aa0d23cf747b", "value": "3072:ROhX0N7+f1l5GWp1icKAArDZz4N9GhbkrNEk1AIoCXqjZ4a4fT+XztasUiJ7G:ghEN7+tp0yN90QEfCX8Z437ujUiRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675530986, "uuid": "f01f3d65-6ccb-4044-93fd-99ccdc5da36f", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675530986, "uuid": "49f7d565-51b8-417a-b00b-24f9163acb25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675530986, "uuid": "6ac408ca-a580-4a42-b700-2530f84dd12e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8def91-a42d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675475135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675475135, "uuid": "b9b29766-37fb-4edf-9291-c84ebf24bfe4", "comment": "Malware payload (GCleaner)", "value": "3eb368f5edeab056b06ca5a9f2e0ffd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675475135, "uuid": "cce02572-947b-436a-a76e-376e99be5349", "comment": "Malware payload (GCleaner)", "value": "36c16404c0f41856499c1e4a3533578e87a2162688bae05ff796273198682c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675475135, "uuid": "b569dfeb-fd20-4133-a07d-26df252d9612", "comment": "Malware payload (GCleaner)", "value": "ec791b3c07b9b970b2af64e67759643c1533c0bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675475135, "uuid": "a0bd8757-f325-42d0-84d4-26e28b92549f", "comment": "Malware payload (GCleaner)", "value": "f8daac4bd1be5615516e636d17e9202f9fb5898f4645df80e97703ea5e41e2711db8f19d4d2bc668446fe37d400ef31c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675475135, "uuid": "73e0e11d-ec63-439e-98fa-fcfc6349dc7c", "value": "T1D19533C2727BC53ED2558BB47E2188027936EA35B83A5C25354D938D0FB3B01DB6AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675475135, "uuid": "c453a79f-fbb0-4b7d-a68c-ce3d7519784a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675475135, "uuid": "71ec2363-60da-4371-916f-1d574660c822", "value": "49152:ygZtbeO0eGSdDqhmA/U+cqngnCo/AjqYcrLfuaLCgv2MR:TZtqkDq0sU+NgnSjLFyv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675475135, "uuid": "6001d770-c4a1-49d1-bd45-30b0a23fa2ae", "value": 2054780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675475135, "uuid": "08e757a2-67eb-4ea8-af45-93f1234207f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675475135, "uuid": "89cc4a95-4fdc-43d8-83d0-a10890a78892", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ce37ed-a4d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1675547115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675547115, "uuid": "7d644062-5a21-420f-a585-d97a808a8fec", "comment": "Malware payload (AZORult)", "value": "5c011fd59a60dc0db2dee6f6aa60e79d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675547115, "uuid": "0fa75b0f-eb9f-4594-be74-eaeb3ecac44f", "comment": "Malware payload (AZORult)", "value": "36de4b0fc17f71c1081e39ce702680bef32f4a5ba60145bb9f6759691d1e3460", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675547115, "uuid": "f4813ac0-c4ec-440d-a8a3-a7cea460b6a8", "comment": "Malware payload (AZORult)", "value": "d0458c2cc16be344791f135d5dbd6cb68888ca29", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675547115, "uuid": "942695c2-86f9-48e2-a684-515db3ba7b08", "comment": "Malware payload (AZORult)", "value": "ef17a760bfc8164302125b7826c873ae2f6c44e554266c0dcc5f064553d0a3bde3599b44bc14909b154b262954882009", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675547115, "uuid": "6950962d-6fa0-4fec-8764-8d281c73f095", "value": "T10774AF42B7C289B7E5E20572098722EBD6229336872C5DD7D3941F4AEE313D2E3352D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675547115, "uuid": "970fafd5-cdd3-4aec-8d2f-3e2f900de446", "value": "1d88d597200c0081784c27940d743ec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675547115, "uuid": "0ad55e15-7b47-4878-b670-569892e3142a", "value": "6144:rWEVkoStOdrlqgh0p7DJ5cAT4HUV39zY1YfAh4Ua/apTBJ6:iECoStOHx2ppTV39Noh4Ua/apTr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675547115, "uuid": "3abad240-503f-488a-95e9-c16e81c87303", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675547115, "uuid": "d6631447-4161-4fbd-94c9-56652633b9cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675547115, "uuid": "ef1a3726-f8b3-421c-a1aa-f8c9c2dc475b", "value": "36DE4B0FC17F71C1081E39CE702680BEF32F4A5BA6014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11116183-a41f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675468885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675468885, "uuid": "a92838df-425c-45c8-a278-ef67d0fa53ab", "comment": "Malware payload (GCleaner)", "value": "3ce38678dd7b46fee9c59a751aabe705", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675468885, "uuid": "4fcab0d5-4bd3-4b9a-af52-2a286767db85", "comment": "Malware payload (GCleaner)", "value": "387c4ea826e5aaf2a294ee86b88625771139f4275cb08aa224d21a2e1254834d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675468885, "uuid": "622a7ceb-7fd4-4562-a403-f4a5364bceaf", "comment": "Malware payload (GCleaner)", "value": "46f6cd410c1b3268097a568036561b1636751892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675468885, "uuid": "5db33e13-fea7-4ee9-ad41-3ba314564bea", "comment": "Malware payload (GCleaner)", "value": "0345c90a06f4beaf23cea77c36c70bd37e866670e4ddf1b432a240e78d4e685ce93245e5da8f07f237b1eee32f422afc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675468885, "uuid": "74a7a6c7-8870-457b-befe-c973d775a310", "value": "T174A53366E3ADA03EE492DB7D6EBAD605FF75BC2510B0127220ED329C1F072E63507196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675468885, "uuid": "1d865409-935d-4bf4-ad31-09be17006988", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675468885, "uuid": "b6d6132c-eb33-4710-925a-1e3ee1ce594a", "value": "49152:ygvpjEiBmvFtHTgd5s/EnuAejEELkx/UG65BZQLCgv2MR:TxjS/H/Enu9jEaktqfWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675468885, "uuid": "d0c0596a-1168-4fcb-a935-2455abd3954a", "value": 2071948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675468885, "uuid": "5510bc41-1673-4283-8cc8-21aa56d64666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675468885, "uuid": "c3b1c12a-148f-4c43-988a-5522c69073d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbb2701-a486-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675513332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513332, "uuid": "9e315a5d-2a24-4cea-a758-5885d552058e", "comment": "Malware payload (Amadey)", "value": "92461c79cdcd6b08651d72a9869b7217", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513332, "uuid": "ebf0319b-0532-4d23-9bff-65818acb5b66", "comment": "Malware payload (Amadey)", "value": "3d018554a07f3eaee1ba0bf79ad5d01c601cae9daf01f901f92ca633db19ac84", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513332, "uuid": "a711adbf-7d72-4446-adbd-75259d9800b0", "comment": "Malware payload (Amadey)", "value": "3cce85722d7db440aeb290419e8cc5cd9bc385b2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513332, "uuid": "35d92b2f-344a-4d70-8e8a-20043aedddfe", "comment": "Malware payload (Amadey)", "value": "0fdf45e7ae7ea00855fa960646d767f2f73b649a00b6e852bf7511a2727fd32c98e4375f524cd53a05507a83ddfdaab9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513332, "uuid": "baf0dda0-436f-46f4-bf1a-c8b4028f3a5f", "value": "T134D412313AB0C472C48256355C68F766AAAEB9340631A85F776906FE6F306C17E3B317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513332, "uuid": "13d18e0f-8f7b-4808-919a-9c6ecaf4f3c6", "value": "3a600fd555a59cd5911cb26c6ab55d55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513332, "uuid": "5e374be6-a154-41ba-90df-a1ee6e9e8317", "value": "12288:W53S9vlR448RF+1BiyD1QE8vUVU5GCfglJ4bpsJqMH:WlYj88X3DvKylJ4lkRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675513332, "uuid": "625a9712-aff9-448c-83ff-e92006fe8b4a", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675513332, "uuid": "fca42fbc-97ec-45ba-a8b2-3caf61c17d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513332, "uuid": "f2be3823-34bc-423b-bb5e-58ca56a85328", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea76bb5d-a482-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675511770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511770, "uuid": "5b7e10e3-c02d-447a-bd5c-90782da62022", "comment": "Malware payload (Gafgyt)", "value": "aabe87c125890cab6858206eae312987", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511770, "uuid": "37ab3259-860a-40e0-ad83-194364c63487", "comment": "Malware payload (Gafgyt)", "value": "3f039a3b32ed78184cdb17593f934c2f170f572cf73516648952f2a7de9ac882", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511770, "uuid": "557158ee-eb92-4b4c-849a-05160829cef0", "comment": "Malware payload (Gafgyt)", "value": "bedc5db9bab4612dc8e9d907cad11c83dc128c49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511770, "uuid": "19feb37a-a78d-4f8a-b515-d01ed5fd2b5e", "comment": "Malware payload (Gafgyt)", "value": "fd9b471ba64b06e68344ee143561b7404ec4419b21cdbb8c19edcd33737cb48fe9af10a1ad59765c8e66cb50bdd243b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511770, "uuid": "a8fac845-99a3-454e-b191-aa9a925daba8", "value": "T1E9831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511770, "uuid": "246bd6cb-ae98-4101-aea7-a7085c3a302f", "value": "1536:BQOc40ozMPjej5qckA39ikRFa/nrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3B+rWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675511770, "uuid": "6611cc98-47a3-4217-8596-fc77fa7556b3", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675511770, "uuid": "93bf3487-ba63-4781-ac69-d455bfb3525e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511770, "uuid": "d0434f44-a8f3-4174-8a18-f042ed10de39", "value": "aabe87c125890cab6858206eae312987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef142dc7-a482-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675511778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511778, "uuid": "1f5d3285-c7bf-4d24-bfbd-5e0ac34b14fe", "comment": "Malware payload (Gafgyt)", "value": "d54e19e4dbb4ed45540b74fc3a391cc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511778, "uuid": "c9df1852-2c3e-44d3-a254-28a4b1aefc95", "comment": "Malware payload (Gafgyt)", "value": "4135430823ceb09e3c61bee693fa7c0a72162fb6ff07da57116d1e496852664a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511778, "uuid": "60ba9904-40e9-472e-bb62-ebb44c8e6ef1", "comment": "Malware payload (Gafgyt)", "value": "2c2a59bd4a26623f15cecde5adca2b88b8c8c4bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511778, "uuid": "2dbe99b4-9e5f-4752-8136-5b9227eff9e8", "comment": "Malware payload (Gafgyt)", "value": "dfc972393682630173e5d473a6bf3a950ecfad44509ac689768fb8ec4a29e931cf6b87c2b95cf655deadf65e735cad96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511778, "uuid": "eb81772c-0425-4193-9fda-629460816f73", "value": "T129B32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511778, "uuid": "d377e6c8-90db-41b6-b62c-fc611ecbb7b8", "value": "3072:b6an17WtsWhdgYJB0D6mbPbmTQOWsXAOn:Wan17WPJB0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675511778, "uuid": "08128f8d-6667-48a0-ac86-d5b0cdfbe2d2", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675511778, "uuid": "06dc3032-d01b-4913-9f1b-79405e546dc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511778, "uuid": "6272b00b-a511-429b-abe2-01a081092b00", "value": "d54e19e4dbb4ed45540b74fc3a391cc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a956ea2e-a45b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675494910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494910, "uuid": "bd9d0c60-852b-48d2-80bd-626aa7818a00", "comment": "Malware payload (Amadey)", "value": "fbb4581199f9cce736dc01aca56b1be2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494910, "uuid": "36e8b577-3677-4f27-b806-ea79b4edab66", "comment": "Malware payload (Amadey)", "value": "4138d6e7eee27648ff297db1f8dda16d920b8471da6a67a47a0aae001f47e620", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494910, "uuid": "c7658768-3271-456c-a5bf-14c5a67e56a2", "comment": "Malware payload (Amadey)", "value": "304a4f28f96531b08e2a8cab0344ca6a213042c0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494910, "uuid": "6e611821-7ca4-404f-bbfc-eb33e370b98b", "comment": "Malware payload (Amadey)", "value": "7546f8b959649afc0005159eccfa1654ff8edd473d6b1f354b04d7b2233a5ff984cc000cf4e068605186a3a00ef36901", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494910, "uuid": "a0642ce8-47ac-41ef-9af1-3859cf6f2b3c", "value": "T1C414DF233990C472C07A11704864EBB56BBEB8314670A96FBF9817AD8F303D16A36F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494910, "uuid": "d4ef4b29-7b15-40fb-a219-93ffdf8afa3d", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494910, "uuid": "17e691fd-4c5e-45f7-b9b2-01c047fc1ea4", "value": "3072:putfg4DyJ7LAuTuh1WrDa5d3ch8t5dUJbN88FPMcP81LIFb+t+2:putML3ah1OeMh8t5SPTRP8lIN+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494910, "uuid": "f9e8070c-a059-476e-b8ea-af2d53575650", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494910, "uuid": "989d73f7-8a2b-4ebe-a251-836cfb74f644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494910, "uuid": "3daa045b-ee07-4dbe-a85d-7e267e57885a", "value": "fbb4581199f9cce736dc01aca56b1be2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e18a01b-a422-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675470330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675470330, "uuid": "d1d82823-f63f-4540-a933-ad56af6ee2a9", "comment": "Malware payload (AgentTesla)", "value": "b08ab9e9f0ef2e9be2d7137a45c61c19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675470330, "uuid": "e4e3ac05-502b-49b5-a02c-3fbbbd42ab19", "comment": "Malware payload (AgentTesla)", "value": "41857a1bfb1cda7337d39a4c6bcec253fb44532179f9cb12e919608f227e3dcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675470330, "uuid": "6861a64a-88dd-47d5-afa8-a4feae08b86c", "comment": "Malware payload (AgentTesla)", "value": "242fab27bf359d76f1a2778f631a07bb32d75cb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675470330, "uuid": "53e2418b-f036-4740-9f6e-8eb7f50e9569", "comment": "Malware payload (AgentTesla)", "value": "57d3ddff5250623f2cb8bf27d69bd4ddffa2d43c6f4e1e9c795cd3352a158df1014f3028fab9f2e71e79eac4528caa44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675470330, "uuid": "c3fdaa9d-b2f0-433e-b8d7-c8fdac5de896", "value": "T1CEC4230C93BD16BFD32E81FF426FC5A0977469193283E78A5E7500F92347B866710AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675470330, "uuid": "2d32c8dd-b185-46e1-b54f-f524478e04f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675470330, "uuid": "a65142d9-df2e-4b5e-8a2b-08f71260cb7b", "value": "12288:NpYxjqGYv6GaG4YPwZrcOqQNxOUIvl7cE3UkfaP0or8z9i7+pvdCWtO:5/W3YPwJcaxKB1faP0or8zw6Rsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675470330, "uuid": "2910ae8c-3735-4037-a96a-a1e87a1c412e", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675470330, "uuid": "3d20ac9e-6138-43c5-a9a6-46b2dde87892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675470330, "uuid": "31f8f753-6c1a-432b-8fb0-f213cd01a91a", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc4d67e-a443-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675484474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675484474, "uuid": "a2124e69-6ede-4768-bf2d-e18ae97dd494", "comment": "Malware payload (PureCrypter)", "value": "ef53888e5c9c730051305234f7c34148", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DotNetInject", "colour": "#CA9755", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675484474, "uuid": "8ca1ac09-6b83-4539-9ed1-1ad542359480", "comment": "Malware payload (PureCrypter)", "value": "4245d9a02b04d5a4f368623194ae5493b0e982b007a03d6f652c09bf75ffa1c1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DotNetInject", "colour": "#CA9755", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675484474, "uuid": "f13c589e-21e2-4f01-a705-b34f77fd5ff7", "comment": "Malware payload (PureCrypter)", "value": "8ccdc44156a556b56a989aa20ccf7df771b1a0e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DotNetInject", "colour": "#CA9755", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675484474, "uuid": "380b2760-184a-4adf-bf2e-14ad9b9d8890", "comment": "Malware payload (PureCrypter)", "value": "9845cb2a092aba6910c15f3e18513f68bc40f1c0e13918275662798de7d8b72478cfc37b425b115987a8275ddcf25f85", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DotNetInject", "colour": "#CA9755", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675484474, "uuid": "e58d8598-927c-4cf5-ad4a-fceac60293a8", "value": "T11BB5290271D28F62D3491B33D4A77D240750C76A1253FBCF27E5632AAC837A275A91AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675484474, "uuid": "23c53c3f-d28f-45fc-8525-27a35489d76d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675484474, "uuid": "9ee7252d-7813-4413-92a1-bd1dfbb1acf8", "value": "24576:sL5yZZrhqkCLi2bkd+/yW23StV50C2MONQoHqI9TKTUPR/xWhDRYqC/py4N/XTYY:sL5JLi2bK+X1aQoHR/xWczDrYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675484474, "uuid": "a70d4841-3d2d-47e0-8488-bd50189a8b56", "value": 2476544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675484474, "uuid": "7c264f8e-4591-441e-9e4b-acd6943f2097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675484474, "uuid": "99688a19-6e91-4197-93a2-d18629b79405", "value": "Pgbdimp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3955b06-a46b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675501799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501799, "uuid": "c1eae9cd-b325-48a6-b83c-b0f5f0218c06", "comment": "Malware payload (Smoke Loader)", "value": "67a4b15515797075d97d278d236c71cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501799, "uuid": "87246976-5c9e-4381-98e4-c7b2cf16df7d", "comment": "Malware payload (Smoke Loader)", "value": "429c0954be1c84f51279dc1485b8c1d751230ff994193c05b4611c2a4ee1ca9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501799, "uuid": "46ec213a-da11-48f2-9541-11030948b5cf", "comment": "Malware payload (Smoke Loader)", "value": "f07237e0562e0426217a996601fdd88ef726d5c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501799, "uuid": "926c9d22-3d26-42f5-8df6-ff36019a6780", "comment": "Malware payload (Smoke Loader)", "value": "29de0261aaccb8d7372333344c9b451c79225d2980d8e1f3d345523625fbdf4f97e03c1b2e81b61e316e52dd66ba7693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501799, "uuid": "e1712149-9556-4431-8343-5c0531bd5fca", "value": "T1C014C03636C0C0B3C56B10348C60DBA56B7EF830593A8A5BB7698BAD5F306D1677734A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501799, "uuid": "66c1e7de-ad10-4f65-95b0-d0b12d71c338", "value": "907f840d18fdf01b512ca68660ff51c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501799, "uuid": "e67a1544-56dc-41f7-874e-d77b92e78895", "value": "3072:EVv9CQ65xLNUvjLnhWSO5bszUxXCV48UbNMz8KplEIcawnx3nvDuBN:EV1MLuv3nhIO7VRvjcasLuBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675501799, "uuid": "bc9a22bf-ede0-4113-a1f2-49a15ceafef2", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675501799, "uuid": "f989e077-3582-46f9-a708-2590cf3a3961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501799, "uuid": "86d6e717-90df-4d49-b702-c2be4c2f1a9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1cc62e-a486-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675513308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513308, "uuid": "21e76c8f-b23c-42f6-8396-1bac46a44616", "comment": "Malware payload (RedLineStealer)", "value": "780e7bd02e18356d7bea377503e50077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513308, "uuid": "7e330bc6-0ce8-42fa-b944-b5077c1b1600", "comment": "Malware payload (RedLineStealer)", "value": "42b5641e5885400a57499a0ce5937928b2e3843f30c86c820ef3631315a1fc6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513308, "uuid": "84de9ad4-0135-4d98-85ae-bb3544d7a2dc", "comment": "Malware payload (RedLineStealer)", "value": "a3e43ad4fbfb762a9d70ac3e6281572f9c4d210e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513308, "uuid": "22773a9c-661b-41d6-9547-353efe2a4bbb", "comment": "Malware payload (RedLineStealer)", "value": "3695bbecf4b22252b4e8e79b65a2d35ecf04c9242aa8158e44ed05b42f7f6d3beb366d5dc168f121e7b58adae763f426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513308, "uuid": "c670510c-82f7-4d8f-a2cf-3af6dc2aa188", "value": "T178B412223BC0C432C17658742934EA7927ADF830D5B4C9677B695BEEAF30AD09736316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513308, "uuid": "da0ea3cf-2bd3-4387-8d9d-720d90cc1db1", "value": "3a600fd555a59cd5911cb26c6ab55d55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513308, "uuid": "29d0edb1-1e60-4f42-a4a3-76d23eb4e4f2", "value": "12288:BFz73aK2LJU/llTC6LlbSvfITBAg9ABgIfj:BF7PnJZLlbSvfITB59egI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675513308, "uuid": "96d56809-1087-4fa9-b9fd-fe032c245300", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675513308, "uuid": "83dd0e34-b65c-47aa-a4b7-632ff810e548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513308, "uuid": "0a1c845a-0573-41e9-9cee-831a29a1b2c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684d7a82-a4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675537321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675537321, "uuid": "4aa5966b-80c2-47bd-ad59-e5f88787561e", "comment": "Malware payload (GCleaner)", "value": "4b95c47836e9a783ba28a98ac3b15831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675537321, "uuid": "8cee08dd-075e-48da-bb9b-87ab4b68861d", "comment": "Malware payload (GCleaner)", "value": "42bf70152219d91c9c5d43f9be59794590f4c8a5f3296b38e4a8c2e5ecae87d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675537321, "uuid": "c5110a64-1f00-4492-ba21-110ebc5750c9", "comment": "Malware payload (GCleaner)", "value": "0e8eeaf424a3f02d4f0c662def24d86d308b3197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675537321, "uuid": "b78d77ef-346a-4285-9b11-749a307b9450", "comment": "Malware payload (GCleaner)", "value": "8213c9f99a1987e09ee2890ec30939f292ca35c1ddbc77bd06d25e21e5fca58b9a6b9f1ad5494243568e735057c768be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675537321, "uuid": "c153673e-9fce-4678-bbf3-dde9992a9b6c", "value": "T114B5DE165DA9D4A7E1C88F70CCE35DFB1C14ECB9C4B9092791147EFB3A32E126C52A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675537321, "uuid": "a7efa098-dd67-402a-922b-6786d3082d14", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675537321, "uuid": "b352de50-6ddb-468f-a9ec-a6d5c245e7c1", "value": "49152:d3ZTb3f1nHFztIUOyUgvLpm+PMP6nIaUligNx8IeLCgv2MR:XTj1nlxIfyUgvI+PmawigNn+v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675537321, "uuid": "bf65a051-b957-4116-9b6e-5976ba6e24ca", "value": 2354835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675537321, "uuid": "eded8438-7e02-414c-8f70-13a8a200a59f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675537321, "uuid": "fa94245e-0881-4388-98e6-4add0dd65975", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467291a8-a490-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675517508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675517508, "uuid": "3058c1d9-8edf-4493-9c81-c1acfb3dfc3c", "comment": "Malware payload (RedLineStealer)", "value": "3531a184849ac145c99db50e99d26c0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675517508, "uuid": "5ab56203-a0f0-47ec-a0cd-5c34721dbd62", "comment": "Malware payload (RedLineStealer)", "value": "436a9c0665714654628cc903f1152e1e98512a036546929530259d8860e1507b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675517508, "uuid": "3bb9925e-8155-4f74-8092-f7ec7729ea66", "comment": "Malware payload (RedLineStealer)", "value": "ebe6e116e0a2fb2137a530e927530fa41fafca86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675517508, "uuid": "775a77ed-8f1e-40c3-9471-af31696c50db", "comment": "Malware payload (RedLineStealer)", "value": "385a3572009cdc330a697a294217a109fed1f2e5ebb99f9c3036dca0bd9b0b806e426d70f3ee9d17a918cc0779b5ff7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675517508, "uuid": "e5034906-0d43-41e0-8065-bd5d6f56244e", "value": "T16BD412313E91C0B0C0AB92304864D7A8EFBDA93256B95547777D1BBE1F302D0A97E61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675517508, "uuid": "94d5c73d-056f-4618-811a-01640694a653", "value": "aea30aa8311fa7a3ea56995ee020184d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675517508, "uuid": "b7cb4696-663c-41aa-8834-5eadf27e119c", "value": "6144:9bVLYR1JpsGYabPUgeTQeKyslV0q9IfHcN6CVDblIzFny0e/cp4MRa7Pa0whSayj:9bVU1rbaQisX0q9pzmZy0+va0RRao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675517508, "uuid": "d6f33523-52a8-40d8-bd0c-cdf9163c6a04", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675517508, "uuid": "0e04321f-d581-4f59-b350-bccf6d8efadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675517508, "uuid": "07e916b4-5b31-4e07-87e9-2e2a85ce3806", "value": "SecuriteInfo.com.Win32.TrojanX-gen.20899.2520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6955c8-a48d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Meterpreter)", "timestamp": 1675516234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675516234, "uuid": "07c8226b-4adf-4ba8-b58e-31f2fb174c55", "comment": "Malware payload (Meterpreter)", "value": "b43ef0b0d8343bd080e9054f81845f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675516234, "uuid": "f3b1223c-2e9e-4e04-b169-1c0ca5670b41", "comment": "Malware payload (Meterpreter)", "value": "43d6771639c41312aee1125894273afcb6bb3ff1e916df6feed86efc4e7c52ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675516234, "uuid": "a73b581d-50a3-447a-9619-8419b7de9ca4", "comment": "Malware payload (Meterpreter)", "value": "4b96811c949aa4cd0d5d6358df80b994aca21c7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675516234, "uuid": "fedb22da-0918-4dcb-9d58-238c03f011ab", "comment": "Malware payload (Meterpreter)", "value": "6226bc5c67ff20f1f1e14b94a4fe8f3ce0a3a5aaefad3c51dcf51ed02b41ead9659d3957cae2382a5b14f99489914573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675516234, "uuid": "7d32bc5a-9546-40ba-88e4-6ce6f9bddacb", "value": "T124730856F2D368F8C167C17486E26732F931BC125134AF6D87A4FB312E16E60AE5E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675516234, "uuid": "d845781f-7785-439f-9853-1e97ec50d164", "value": "46be82ecd96300ec7ce610dc0f6e3bf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675516234, "uuid": "f7b9632f-72e8-4aeb-91f2-41c0faa783bd", "value": "768:tKvHz44fLffEdN3Jqq2QA/qB4z2m77sYcA76hkJt/XEiCKPlUlWPe1t5uNC/hpHN:ovs4DfCNUmkv77lw/clUkPnihrKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675516234, "uuid": "09a1d3b8-70ee-40f6-804d-0ecf57a275e5", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675516234, "uuid": "86cd0e10-c854-4b17-87df-8fdc3c0d46f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675516234, "uuid": "9f8a7182-9899-4b93-8a7d-27bdc4ec2a61", "value": "b43ef0b0d8343bd080e9054f81845f75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65287da0-a448-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675486636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486636, "uuid": "da2e7636-4177-442b-99c1-3f39f78f3443", "comment": "Malware payload (Formbook)", "value": "beb149595ce92039e9067b46f231dc32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486636, "uuid": "1a163e60-5a13-4a98-8355-6fca23095e1d", "comment": "Malware payload (Formbook)", "value": "459aa22827ed6a13af8399cf656ba76b1f9539edb3085ff3256804e111f52c9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486636, "uuid": "79276f9b-d3e1-47f0-a354-d91114e9e956", "comment": "Malware payload (Formbook)", "value": "8c91835859dea48ce23326f83d965fcfe3d30363", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486636, "uuid": "0e9780ff-3fb1-4c90-a586-805e3445b15a", "comment": "Malware payload (Formbook)", "value": "5cf4554364a5a7159c43b11e3c8b9ea9ebfed4121eace990473a38a4253a1253ec7fbe7fd5a242673dbd1143cc17404a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486636, "uuid": "7b8b3052-0995-4988-b13e-324be97e09fd", "value": "T194058EA337B199B2F78720B20434BA885BF07503BE56E2939BB737C06785DB77294152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486636, "uuid": "bd51081e-1b88-40f1-8b84-3c7e9a83670d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486636, "uuid": "d0f81b91-6814-493d-a589-2a4a8e9976f6", "value": "12288:UhefaqG4yPaC6Fy2MxzBembh43Bqs35oXyqbYEF8iD5MAgWFA2xZK83:yeSqG4yPaC6F0xdRFmBAfeoZgWFzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675486636, "uuid": "b1177c8f-adf5-4b44-88dc-eb9642da4f8a", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675486636, "uuid": "274e6a13-6bd5-49c8-8a88-5a427dfc0ab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486636, "uuid": "541610db-1850-4977-a145-56d108169334", "value": "beb149595ce92039e9067b46f231dc32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c8c295-a4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675546095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546095, "uuid": "537a74f9-6b37-488f-868c-cb008658b728", "comment": "Malware payload (Mirai)", "value": "96899910f3bf42dde339c987083d390b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546095, "uuid": "9f071a23-7922-40da-8f87-0ff80990cf20", "comment": "Malware payload (Mirai)", "value": "4758708fc3022af5ce3ca19b3e49e4e42eaaf822eb05b2c5b9efd71c40e0ebd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546095, "uuid": "e9707a3b-e020-44ac-b22d-d4245c168b96", "comment": "Malware payload (Mirai)", "value": "263a4e9906c2f2c283c8f6dbed3aaa669317a250", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546095, "uuid": "eae958fa-c2bf-40b8-85bb-f735e33ce1a2", "comment": "Malware payload (Mirai)", "value": "c05a6063c7cb1187bdafcfcfb46e24274fde2529ced7c8d3b7c2443373a9cc42c027d8d1c770520f1ece801da20fa72b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546095, "uuid": "755e341f-ccda-4924-9d85-38cd21149844", "value": "T1DAE33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546095, "uuid": "d703a34e-9ccb-4f54-894e-c99462c37cca", "value": "3072:yJTc2PBSpat7Oabvzj4dlRsh8ZQIldtMXkkTM/9zY:yJTc6JOabvzj4dLsh8/tMXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546095, "uuid": "7b746898-3e0a-424b-a917-79e74ea314f7", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546095, "uuid": "cc980435-35d4-4344-8a81-79f51b6a639b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546095, "uuid": "15108100-741b-4b96-b5e3-64aa17d95c31", "value": "96899910f3bf42dde339c987083d390b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a20eb78-a48b-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675515340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675515340, "uuid": "188c2ab1-e920-4e04-8f8a-242a6df4166c", "comment": "Malware payload (CoinMiner)", "value": "edf7a1ae5af01d6ccc602169fc3ab2bc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675515340, "uuid": "88bef823-64d7-4bd4-8f23-a9020e24b7ac", "comment": "Malware payload (CoinMiner)", "value": "49c61da16181416659c0ff7e7aaf0938b8edb9c52aa7b0c3ec5d258d57181078", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675515340, "uuid": "ce386112-474b-4bc7-8407-52e50e59d95e", "comment": "Malware payload (CoinMiner)", "value": "680f5331f8319097f40ac2fed3ecbe2395241013", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675515340, "uuid": "f6d95daa-b0bf-4b52-8cb4-2882dcfafd5e", "comment": "Malware payload (CoinMiner)", "value": "ccc19186669eb092cb544434a53dbd6893c1eb285d8cc6c9451661b84ce8a9f877487720de336aa7c424736ae17ddec8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675515340, "uuid": "1d13cae5-09ad-4fad-bce8-c4ead2b82bc5", "value": "T16AF5BF17AAA984A4D069EC37C486427107B17D74A7B287CB32BEBD5A3F721C19C3B315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675515340, "uuid": "2c6d9328-9ead-469b-b115-e720285dca25", "value": "b5c9ebd6097aefe6bdb11aad04cffe12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675515340, "uuid": "830901ad-45d0-44cc-8e78-301966665917", "value": "49152:hOnjDmNlqKeOnjDmNlqO/UzbPZpXXjOnjDmNlq/z9wj3B0IUgLtobesGwtHJBEdS:AMvYMB0I5IG+H80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675515340, "uuid": "c67ec93c-16da-4d9f-9b40-9dd4968b058a", "value": 3568416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675515340, "uuid": "dd01e68d-c351-4987-8771-13c0cb4f336b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675515340, "uuid": "af7493bb-81ef-4bef-89cc-cb5d922e6a73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2a00cc-a451-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675490457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675490457, "uuid": "6cec1b63-5fd2-49ef-a2a0-6fbaeb4d8587", "comment": "Malware payload (GCleaner)", "value": "15d87c92d8cfb1a95203f87820abf810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675490457, "uuid": "2058090c-a9a1-459d-8db7-f25844a5b998", "comment": "Malware payload (GCleaner)", "value": "4c5eb5f48244c08eec34031af73fab81bc2193c6d48266e2212c67023ff188ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675490457, "uuid": "661818a5-317a-4961-93fc-912304bb6da4", "comment": "Malware payload (GCleaner)", "value": "1808e12c1d0662bb605a3c252b4443dc3751da47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675490457, "uuid": "d4f36184-7afc-4d5d-a08f-a67b6c50e239", "comment": "Malware payload (GCleaner)", "value": "68cef9fd54d233e1edd9b1071d38335a6706d2f1d14a9497b184394404d7e43af9abfd29236731f3a94f137e29983ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675490457, "uuid": "4b9d0aae-fd72-4048-892d-a9f379c82df5", "value": "T137B5DF165CA8E067E0C88FB1CDF36EFB4C15ECB9D0B5091791043EFB7A36A422D56629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675490457, "uuid": "6b8353ee-3e74-4061-8229-a25d88565a09", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675490457, "uuid": "6d4d30d3-bcea-49f8-907b-1012f305557f", "value": "49152:d3ZVyBx29G9c1PverTT7lYFSjvRSbJDiO74R+aiT4EdLCgv2MR:XVyBx2oGWRYFSjvMbV4gac4Ehv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675490457, "uuid": "cc034fd1-8a21-43ec-923c-fd073a3911dc", "value": 2296408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675490457, "uuid": "c2dc0dd6-1d7a-4a39-bcfd-8aa36ac5f750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675490457, "uuid": "a74fdf3b-b849-4e73-8c48-3ba2d7973351", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69dbcdce-a457-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675493086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675493086, "uuid": "2ebf05e0-df01-4ddf-93c3-4f9211aadbff", "comment": "Malware payload (RedLineStealer)", "value": "ba27548e7ad6a3913220fd0e9a5e1b43", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "Pw-4399", "colour": "#0DB56D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675493086, "uuid": "d5214582-814a-400e-b4d0-2f79f5bcd2a7", "comment": "Malware payload (RedLineStealer)", "value": "4c667db3261f175444f903823b2a14a18ed9ff705dac18c4c67b3c5bd7a406d0", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "Pw-4399", "colour": "#0DB56D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675493086, "uuid": "89b49793-74b0-48b5-b70e-9e301aa5e7f4", "comment": "Malware payload (RedLineStealer)", "value": "678953935d762f03c8c3f5727d220f0a00c7fe28", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "Pw-4399", "colour": "#0DB56D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675493086, "uuid": "538be396-83cc-4285-80f5-181ff21e1937", "comment": "Malware payload (RedLineStealer)", "value": "3b8844f619bd755e844ae20a3982eb5e4afb3734fa15abdc3cd09b1c46b3c143197228c5b269e20ca89f9e70f2f81519", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "Pw-4399", "colour": "#0DB56D", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675493086, "uuid": "0344d379-c8d7-4474-864a-fc6c9dc79fab", "value": "T1F0D633E460161BE9E4F48D145189B752DE44B42E899803FE05CB7D7A8B6CF4CC6F0EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675493086, "uuid": "06ef5120-9a23-4977-a759-698722d1e724", "value": "393216:tgftJ21FjFO4tzTd2stqMZikzO4OjZsqxgjs6//UG:iD2DhdT4MOjZsqWj1/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675493086, "uuid": "d82aada8-c825-4fb2-ad61-747992bfa2ff", "value": 13613780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675493086, "uuid": "f81e6a3c-c5d3-4671-9717-83f839abe10f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675493086, "uuid": "6640b46e-6497-455b-8156-ad1bd8eda274", "value": "HeInstaller.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447f85b0-a451-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675490446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675490446, "uuid": "c81a26fd-c574-4203-a8fc-dc8148b1f2aa", "comment": "Malware payload (njrat)", "value": "b0c82fbc0c4cbf7def43d2d99e0b9294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675490446, "uuid": "1199665f-b751-48b1-8273-b6b724f4a6d0", "comment": "Malware payload (njrat)", "value": "4c96243942de1d3b882b58d879281b844a244221079767971549035ff18472ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675490446, "uuid": "d929bde0-ab56-4b37-bb39-f04f7a8f29b3", "comment": "Malware payload (njrat)", "value": "3419401cffe730f14a58f8a6143a65cebd58cb5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675490446, "uuid": "b78d76ca-a80a-450b-a702-094bbcb80936", "comment": "Malware payload (njrat)", "value": "e89a6e5ce9975c7dfdd4e416e834ef40d33c9dffb21406315c9933633f028f033a07039517708ca4490db89655785f95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675490446, "uuid": "037fe98e-807c-4cda-a99d-6a366bfaa5df", "value": "T169B23A4E3FA98856C4BC17748AB5961043B491870423EE2FCCC564DBAFB3AD91D4CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675490446, "uuid": "8a08a0f6-4ab9-456c-878c-f5d0082b565d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675490446, "uuid": "156a7f09-2fa0-4c22-a0d8-45173d312b0a", "value": "384:5c6CqbFYh3odrVCGiHssDB4b6i6pgpEupNXRmRvR6JZlbw8hqIusZzZ6d:qIU0twFRpcnu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675490446, "uuid": "7f81a6ef-1613-4b4b-b70a-bbdff5d50f7d", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675490446, "uuid": "70330722-23b4-4f69-a560-cbd11cf9aabf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675490446, "uuid": "53a42124-e7ae-4b16-8fa2-5eabcd3bcc80", "value": "b0c82fbc0c4cbf7def43d2d99e0b9294.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c570dc-a4b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675533096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533096, "uuid": "585618cb-667e-4377-971d-b43d93c57b44", "comment": "Malware payload (CoinMiner)", "value": "871ebf3f33479e03433fa1f0640f0ead", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533096, "uuid": "dfa825de-d9ca-4458-a0c8-b5bd0a71858c", "comment": "Malware payload (CoinMiner)", "value": "4d54865fb89f816189b0d965990b91612adcd7b82906e01f08a33588efc063cb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533096, "uuid": "83d4e90d-639d-45d0-b0d3-a14232419f23", "comment": "Malware payload (CoinMiner)", "value": "cdd334fe69b745d48d9d3497d28aa775ac4f9044", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533096, "uuid": "a26de293-f7aa-48aa-960a-c35ade56ddde", "comment": "Malware payload (CoinMiner)", "value": "0c2427bb49b9a574fbc93532f941a35a85bb53bf057021dfa96c304a2e441e797750d38afc6e5d68a708e3581a4af23d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533096, "uuid": "fc52407c-05ce-4b7d-a20c-bbfe0b1431a7", "value": "T146F5BF23AA9D04A4C065ED36C486422257B17D7467B387CB32BEBD5A3FB22C19D3B315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533096, "uuid": "40bbc567-a26e-4172-b011-ad08b9612925", "value": "dc6619df025739ad47a15e80923800e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533096, "uuid": "9de9b76b-3362-403d-8567-c88005c763ac", "value": "49152:yOnjDmNlqKWOnjDmNlqO/UzbPZRXZrOnjDmNlq/z9L8YM8UIM7b4AEG66O3f9:/MveHM8UjbR66OF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675533096, "uuid": "b19248bc-cb2a-4b05-993a-2e4bb8fddf1c", "value": 3518752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675533096, "uuid": "34749741-01f7-4dac-8124-8a1fdb6cdb19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533096, "uuid": "f256e0c6-323e-46dd-8ad9-54a28509eefa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2b5ffe-a4cf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675544658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675544658, "uuid": "9528daab-50fe-4c02-b3ec-c26f594d0e58", "comment": "Malware payload", "value": "f441c8e5b5846fb5acd74ea43aa097b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675544658, "uuid": "d3a0d1b5-c0df-4ebe-9f21-c85a814670bb", "comment": "Malware payload", "value": "4f5ccf2e8b5ea936f4b44b2f7b3bdff29efb28d7bc0e681dca8e2fa10f424fb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675544658, "uuid": "e189261b-ee05-498e-8d5e-60c8b46ed0a4", "comment": "Malware payload", "value": "77f4e4478b76d5e13166765704af41aa512f477d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675544658, "uuid": "b419c501-b7ee-4526-a20a-1808f41b3d4d", "comment": "Malware payload", "value": "9e7a83a02d8830d61dd0c625c25fe460a6c79c538d1e8481027ddc4361af8626fe6da693808ed1cb930d9e4d416f26ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675544658, "uuid": "8b043fa8-032e-494e-8e86-2e5542a69a0e", "value": "T1D314D03635D0C072C76624309865DFB26B7EB83156B68D4BBBA41BAE5F303C1923B257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675544658, "uuid": "3289d361-c7bb-4403-a8d3-2471c29bc7d1", "value": "847f96cdadc895b3547edbb7a505a62a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675544658, "uuid": "a8ab9458-4dfe-46f1-a3f5-7ad660ea1f95", "value": "3072:JpKCO9q/LvL3Z3CSWYRLz5fuJ2c1lo9Z1JNFViO/OLrCUd:Jp8SLLJSS9IloPrNFrguU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675544658, "uuid": "900ba24c-29e2-4c57-abe8-270a485978ce", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675544658, "uuid": "8e8cf302-fce4-4799-995d-25bcd5b9a272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675544658, "uuid": "72e2b201-5657-4a46-873d-d6e065070ca6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cb3c97-a474-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675505746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505746, "uuid": "310bcc7a-5fda-456d-8037-ab4789cc521d", "comment": "Malware payload (GCleaner)", "value": "4bda23f149059aa3bb2b250205744cfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505746, "uuid": "69c8c20a-3970-4f0a-85f5-4aa3e73895b0", "comment": "Malware payload (GCleaner)", "value": "505f3cc8f57d00bdcc6c1cfe0a95c189669f5bff4531af079b4a959beb394502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505746, "uuid": "ba546358-3db4-4992-a549-5dce3e3929cb", "comment": "Malware payload (GCleaner)", "value": "220ff89b1210e4caf91058b0ccd6d6eb05457fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505746, "uuid": "3bc7ebd8-e936-45a0-9b2b-26dd0b653088", "comment": "Malware payload (GCleaner)", "value": "0487b98376e78ff05120d3f265ec94bb2a599185f3f689525c858238f138a3080fdd49f5ed5648c346a5dfd605329342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505746, "uuid": "935d43f0-4e40-4da9-9d17-5e6e60248a05", "value": "T1ADB5EF161CA8E16BE0C98FB1C9E35DFB0C15EC79C1B91813D1097EFB3A32E522D46669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505746, "uuid": "e7ee785a-34b3-480f-9483-2bcb50246bcd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505746, "uuid": "a84d3195-461a-4b49-8e59-6e7fbabf99dd", "value": "49152:d3ZE42dquWj9RowjAdRQHPPlq8bOE5wZcNqb1n5Un9dJ8wLCgv2MR:XN17haQHPtX6E5EcNq5nunfKYv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675505746, "uuid": "46dced6c-f08c-45a5-abd6-86d7317234b3", "value": 2338329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675505746, "uuid": "b485ef22-7bc8-4b1c-a17b-0ae6fac4c6b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505746, "uuid": "9522dab8-47f3-4f4e-9724-407732972ec6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7aceb2-a4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675531020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531020, "uuid": "a9afa63d-49ef-42f6-8a36-7360f6244fff", "comment": "Malware payload (RedLineStealer)", "value": "21b76220a37a0bb84324d80d99f55425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531020, "uuid": "c1bb305f-3124-4407-8620-348709b68ac9", "comment": "Malware payload (RedLineStealer)", "value": "50625ef66704390804940dfe1e9b09003723f99bd109ff262757de3aa1b82cc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531020, "uuid": "36fa4cf6-f92c-4d99-bc5b-6bf9356b8b7b", "comment": "Malware payload (RedLineStealer)", "value": "973b7b806ef9f7f1b34e0546e9ffa25a847fbfae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531020, "uuid": "daf51654-5668-4d79-a33e-677a2c10110e", "comment": "Malware payload (RedLineStealer)", "value": "2c2e9181aad5602bfd9626558ca27d8f3c43eddafbe34fda5e37915e388c95a7da67874bc0646abf956d89a48c406de4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531020, "uuid": "46252519-7c95-47a7-b664-969c85f69393", "value": "T14534D047ABE98072D8F51B705CF603C70B36BCA29D74932B2745A95E5CB3684993233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531020, "uuid": "a9dc4ed8-1a67-452d-b033-573f45e0c511", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531020, "uuid": "968da4ab-6757-4453-98c2-e56fae2321bd", "value": "3072:wOhX0N7+f1X5GWp1icKAArDZz4N9GhbkrNEk1pFz7ad0oCofpzFY1qOLRXYM7i:1hEN7+rp0yN90QEqBJ2fpzFY1fLPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675531020, "uuid": "abd7aae1-0c33-4085-8bed-ae3dc325f725", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675531020, "uuid": "e4e99d66-9d11-47eb-b648-c4be7f5246fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531020, "uuid": "0ec238ea-c04f-4deb-9e07-d61561d54b78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a303f69c-a46e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675503060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675503060, "uuid": "1d534b39-b97d-4680-94d9-47210dc2cb49", "comment": "Malware payload (RedLineStealer)", "value": "48827327bd03d00ef2232c5762febc4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675503060, "uuid": "d82404ba-f71c-4a31-a7ba-a46ff1594bf2", "comment": "Malware payload (RedLineStealer)", "value": "52026db8d4b307fe14a4f3b1936ba8f450644aa1b12fb607e991c34a1779a3a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675503060, "uuid": "c9b44b91-68a3-4883-b91c-5f7f43fff5ba", "comment": "Malware payload (RedLineStealer)", "value": "2416f2392e14f3015b808f5cca6260ad77464b27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675503060, "uuid": "0527eae0-f3fb-44fb-a6f1-3c8f41bd1033", "comment": "Malware payload (RedLineStealer)", "value": "626caeaf98daf785c1c3a9303b351862c78c0ede684fae9e6820a9fcacf9204f43cdefaa2b661ba1832c0954e602c5ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675503060, "uuid": "0ce3139b-c953-4d4a-95a1-f6599c463cd2", "value": "T1BF54F13336A0C471C2B750701C24DBA4EFFEA831A5B9864B77651B7D5F706D0AA2738A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675503060, "uuid": "5c61c46d-ace9-4ec4-8c4e-aeaf3fb24e7e", "value": "aea30aa8311fa7a3ea56995ee020184d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675503060, "uuid": "2540089a-cacb-4d9b-bcc5-81943bac837a", "value": "6144:0baL0Mqb++dlhe5/O9KR0WIUqxlud2SmXhesDeCSEU:0bahqb++dlhe5/O9KRpIUqv3SCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675503060, "uuid": "0e29d604-d78c-4c6c-bcf9-e83b297e6a81", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675503060, "uuid": "9b032382-729c-4c34-a06f-a732cfb1125c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675503060, "uuid": "871bd297-599e-4270-90b1-31919f79e0f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402abc15-a474-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675505471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505471, "uuid": "d35817b8-7dc0-4279-bca6-5a1ea5e437eb", "comment": "Malware payload", "value": "c8374c9984732b5b819e4d38e329a606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505471, "uuid": "e87f5fa8-0939-4a69-a266-2821e62370ff", "comment": "Malware payload", "value": "54c2907076a03da48ade30dd4490b12e5743d98e4a723cfb8d0ba3cea3b9935c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505471, "uuid": "361dc90f-f65a-44ed-baa4-f0119889aef7", "comment": "Malware payload", "value": "8a064b42306b7fc8b7969f2af44f6e2b6bb2ae8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505471, "uuid": "ab470a04-c615-4636-8c18-d6e18e084cf8", "comment": "Malware payload", "value": "40016ad7966308221f19745ce6ec18fc1d9a111119f380158cccd670d415851de8123c7c35f246b5d36fecba2e9e2440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505471, "uuid": "88abef3b-ec22-432e-a825-f90a06ef01bc", "value": "T175763320FCE6CAFBCA674D3295AA3DA5D379FA0A2F0C42971789423D7775914B204327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505471, "uuid": "5e609b41-62e3-4889-b98b-50577c6d7b8f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505471, "uuid": "e16728e7-f16f-4c71-9a76-2f6a3709cda9", "value": "196608:91OKbX2pnx+foJPfe3Jz+l7Mwh3WBSnNWmKQRQ+:3OKbGpx+fo4UVM8WgxKQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675505471, "uuid": "5e481386-91d2-43ef-91e7-b392bed1a57f", "value": 7579490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675505471, "uuid": "c29a26c2-f0c5-4cda-a4c7-0953cff06d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505471, "uuid": "2b0f0401-33c3-496d-91d3-1d33658be77f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57934241-a446-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675485754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485754, "uuid": "d809401e-6a2b-45a4-affd-ba2f834c3a3c", "comment": "Malware payload (Rhadamanthys)", "value": "6ded629527d50c6f9cebf217e908fb52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485754, "uuid": "975373c4-0916-4d32-a633-1c3a6089193a", "comment": "Malware payload (Rhadamanthys)", "value": "551694af7b6ae55a53a09344bc3e9ec29ede81bfd7c82e330d6f509ca83a87c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485754, "uuid": "cd50091e-41d7-4f6e-8b70-d13daee6fd12", "comment": "Malware payload (Rhadamanthys)", "value": "93dbd74d01e98e8ad65beff65ee6c1d5c5912da7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485754, "uuid": "a7af37c1-82ef-43d2-b539-38eb6ca9b29f", "comment": "Malware payload (Rhadamanthys)", "value": "54cc1bff465f4863664e87415cb1c8d813fd7feebe59059e8c4e8e5c26eca8420cc1ffbead3bebb93a5953371a9917a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485754, "uuid": "fe20f2e2-fa73-4685-a7e4-8e277b180dbe", "value": "T15814F2B9207280B9DED7017B5D5846A26EF93E310764AB8F6F2CE0467EE01FD6029573", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485754, "uuid": "e4538a49-a22b-4a48-a687-b0721b87a910", "value": "e382229cbe1cfe84b080e0a3eda013fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485754, "uuid": "70b64304-0f41-4c88-94ba-e8a00615ba4d", "value": "6144:UC1N40Fnr0602TzhldWqIk6jKSxPMkPOR0:UC1VFng60OCHNMNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675485754, "uuid": "a433038d-57d3-4dd3-8046-451fde4e4015", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675485754, "uuid": "6f3dd472-d23e-4612-9256-ff409c4df9bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485754, "uuid": "3ce8c05e-ee67-4b76-9d06-3f44939d0d04", "value": "6ded629527d50c6f9cebf217e908fb52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1ad67c-a498-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675521111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521111, "uuid": "9469cb54-14c2-4b32-8cc6-9a22588383f7", "comment": "Malware payload (GCleaner)", "value": "70b7f63ea53ba83ed736eb1a2af69128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521111, "uuid": "93cb9be6-77c7-48cb-8b81-ae452800ad82", "comment": "Malware payload (GCleaner)", "value": "589cb32d84ccb9433a1467998dae8185c43b34c44fa5ff301661b4ecea008745", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521111, "uuid": "98fde3bd-c2c5-4a32-8983-e3622da8da2a", "comment": "Malware payload (GCleaner)", "value": "782e7e2375bdc64f1e22eaac421468c368f8070e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521111, "uuid": "2069cee4-62f3-49c0-990a-8e6434314e04", "comment": "Malware payload (GCleaner)", "value": "d203091965a5591a5879332d23b1826eb158166c50db4eaa9de3f77676413f029491cdf12e717cd30217451c40948bd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521111, "uuid": "11e2d26b-fd0e-4850-a92b-6a522aeea13a", "value": "T1D7B5DF121C98E0A7E1C84FB0CCE35DFB5C51DDB9C0B5192791193EFB3A36E422D8A669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521111, "uuid": "093e2948-1027-4d86-91c2-3d8a60170e44", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521111, "uuid": "65ed482c-bf64-49aa-8b73-4672196c4933", "value": "49152:d3ZBD/GwawMj+8tQFuHTUuVH+ALCgv2MR:XJLawGLQaTUut+ov2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675521111, "uuid": "7362fc92-dfa0-4e2d-919f-651a4c741cb3", "value": 2329273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675521111, "uuid": "0016e57c-0570-4c2d-aa27-62589d3843ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521111, "uuid": "244a1d01-67d2-4c80-b358-6d1b0011c30d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cfad2f-a49c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675522869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522869, "uuid": "f825139d-8afc-4303-83a1-d43a9f33c8ff", "comment": "Malware payload (GCleaner)", "value": "f97fdba97ade5b0ab6031d06d652dad9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522869, "uuid": "ee290935-ba5e-445f-9eb8-510adfacf2ce", "comment": "Malware payload (GCleaner)", "value": "5af681b622593497340e5b0fe347edd077c72181ebcf28d66b51c3cf435a18af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522869, "uuid": "82856e44-6e4f-4a3f-b04a-7be99aa6b781", "comment": "Malware payload (GCleaner)", "value": "a6ebea7e6a5a59cc6a3bfc98183e19e742cc1e79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522869, "uuid": "a4d6c630-e6e1-42d0-a90d-c12d59fc0ee8", "comment": "Malware payload (GCleaner)", "value": "6eb9f0997caaee1e3c70edb64adcc50d7dd115bf9216ea37fca9befd01188657149820b836be6b231a056c50d3757af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522869, "uuid": "98d99cef-66b7-4331-bff2-6083e286722f", "value": "T1B7B5DF165D98E167E0D88FB1CCF36EFB5C51ED78C0B8481791047EFB3A72A522C86629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522869, "uuid": "e9b2d7b0-46cd-455c-a0be-9b9f8057c459", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522869, "uuid": "74509ea0-86c7-4a9f-89eb-dc36a65a8aed", "value": "49152:d3ZlbfCxtakTvzl8gIyORqn7FzHPJLCgv2MR:XlbfCzaavzlNIyOo7FzNv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675522869, "uuid": "eacb094b-7ff5-4b59-9e22-4959dd8b72b8", "value": 2343181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675522869, "uuid": "73d10f22-4d0d-4ef6-9e2e-52a996c7562d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522869, "uuid": "4b126884-2016-459c-b57b-e9e49bb3281f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319985d4-a490-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675517473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675517473, "uuid": "8ebf7866-21b7-4e3d-9f0c-1cb38e31b68f", "comment": "Malware payload (GCleaner)", "value": "e0dc6645ee951de8d609d30cbd1139ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675517473, "uuid": "29dabd91-9d8d-491a-b526-abe7fc9e81b7", "comment": "Malware payload (GCleaner)", "value": "5c9e24bae5ec995c1147f6ec3709f67354e4e198053e3c1e4f87b2e032669d36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675517473, "uuid": "511d386a-5f88-4924-a01f-49ece05984a8", "comment": "Malware payload (GCleaner)", "value": "7ee0b24327e8979a2a9d14d4223c74c09343f4da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675517473, "uuid": "49594ed6-6f2f-4c5c-95dd-499c7c438563", "comment": "Malware payload (GCleaner)", "value": "c03daf39dc923b2d5fa9cd61a04a720a0aa30348c12a67a0b8f59babec80181e52c4d5a2a565afed5d9789f3a9bdf9fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675517473, "uuid": "f9b30f4d-eb05-423b-8aba-1eb9d3d459dd", "value": "T1A2B5EF125C99E06BE0C84FB0DCF76EFB5C11EC79C0B9491791043EFB3A32A626C56669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675517473, "uuid": "4c21d6aa-3559-461d-b3f5-b0d54c0b6160", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675517473, "uuid": "804dc9cd-5253-49b2-829a-08dd0f3cc7f8", "value": "49152:d3Z19cpTAdVt+WPMv/0awTh7szRKHw7y+Z4LCgv2MR:X194IV12/uZszOw7jav2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675517473, "uuid": "3509d18c-4876-4d32-b46f-5ca45b5c4770", "value": 2334531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675517473, "uuid": "c22ae7c1-e63b-4b80-a741-d23e90284b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675517473, "uuid": "c22d8ca6-7fe5-48c8-b917-b6e29bd192c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6d9184-a4bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675536387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536387, "uuid": "b2492a3c-4232-4ff4-b853-9bbb8f37089f", "comment": "Malware payload (Smoke Loader)", "value": "5c311f42fe8e0d0f746791d0868e73f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536387, "uuid": "9674c8b2-252f-4d3c-9b24-a1d73e32d29f", "comment": "Malware payload (Smoke Loader)", "value": "5d4414c07b3b8dd7dc4067d16e5fd0f7f643cee53ff01fe3d1d72802e484ce3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536387, "uuid": "3e2bfe70-26fb-4917-b9ea-16fb28de98e1", "comment": "Malware payload (Smoke Loader)", "value": "5887c9da90622e07eefb849568f555cb3f91d4f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536387, "uuid": "b0b7c296-7ab4-4b60-8313-e6e930463215", "comment": "Malware payload (Smoke Loader)", "value": "3bc7548ab80adc9d8c0a80a6bf1e825b35bf3d2248e0e29627d6cb452208902489391609c12962c7ba8d1be386b15853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536387, "uuid": "11fa14b3-7b90-41d6-8994-a5cb14047e44", "value": "T1A314D0333AC0C07EC5AB61304C58EBA06B7EB931457599577BE80BAE5F702E16A76307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536387, "uuid": "d8cfde17-3b19-4cbd-b021-fb43a55995fe", "value": "158a612a52d4365bdc88fe279a20e1a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536387, "uuid": "b74dd679-3ad0-4c6f-bf36-aecd6d2721ac", "value": "3072:PFdExGjscLhK+/LNWQO05G5EPXQ7CndGMc2wKiMkuc27VE:PFPjLhBTNKPyQgGMzht2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675536387, "uuid": "07f55dd6-bba8-4ed9-bf82-85674405b65f", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675536387, "uuid": "b9d6c53b-c08c-47b2-87ac-23b3e39eb434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536387, "uuid": "3ff36a64-e1d8-4ace-afbb-a0a4666251c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3694e5-a423-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675470677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675470677, "uuid": "b517eea4-2a16-48a5-9479-4a16bf8af37e", "comment": "Malware payload (GCleaner)", "value": "f62f9de198fcea80088ea0bb0ba18dbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675470677, "uuid": "3d1f1405-d3b5-4bcf-8f32-25e798cfdea4", "comment": "Malware payload (GCleaner)", "value": "5dc93e3ae2701521d35d06ed0a667c9fecba843075860c458941dccca2611114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675470677, "uuid": "3e93874a-a4a9-4e79-9e8b-b92dba3df67a", "comment": "Malware payload (GCleaner)", "value": "b38d83cbc182505e07cd907d577b2cc1677dea3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675470677, "uuid": "a0060c83-c1ac-43e5-8301-07a23c7220cb", "comment": "Malware payload (GCleaner)", "value": "18a05b0d75b95df66b5bb08827ab9bc853ac2d86f33427e1212ca350fa8676ff9144fbee5618360f356953ae21e916cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675470677, "uuid": "d9ba7c99-98b0-49d6-8e8b-4537b971c6c2", "value": "T14C95333AE3E295B6C506C7F07A7D6A243BEA27193610412A31CCB35D3FB3254641F66E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675470677, "uuid": "5c9deada-df06-4bc8-9a87-7a7c6947294e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675470677, "uuid": "cd1369d6-1700-4348-9e4d-c5eaddfe07d8", "value": "49152:ygDtGiRIOZpjSIb6aOgbDUDlhxX7iKcQ8mFLCgv2MR:TDMtgGaOgbD+KQ8m5v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675470677, "uuid": "565eb021-530b-4872-8ee5-3c1db9753ec0", "value": 2027014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675470677, "uuid": "e3f2d4f0-cca7-428a-993a-24d9d26371a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675470677, "uuid": "a4ddb04b-b76d-4035-ae59-9ebe1ae891c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ef8b5e-a499-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675521619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521619, "uuid": "70c49172-8f4f-4e02-bdb3-e8e6a2b62822", "comment": "Malware payload (RedLineStealer)", "value": "a1111c3448077ed7a398c3fb0b939ab1", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521619, "uuid": "f7dedb68-a100-4bde-ad65-5645008ce506", "comment": "Malware payload (RedLineStealer)", "value": "5e03c1508f5b1447c879f22a20234db719e58830fd71e1d90802130d00809937", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521619, "uuid": "c3e73fdd-d5e6-4367-899a-6e3f630e76e2", "comment": "Malware payload (RedLineStealer)", "value": "a28fc21feee86ea36d0292e28d3d661cd67185be", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521619, "uuid": "c56dec58-7d44-4eae-b838-63dd0de9b34f", "comment": "Malware payload (RedLineStealer)", "value": "f0b06045d023106b80233fb4fa8e9de7f9ad2608229f78b7f86a1b39b430b9af1095e27fd58654f3c37f32df719ce9a4", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521619, "uuid": "c6b3984e-39fe-425e-a7ec-8ae4dab08231", "value": "T117E4BD267B5D87EF04D2E5009A63E94D3A617E7F895DB6FAF2D35FCB4288810A843530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521619, "uuid": "e01224b6-7051-422e-865e-fdda77d1a9a0", "value": "12288:b9HnOowInWpwUJKzYclLIBHJI/GkWKvSQXspjJBB:bJOtIWp34lc6GkWKv6pj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675521619, "uuid": "ccd9eb74-96ca-4f4e-b338-e8a7dd51956b", "value": 672948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675521619, "uuid": "ae0267ef-e09e-4c5c-90a1-1d9b0c1f8419", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521619, "uuid": "2aa024dc-2374-43d6-85f5-01f6a2d9823b", "value": "EkzoCheat.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc25e36-a430-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675476181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476181, "uuid": "c0c37aa9-5eac-42c5-9af0-83ad5baf58a3", "comment": "Malware payload (Amadey)", "value": "50275d9acfc966ba5795701d129ffa4e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476181, "uuid": "239df08a-dfc3-478b-850f-18df50e39ba1", "comment": "Malware payload (Amadey)", "value": "5eb3337ef3f2797b333eface2efa397bc2d2f04fabfdd5abb151f259dae1bcc2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476181, "uuid": "b77b0d46-2d9f-4b09-9a61-3e1e6611d165", "comment": "Malware payload (Amadey)", "value": "232f8238a59436f3342eda7eb474078e853ecfc6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476181, "uuid": "2b6bee4c-938d-4244-a0fa-519cd89ca422", "comment": "Malware payload (Amadey)", "value": "6edab7df17929c1d35ee4fa2b32c302984015202d8c8c296acf2be543858fe6fec48dd4f27f3dd9682012ce26facf2f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476181, "uuid": "78add9c4-4fc4-4343-b45e-09a793f41741", "value": "T14714DF2335C0C0B2C57A1C345C25DAA96B7EB8304AB5991BB7B4CBBD5F316D0263B35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476181, "uuid": "79c74518-306a-44ea-a984-0f737eef7548", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476181, "uuid": "a5ff4a1a-073f-484e-92e0-00d0e1b46834", "value": "3072:1lk60cFXycLWNQ9RUWs55iG1u9u+8GAC9vfsJQCBJAEUSgXiT0:1lacL8Q/UiUu9uDfJQCBiDlyT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675476181, "uuid": "10d8f9a0-d34c-4dbe-9133-df3ee5d53ef1", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675476181, "uuid": "db8f6ec5-0d1f-4f0d-ac0e-2af8cff6b254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476181, "uuid": "550a5373-7844-48b8-a112-55a431a1e669", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ac22b2-a4ca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675542635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542635, "uuid": "0287fef6-8c31-4f14-8da1-6dced54ef216", "comment": "Malware payload", "value": "98d4a20ef57bea35f79696cee8bbf940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542635, "uuid": "4fc89572-ec99-4176-b876-2c85a4fa1063", "comment": "Malware payload", "value": "5f906f8444adeff48ec291868b78331329f58673fe7f606793afef410a2198f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542635, "uuid": "aa1a2c98-e66a-47af-b627-fb4f286a4a43", "comment": "Malware payload", "value": "29856a8a2ed8a4b8dd8b784a7fc187de4a658430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542635, "uuid": "11f14854-b36d-4463-9b1b-7076187dde24", "comment": "Malware payload", "value": "c3c12be3cf3ad4cdaddc1ab818db6ba6a05c4902f583f61d837fd4769e99ea903ad3e9c93356fc922edc611d76d5b58e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542635, "uuid": "4cb308ab-d830-4c1f-9953-c314ebacb6f9", "value": "T133C53343870B5E5ECD7D9FB404E43DA4932A448F503D4ACD5AAC74860BBE6B4F92CA93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542635, "uuid": "7375cd92-eb88-4c8d-be1c-7f9279473657", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542635, "uuid": "94480d5e-7ae3-484c-90de-ca660ba3c321", "value": "49152:S95jZoJy9FC3+ZTRAgKL2+ysngx/Zhax2tK/zPfg6Ub/v6H/:i53hTR9i2ggx/e9rfg6Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675542635, "uuid": "1b9eaeec-64e2-4784-a0ef-a1a7cdf511dd", "value": 2537984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675542635, "uuid": "26a09e3d-6300-4ffc-b41b-70da757294e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542635, "uuid": "49f8ac84-6ad4-4940-ac20-bce8feeb4fcc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fc82c5-a4e4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675553477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553477, "uuid": "8777407c-a918-464d-8a8b-a028c2755172", "comment": "Malware payload", "value": "84bd953c8da982e2d1d0b4cf3d73f2b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553477, "uuid": "cd89c5d9-135e-46de-8674-495814904eb2", "comment": "Malware payload", "value": "627b9c97c0737144482faf3622c06164ef1f4a199d7967e528ff89de1822da06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553477, "uuid": "8b1656d9-e244-4ed4-ae4a-f7b1d5d5681e", "comment": "Malware payload", "value": "6546a0c780cbefe872667005983b451b48ea8965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553477, "uuid": "20ada7d0-c3d1-4f27-aace-ed68ffcd7e46", "comment": "Malware payload", "value": "cc4ef8ab8f87bba80d7af22ec13b26ac15d86732059aa1d93e577b8ead56e031412bbe6aec37d010b2e10059233c26de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553477, "uuid": "f08e2896-7625-4ecd-ab90-318f747cdc6a", "value": "T1E214C0323A90C073C5AA64314C64DAA57BBEF53056788D5BB7A807BE4F302C1A77635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553477, "uuid": "f5214bcb-5f81-4de2-a5af-45b586f39e35", "value": "9d027e1822da283963b2da86a5b0354e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553477, "uuid": "0939623d-27d4-4d27-87aa-8169ec2c0c4a", "value": "3072:AMnO5McAhtavGpLXuyWnE5GMwN1Ecnil+87K0BdChKejCDQrK:AMnJNhM+pLeyJwfXnio8u0zxeCQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675553477, "uuid": "5167bec1-a681-446f-9ca9-beb0862aed12", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675553477, "uuid": "a1931512-9fcc-43c1-852c-fcebc97f0272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553477, "uuid": "649427b2-b009-4a9d-8806-7d743be8c02d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a605c2f-a443-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675484470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675484470, "uuid": "62883609-76d2-4ba1-bc8c-e914f1a8c090", "comment": "Malware payload (Vidar)", "value": "942263313e05915cb53cfdb38d5c32b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675484470, "uuid": "5d7a385e-a099-40ef-be0d-6ae46a2b4576", "comment": "Malware payload (Vidar)", "value": "62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675484470, "uuid": "480acc04-d8eb-49e6-81ab-acfb1642b980", "comment": "Malware payload (Vidar)", "value": "137221430dc73e5e1fc6d69ff1f137c4f0fb7171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675484470, "uuid": "79993e80-0f48-41b2-83ef-29327f8ce66a", "comment": "Malware payload (Vidar)", "value": "2514905633d6fb2498bf5102dfa479fef6c940739ac32c7a6e16f8e248149cc945b2cfdc7805985947dc85ecec796767", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675484470, "uuid": "f186ea41-2a50-4ac1-b50b-7a74d996db87", "value": "T12366F151FCD754B2E902253208A7A2EF23316D095F358AC7D644BF6EFC72AE11D32269", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675484470, "uuid": "c89bf58b-349f-4e2b-9dd7-c35082feb93e", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675484470, "uuid": "c8d5f8c1-f73d-4815-817b-e9c4369a8ca1", "value": "98304:F9ESHkkBC/0Dh1pItsNaY1eq0m0bsCuWPFbmTbow9PdMr6SAdB4e4JJmC2+dh1uy:/EiOKh1paJ2qsgFZwluZAdiegmA/F53R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675484470, "uuid": "3a2e955d-f3d8-410c-a284-943c9b526140", "value": 6500976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675484470, "uuid": "9e7c4140-ee0b-4ffe-aeb7-c75e65c36036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675484470, "uuid": "ac621411-7fe1-435a-aeea-d48dba8beae8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8990d750-a429-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675473382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675473382, "uuid": "370bb489-63b7-480a-aa70-b57b42935aff", "comment": "Malware payload (GCleaner)", "value": "3412135b35795150ce692918c2f7d164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675473382, "uuid": "49448ee3-2882-49ce-afe3-6f0b2f2b8933", "comment": "Malware payload (GCleaner)", "value": "643a3bdc8fd069eedbc24efaf66669fe96287fa888192190ef3b0b8025d0ec19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675473382, "uuid": "2b16f4fb-ec14-494f-9195-392995d09cda", "comment": "Malware payload (GCleaner)", "value": "1422859528aba3619ca24c37cc9834ffdc6aaa8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675473382, "uuid": "ef41dacf-e5d4-4a12-bf0b-f737c21afca3", "comment": "Malware payload (GCleaner)", "value": "037921a194b312bf2d99921ffcbbdafd0b1da294d576afeae4e10f2c5388a3c30e2f3eecf64e88bd0312d40b5766e152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675473382, "uuid": "2db78c59-086f-42de-ad4f-e1d342b3949f", "value": "T19D953344A5D13033D59253BA3C38C9A6DE363E5F36343586BA8EB42F46672C2BD0C6E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675473382, "uuid": "bfd9336b-e154-4cff-893f-3be67b060633", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675473382, "uuid": "29c307ed-7f09-45b9-82f2-9f1a29671359", "value": "49152:yg+LYqoCHCxgCBEFFVckyMJPMLmygjlqhFrjxRLCgv2MR:T+USG9EFsma2kFrt9v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675473382, "uuid": "70dbe784-64d2-45bf-8806-804b534add8d", "value": 2041714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675473382, "uuid": "97810650-4b39-4400-8654-a2d4b320719d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675473382, "uuid": "47a4049d-38d6-419e-ae6b-3453e52dca39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acbb2044-a488-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675514243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675514243, "uuid": "e7041bf1-2679-43b1-943f-aab8d1fabe56", "comment": "Malware payload", "value": "716b2ad7c90b6c262c392234f1de286a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675514243, "uuid": "d12545b9-ca25-432b-849a-106194e8f9a6", "comment": "Malware payload", "value": "64cb034c0853ed0f2662bc8d35275f4d40d88c379b0a4f4b1e4812a6dd22aa5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675514243, "uuid": "d4452815-41d7-4837-b3c9-ff0f0531db30", "comment": "Malware payload", "value": "bb40146fc5c86fab55258d6218ca438df2bca832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675514243, "uuid": "c09a515c-023b-430e-806b-04c6a406de18", "comment": "Malware payload", "value": "537f9521ceb20d7080bf5d9929cbbe43c67b920214be94db39232a304cb5f44f4726fc977b8e541bf809e5d278dc0e9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675514243, "uuid": "d9303513-2395-4a20-90e0-1cfa9165c487", "value": "T1B31712136A8B0E75DDD267B461DB273F9734EE30C92ADBBFE608C4255953380681BB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675514243, "uuid": "92631007-992b-4c75-94c8-1a2bf530dbcd", "value": "983494ea79ac0e7e813ad9bb85c21543", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675514243, "uuid": "9e667efc-7d47-4e8f-a5c2-390fab8c7115", "value": "49152:WSR0wThKY5S4VTh+yARMTRqenTz8/cblnq8I7gRw8g4QSxxNA2o9HQvzYvzCy1VY:awT2FM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675514243, "uuid": "ab91d382-41ae-4c5a-b971-fcf9665f3673", "value": 19641192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675514243, "uuid": "01eeb0a6-d211-4109-9c14-b5669fe707b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675514243, "uuid": "8454fb9d-427f-4b6a-ad19-515443618da5", "value": "rcm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498735f1-a4c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675538129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675538129, "uuid": "c3bc2f2e-a090-47a6-89a6-0b9aecef0103", "comment": "Malware payload (DCRat)", "value": "a6694ce753703a4ea040569e562d11db", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675538129, "uuid": "cb816b0f-ec36-44de-87ad-c54bda351ad5", "comment": "Malware payload (DCRat)", "value": "66faa0ab77f8471078f93a7d389f95ddffd4b5fc6abf7f79fee3f1dd9a70a5b7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675538129, "uuid": "5309009f-42aa-4b46-8cb3-8042db1823f7", "comment": "Malware payload (DCRat)", "value": "fc04eaf80dbd392d764ed0944e3fbae77061e143", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675538129, "uuid": "3b0dff1e-8b5e-49db-aa02-5a4eadfac25a", "comment": "Malware payload (DCRat)", "value": "5a01dc00360d7aa9dec8b60cae0f5d6122a2cd23bbfa8f7f8b9af51a936c34dfa17ffb918d05c501d886589a713896d6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675538129, "uuid": "59b09d71-9338-45f0-8dde-593019ac4a95", "value": "T15E9633A752922CE9E81F8139C5C2C630A7A27C1603A0E17F17E18FA73F5F6A11D3B561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675538129, "uuid": "b8e2cef0-aac5-4f86-9827-35302040e5b4", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675538129, "uuid": "76c75dfa-35f9-4934-910e-c351239c123e", "value": "196608:/BbOQL+V2yoqdQmRrdA6lsuErSEEJwdF6OrtYPXk0:Zr+oy9dQOls+9JOrt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675538129, "uuid": "e4f61ae8-a31b-4273-a1b5-996e1a60a013", "value": 8667113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675538129, "uuid": "6d1adf04-59d3-4076-a0b6-14737a381834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675538129, "uuid": "21a1c628-ca12-457e-920d-8b210d947184", "value": "a6694ce753703a4ea040569e562d11db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08bc4f9-a448-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675486843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486843, "uuid": "0e45062f-7821-4e05-a95c-3ab240a0b9a2", "comment": "Malware payload (RedLineStealer)", "value": "c529084c8fb3ab485c0675c01c2a5822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486843, "uuid": "54452100-77b5-4221-a428-4296da95b8ee", "comment": "Malware payload (RedLineStealer)", "value": "6733c6df49e6a332124d169d30355a000417640b788c38398a29051fb1b7c55d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486843, "uuid": "e756ece6-ae08-476d-b08a-5eef9c475ad5", "comment": "Malware payload (RedLineStealer)", "value": "27e7709aa01f4ef4aa2b67e92c8e4f416b6515a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486843, "uuid": "4acaea37-ee0f-499e-80ee-ca2bf8f17cc7", "comment": "Malware payload (RedLineStealer)", "value": "a203644808c14122d528d7b2e5e4bd41d4e79ee812af6fb5a11a17cb9d4f6872b0102a239b3b934ba5f6c6b4ae19e5bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486843, "uuid": "1c5bc583-6e53-498d-b4c9-e3c6261e1447", "value": "T1D854F1223691D132C57720348D64DBA4FBBEE830067A9A577F690BAE4F307D0A636357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486843, "uuid": "67b79223-11b8-4672-ba06-e93ce9268284", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486843, "uuid": "e5a10ef8-ce3b-4731-91c4-4062e4a64b4d", "value": "6144:1lyslwLmGvVtooHrtuWTSTtue24lA4Nrh0W0oAWzZRK:1lji6QVtoWrtuWTSIe24WyGWZZzPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675486843, "uuid": "46901779-5916-46bb-ae7d-62cdd1188387", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675486843, "uuid": "52bcc4e8-a389-4bed-9111-1bf7de57ecf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486843, "uuid": "17c35b7d-8775-4105-984e-f19c5fecdd84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8510781-a4d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675549079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675549079, "uuid": "c47a1381-1e45-4429-8050-d0eb4e65ddd8", "comment": "Malware payload (RemcosRAT)", "value": "2aa238c62bdf21d61a382de34650c887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675549079, "uuid": "c3ad6e34-800c-49fa-b57f-0b7ff3ad73b2", "comment": "Malware payload (RemcosRAT)", "value": "6a4ff99ad29aa40eddb5e509b7460556ab23f2dc1f08ce014dc32817128e6c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675549079, "uuid": "99eeb2e1-8b7c-44b9-9188-a0fa1a92b311", "comment": "Malware payload (RemcosRAT)", "value": "2e2bb363ca3d9af4b7ab6001e48ef1eca859b94d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675549079, "uuid": "2063e5aa-97b9-4b3e-89f6-86c54165df08", "comment": "Malware payload (RemcosRAT)", "value": "b960b62b38a5665d15e2f616c48a99d977429d879ca6ca9ce8ea9057524e4d731d1e41ed804f9aac488315e9821a6528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675549079, "uuid": "917fcd70-f2bb-4884-ab98-11c0b27136f0", "value": "T172E1D703A3DC5B37DEE64B3A9CB3238503B9A7079943CB5E58D8515A6D81BCD0B60F64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675549079, "uuid": "8ebd8114-0e0f-4952-b57d-36b11199c17d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675549079, "uuid": "8d6629ec-c0b1-43b1-93a1-e8c6f29b8db1", "value": "96:HkzEkmmFXmT7mjXpKQPOGvMtOcDTmbDtEkIFBjQlrQ5bFnU:HqfEwXXPADT6zKWl0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675549079, "uuid": "268bb21c-c51b-4c5a-b400-88d22446eae7", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675549079, "uuid": "0728b855-fcdb-4f66-a351-baf00b9f9655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675549079, "uuid": "5e07a086-bc8f-4c8b-979f-d6517aebd0d0", "value": "PAYMENT CONFIRMATION COPY_ 529520419250297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31a54a6-a485-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675513073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513073, "uuid": "5df0cb6f-e347-4193-9e00-3feee6b3d81e", "comment": "Malware payload (Smoke Loader)", "value": "113a21345729c63ce7ba40961ddfe9dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513073, "uuid": "b7e72ae6-195a-45a1-b577-42100238aba4", "comment": "Malware payload (Smoke Loader)", "value": "6b1240a3b53ac9be8992347c3ff354c5270d756c265c0b9587ba586f837ab889", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513073, "uuid": "7b797577-21c6-4327-97f7-445aa84f309b", "comment": "Malware payload (Smoke Loader)", "value": "ca40914844dd8a52d4b90c8cedc4ef63adb711ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513073, "uuid": "fc335c9b-da0b-4945-b742-e11454bd2e80", "comment": "Malware payload (Smoke Loader)", "value": "6e78d57f7402ecb7ac7674b5c37e62a2ea28a7ae3bc9d789b0b023c1d4c51d48e48d15da253764e53934825f6a4bafe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513073, "uuid": "8b22e75b-931b-4192-94a6-82cde961c6d4", "value": "T1A914DF323A90C073C57B04748C60EBA56BBDB43156BAD95BB7980B6D9F303D12A3635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513073, "uuid": "75b83ff7-3c9d-4ed7-a710-77744d6ddfef", "value": "3a600fd555a59cd5911cb26c6ab55d55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513073, "uuid": "fb4cdd3f-8e2d-480c-849a-6f1b6abbb20a", "value": "3072:R6+JJTFGY/xLFk/rL0WhV55IRvi/bCc4W84yXr9O4b79:R6uL/xLW//0UR4W84y79Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675513073, "uuid": "4b1d69eb-8c7e-441d-bcb0-03a14a4f633e", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675513073, "uuid": "bf8caf3c-a8f6-47d8-9c3f-ad2a0c993049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513073, "uuid": "5612727c-9f49-48f8-a631-74e94a75d7ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec5f06c-a4c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675539158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539158, "uuid": "d2a61db9-41e6-44e5-9e21-71c879bc1178", "comment": "Malware payload (RedLineStealer)", "value": "52ae2ebb8670fd969ccc651e671c4d84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539158, "uuid": "4cb19894-da99-4af5-8872-ac902a50f1bb", "comment": "Malware payload (RedLineStealer)", "value": "6b956e9f4afb4aca53161382a250c55cc187f1d1b89bc232c36b128b57dfa193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539158, "uuid": "c8080356-5567-4888-9a89-222eff72a1f9", "comment": "Malware payload (RedLineStealer)", "value": "544d8e7d83ff4e78fb280ef96f2af4cd5c943230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539158, "uuid": "65cde753-0177-40fa-b6a7-c8ddffb89219", "comment": "Malware payload (RedLineStealer)", "value": "10cbe8a6e7ce379b9567e3e4c4bf02a3c355613fdfb0052ca75d44bc473e84a9e33e7b2055e3972799a2aad8a55c8712", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539158, "uuid": "f584a8ac-9962-4aca-ba66-0e07b24acc7d", "value": "T16A84F1323690C0B2C56A57305C54EB65B6BAB83096318A777B6807AE4F702D16B3637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539158, "uuid": "4c970b02-e15c-4c53-9156-6b377e39523d", "value": "847f96cdadc895b3547edbb7a505a62a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539158, "uuid": "7161ea6c-81e9-42bb-aeb1-4c80cd79c6ce", "value": "6144:4g/XLCjuqJTYbMi0ZBPECpOaNTtrxDzMyt3GyvV:4g/cuqegHPDnxJzMcWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675539158, "uuid": "308c29dc-62e0-43e5-adfa-823001fc5b3e", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675539158, "uuid": "dfdbee5d-4261-466c-927d-8284b366843e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539158, "uuid": "bbbc8d82-b663-4303-b0ac-9c59bb36fbef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdd6cf1-a462-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675497706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675497706, "uuid": "5f2e2813-dcba-456d-830a-dec7a1894ba4", "comment": "Malware payload (RedLineStealer)", "value": "b100b49cda91183607ae3a982b126804", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675497706, "uuid": "e487f7ea-63b7-4bb4-81aa-6026e25e3269", "comment": "Malware payload (RedLineStealer)", "value": "6c031a0f156aa5e291dac746b8df7cdd6caa5fc2f7f273f0d7782ff99c98b45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675497706, "uuid": "7dbee44c-8e66-4767-b214-f34216212f3a", "comment": "Malware payload (RedLineStealer)", "value": "050d933f6f061880896620cf5b43a3eb0a294db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675497706, "uuid": "9c4e060e-e0f0-49ca-990a-2c2863fd5d38", "comment": "Malware payload (RedLineStealer)", "value": "a9fff87397bda37d6e12ca5094979ca43a61c0590c2702918e24da99516d2ea6a2e50ebb0239aacffb6e994d8b2a3593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675497706, "uuid": "14e9be64-bed7-4629-ad55-766081911e19", "value": "T1A254F1227A50C4B1C7B744344D68DF747BBDB9319079861B77A816BE9F306C0963A38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675497706, "uuid": "2773dae8-7329-4d15-81ef-1f23a5c0a61f", "value": "99cebe82e9a09163c3069dbc31af6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675497706, "uuid": "1a6fb76d-a9e0-4363-9fcf-0ae14c55b649", "value": "6144:KJlzLZpot2TZ0RHqcrAtz0j56xdCARoEWa:KJFXoM2xqc0tz0jEx6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675497706, "uuid": "e46188ba-76b8-40c7-a85d-6109d3bf5ed3", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675497706, "uuid": "2e07a26e-b1d5-466b-b9c6-7076c3da10a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675497706, "uuid": "0db902b8-4742-4612-952e-7e061c6ec177", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae38ab8-a496-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675520334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675520334, "uuid": "25609ec0-2bb7-4c6b-9b0c-5a19bcab01b3", "comment": "Malware payload (RedLineStealer)", "value": "02438d171a0c8926e8fc52463b4d21bd", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "hulk", "colour": "#CD961F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675520334, "uuid": "8ac3d836-34ac-4d63-af49-fc45b64e9f93", "comment": "Malware payload (RedLineStealer)", "value": "6e69194b6d4b433733e82067e4ab9968bdb7bbc5e4e82220f35d943db6af60dd", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "hulk", "colour": "#CD961F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675520334, "uuid": "9be16b6d-fa42-4242-bc78-9c11629103d7", "comment": "Malware payload (RedLineStealer)", "value": "ce1bbac8f80d2f927442beb9cc4ba71e087240fa", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "hulk", "colour": "#CD961F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675520334, "uuid": "e8df41f0-86c1-4c7d-9f60-decf26c5dcc8", "comment": "Malware payload (RedLineStealer)", "value": "40c3daa36242ff202e9ea4ca9eb2100a527ff8253532949c6a2debe7511c558defca22c1f8a77113b36eec66cd7685aa", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "hulk", "colour": "#CD961F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675520334, "uuid": "cc4cb75f-dad2-49dd-a5dd-99830c7ff3e1", "value": "T1735623317B0C87FE10D7E155CB37ED1D6F217E7EAC59B6ABB68A0FDA46888019D02121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675520334, "uuid": "171dc1c2-0bd5-42b8-8779-12d57ac73c2a", "value": "98304:xWsXSUI37hQUVTTO04pdZLHsrn0RtC+jxg2vw+yulRgFxAr18p9ixbrEzvxkpA/U:xWsXVI3FQMTTO04pdZLHsmjxg2vfl+76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675520334, "uuid": "a80b54ec-1f45-48e6-8c28-818116fb3e3c", "value": 6272875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675520334, "uuid": "9fee41a3-6f6f-4bd0-a774-1ea20f9033b4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675520334, "uuid": "d435b908-abea-4389-8a90-2251a0dcdced", "value": "NcCrack.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d328d6-a4d7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675548055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548055, "uuid": "00d8206f-a2f8-461b-98f7-ed090282646b", "comment": "Malware payload", "value": "15459cf34d781a60ec3d1b3b97d7a557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548055, "uuid": "755a0ba9-dc7f-40c0-b322-9206c39a33ba", "comment": "Malware payload", "value": "6ee4c4a84f70205e3ff1a55984eab7633c17e2f00b67935f297ce6eac23c764f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548055, "uuid": "820de522-ff93-416b-8747-fa0a03ff1712", "comment": "Malware payload", "value": "19932bb513a77a5af9a063ed65fd342aade83739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548055, "uuid": "a7a5a6eb-aed5-4a3a-9235-26e43390c07b", "comment": "Malware payload", "value": "0cd8ebe8a24e0a021cd4bc6d585f7edef526f186f30ba576ed04be94161389a51188929840b905ab5fb7cfde54467fcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548055, "uuid": "d4a9aa8f-1390-4bac-b6a5-499c6e0c7fc7", "value": "T110B5EF124CA8E0A7E0C88FB0CCE35DFB5D55ECB9C1B8491795147EFB3A32E522C56629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548055, "uuid": "c11da292-cd65-4da3-bc2e-ca06eba815cf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548055, "uuid": "8054e418-0f5a-4ac9-933d-56f0a29b44c1", "value": "49152:d3ZBOoiQj1IXYimueTu85CCPSt1kMw2onSbRoZdHLCgv2MR:XBOo1jEzeTR1PNMw5+ETv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675548055, "uuid": "f19f9599-6132-4bfc-be3e-4a6d80c6c133", "value": 2342611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675548055, "uuid": "4a685a4d-379c-4571-829c-e9d8fc4121ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548055, "uuid": "fb82e063-e1bd-47c0-9e49-06ae6a74ba4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6ffbfe-a460-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675497036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675497036, "uuid": "be6ee7a0-da32-481f-8352-662e612de31a", "comment": "Malware payload (RedLineStealer)", "value": "4bfe502c4791a606544d04b7fc34326e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675497036, "uuid": "c644a293-d945-4e2d-84f9-1ab761873cca", "comment": "Malware payload (RedLineStealer)", "value": "6fbf44183c6ed6ebe3f188f187afe712574c34d9787cdf40c5bcbb07f6d50fb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675497036, "uuid": "79a932aa-8393-4bda-9d65-8f2ce992f4af", "comment": "Malware payload (RedLineStealer)", "value": "c9e5e5cd471403f5c8f96b3808f5c26e20cd23ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675497036, "uuid": "b8d1bc09-4886-4d71-a6c3-fd25f76fda3a", "comment": "Malware payload (RedLineStealer)", "value": "618bdd09d8b6487a187abf883c95b98c9fec3356ec39a4a17176a3e50b212b0bbc53ef231e883ad0c73ae2b1f3b84364", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675497036, "uuid": "fe6f57bb-01f5-47a3-8c50-f9b955c12106", "value": "T1C005222236B0C0B1CA3A183069348A9DAFB97870A778561B7B6D0FF84F317D15636797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675497036, "uuid": "7bbf872d-c64e-47da-9684-c5c0dd63395a", "value": "99cebe82e9a09163c3069dbc31af6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675497036, "uuid": "a6e73bb0-90d3-4eec-92a7-863f28c0c8b4", "value": "12288:5J9g/YR+P4AGT7HWdQeTaTwA+Zj88VRtP5Jdj+udqGRjymXHhMgT6wdnrjF:5sYerlTVRtPVj1dqWtHhTBdnrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675497036, "uuid": "745ccaed-33bf-4525-87ce-8686fd26d76d", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675497036, "uuid": "1b5e7a0e-d3b6-44d6-87ba-93ce63c0b43b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675497036, "uuid": "557bd2d8-2110-41a8-95fd-463d65c56e56", "value": "4bfe502c4791a606544d04b7fc34326e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732482a3-a4a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675527461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527461, "uuid": "6c78356f-55c8-4c43-8b8c-4375ff76e015", "comment": "Malware payload (RemcosRAT)", "value": "e1c771cceb693ea14bbcde32ac1355fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527461, "uuid": "61d001e3-232e-48b6-9ccd-fb90d704a45b", "comment": "Malware payload (RemcosRAT)", "value": "70a0d6207bf07b9d71452c71fc65c9b8335d2099796d70a25ec6f2a03090daa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527461, "uuid": "941c1a68-34f2-432d-bb5c-2c21c03023f4", "comment": "Malware payload (RemcosRAT)", "value": "bc2da06db4b0cc42595b7761ff990e303441cd99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527461, "uuid": "9ca713b0-a3f7-4817-a74c-d1acecea421e", "comment": "Malware payload (RemcosRAT)", "value": "23f3d0a9d9fd0d2a5ae6c5b2e97700c6549b338de63a277aeed37c32f054d0a3ab06907a17c1cfcd598c6bb998bcbc1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527461, "uuid": "ca1b28b8-7487-4364-822d-db956d504990", "value": "T17DC5BF006083DEA17C1E91D62A896D47FD0B8CCC7FF8F231F13EAAE9609558D597A127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527461, "uuid": "d1ef631c-a35c-43b5-a081-5fef20fb5428", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527461, "uuid": "4bb9966e-c299-4448-9261-4878cb9193f1", "value": "24576:CsLDsY5ohQjNm5lGrJrGU/thfLixwfA7DgCBbZoiSNy5aKg88vX6yqlAtVULkfSO:C3FYVr4U/3L7yRAUQKuakLomg0BqKqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675527461, "uuid": "328151fc-1b5e-42f9-a55c-ed7a831458b3", "value": 2671104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675527461, "uuid": "3b82e6aa-4e55-4052-b781-52c7c4e1c534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527461, "uuid": "28a1e2ca-9f9c-4f84-9e84-754f9815d30b", "value": "Enquiry_Order_Official_Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec37b7f4-a49a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675522081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522081, "uuid": "df6a05e9-b0ce-4beb-8984-66a2e7292545", "comment": "Malware payload (Amadey)", "value": "f5edc71dee702c11351951d3dc5f8c48", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522081, "uuid": "10e0ade1-3fb3-47e5-87ae-5c33653c979b", "comment": "Malware payload (Amadey)", "value": "7114b1e46bd68fb8d8e16daebf0a34b36efd2d1674106599f39bf7419bcf723b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522081, "uuid": "339cd8ce-b4f2-4c25-a02c-26cdb201d681", "comment": "Malware payload (Amadey)", "value": "32138f7a7bc344eab27815d879f04b213a688e62", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522081, "uuid": "d465e99a-39c5-46a7-a1af-201750b0b21c", "comment": "Malware payload (Amadey)", "value": "49755965cac3d10cbe5085b2c00d07c1494327ec58578f79ed4dd5830db8b708535ad6c96419b1b08365d04f60daa366", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522081, "uuid": "c28907fa-a506-43d4-8d08-e99aa3f88f60", "value": "T1F2B412223E80DC32E82D32745828F72DAA7DD4701576D4677BAD27AE5F703E06636389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522081, "uuid": "aa24454a-188f-48dd-b8a1-05069f25dcdd", "value": "be7581a01c1ad2f53e81adb31665eb55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522081, "uuid": "ab8b6a88-ace4-4568-92c0-acfbda8e2225", "value": "12288:PBEiZHdBaDrb6ibufsa4W9Xk5640GWJfpMMjhg1mVko:PBU9b6XklvsfpvK18ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675522081, "uuid": "48d9844b-6ee8-4cef-a3f7-a09d36185113", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675522081, "uuid": "2b184e66-5f72-46cc-b354-c264297a5b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522081, "uuid": "976f3767-b81d-4b1d-9c7a-03d64ad9212d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd35648-a440-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675483456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483456, "uuid": "5a3a07bd-3222-4666-9b1b-d26780892f34", "comment": "Malware payload (Amadey)", "value": "0639746f4cc4944b7faee3f4f0c24539", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483456, "uuid": "7c9dc459-7b71-4aca-9e1d-9d737f6de7ec", "comment": "Malware payload (Amadey)", "value": "716a1e8a2385af12aebf95bcaa32cd4b28db5c36aff954ccdfd4f550a5c54a00", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483456, "uuid": "6839eec4-28c2-47d4-ad91-1e7f47a49d54", "comment": "Malware payload (Amadey)", "value": "6ed6172337963b76b2260be340728935a355d20b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483456, "uuid": "a5cfae6c-23e3-4247-b244-4da34a6ec1d6", "comment": "Malware payload (Amadey)", "value": "e088b0cdff688904afd87c07943d441bc4b35e4d69c723c456a11beda507ab60d72341394cf319b7bef1f8e91f1738cb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483456, "uuid": "9c4dd2aa-6535-4b37-906b-618ad8b6b4ce", "value": "T1CB0512323790C0B2C56A55344CB0EAE6BF296971C62D470BBB0817FDDF31AD0AA76356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483456, "uuid": "5586ad1c-7628-486e-8d88-3ca8e40e00c6", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483456, "uuid": "2365eba1-9ea0-49e8-8c6e-036d9bb736ee", "value": "24576:nq+RJL2iT79dBGfhlKui5X3fRw9BRPtaQ1b:n/Z9oh5iXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675483456, "uuid": "f4d7cb06-250a-4d52-a1fd-f98d7d6d3731", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675483456, "uuid": "00c04eeb-90bf-49e9-a26b-89fc898f9e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483456, "uuid": "ff82860a-87e7-4a9e-acc7-2bba9d7cddc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf8c136-a457-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675493198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675493198, "uuid": "4056e97f-374d-48a9-b24a-92e23f47da5d", "comment": "Malware payload (GCleaner)", "value": "21df6d9dfc45910b9f54530f819bcd1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675493198, "uuid": "ea55eeea-e581-426c-8b69-b8019f7ce8d9", "comment": "Malware payload (GCleaner)", "value": "71bf7691a9cc7dc3f5dee1ac0bf691a1be90aa88b4d43a6d56d9ea36deea9096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675493198, "uuid": "69e4b236-9e5f-4e08-abda-8e80dd885d2b", "comment": "Malware payload (GCleaner)", "value": "40ccd25cedac267951b98ff85b2b7a569f8e08c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675493198, "uuid": "c4b5354e-4c6b-482a-9b5e-554f7c9c101c", "comment": "Malware payload (GCleaner)", "value": "aa557c69e4da177e57e5cf7d11eb4af9e70f06de0bd921bcc62be70b6837975dbd37ce94cfaaa7b81550330ecd136cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675493198, "uuid": "6f2c13bb-ee8d-4f73-bf27-8587c9c06997", "value": "T1B6B5DF061C98E5ABE0C98F70CDF35DFB1C15ED79C4B9486791043EFB3A32A122D96629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675493198, "uuid": "f2537cb3-dc00-47cd-8a8f-88ab2457aefd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675493198, "uuid": "91a9f96f-0d35-4567-9873-956c53c51925", "value": "49152:d3ZCqVMHh2lu9ZyMf4lB9zp3aNZsXThZtV/LCgv2MR:Xbyh2liyMfa2Nqtpv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675493198, "uuid": "ea074bf0-f8ad-4563-94db-b4e7e10bc6e9", "value": 2347756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675493198, "uuid": "bf003a0a-1b32-4345-9eae-47648a6c7564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675493198, "uuid": "86348c31-1a12-43e3-a6db-f1b58dd05bcc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcbbfb3-a468-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1675500632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675500632, "uuid": "964dcc8f-90a6-4fe3-b3bd-680c22f6978b", "comment": "Malware payload (Gh0stRAT)", "value": "bd603b6c37479f752e1bd2694a238e1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675500632, "uuid": "b0ea05f8-670f-4aca-a6c1-77a3c6b67614", "comment": "Malware payload (Gh0stRAT)", "value": "72c2cbb7f605a009d04ad60b51cae96b71472176c071a2df0257db7f79054d01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675500632, "uuid": "a5957a68-f820-40ac-a2ec-85ca7726f535", "comment": "Malware payload (Gh0stRAT)", "value": "a98307b90376d2174dd02c27a53f812a458b77d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675500632, "uuid": "7876aaea-c8e4-4d3e-8604-b0222b6084e2", "comment": "Malware payload (Gh0stRAT)", "value": "e9654fa18de816bf114fe35465aaeca61d6f64e2d54ceedde4a88ab38511a9c16ad665682d10e483469d30a1c4fb4fbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675500632, "uuid": "1fabd376-8c1d-4749-9418-6aa190ea86f3", "value": "T1ED577D35F7CB80F2FA11083C44E677BEAB7E7C16035A9A579B04CE1709631597A2326B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675500632, "uuid": "d7bb6972-5218-47ce-89d4-13317f90dc88", "value": "93e81a5e6c02db26acd594c237e8f622", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675500632, "uuid": "2198e13d-df79-4203-8120-5ad35ab0ae29", "value": "3072:cgivARinbxSZPPjqaS6Aai6WqC3Fa93LUgz8a9hU3gtO85t:JW2LqauDE97xz8wmn85t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675500632, "uuid": "daa97cff-528d-497d-8aec-7ad77b6a798d", "value": 28528640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675500632, "uuid": "6a946159-324b-4186-b976-16cabab0ee9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675500632, "uuid": "50c354b2-fbe9-4d01-8119-82a1c7dc4466", "value": "bd603b6c37479f752e1bd2694a238e1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed44d6f-a4d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675548607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548607, "uuid": "eb9d977d-607c-4b7b-bd92-bfa4bf36df91", "comment": "Malware payload", "value": "c998826af2e3b3a0e0f3eb49e867734d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548607, "uuid": "0fdbe95e-21d6-465f-8c8c-6e5790530094", "comment": "Malware payload", "value": "72f30b0dede8e6aa1ea596dcdb5ef057b20027e0eacd5e42e48efef0bdfd0cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548607, "uuid": "833f086a-92f3-4bdb-b460-f899fa97a2c4", "comment": "Malware payload", "value": "7c4263b465a793c804cbbf528520e9b27ff2c7c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548607, "uuid": "2e4fb9cb-41e5-437f-a5ae-ea3921362264", "comment": "Malware payload", "value": "d7d144cf6bb16f9ceb2a7410286284c75c9f9b5758e7869d36e9f934f02465f3946f10d258f274e9d0974c5b50b78c2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548607, "uuid": "ff00ded1-42bb-4d21-ae0c-73d07b0aaeba", "value": "T192E5BF23AA9D4894C169AC37C486463107B26D7467B387CB33BEBD5A3FB21C19D3B215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548607, "uuid": "d88ec3b5-2476-458d-939d-d4d1c311bd01", "value": "ac69b18903682937407e9a292ea36a0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548607, "uuid": "931ab121-b35d-48f0-8bd2-e3debf288a7b", "value": "49152:iOnjDmNlqKYXZyOnjDmNlq/z9Bl/u1ufyV74fFByKXBoZ3ei1Glx:Fdu1ZV7UyKXBoZeyGlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675548607, "uuid": "0c07fdd8-c30a-41d0-bab1-7e08b70d0f98", "value": 3205920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675548607, "uuid": "732a4dcb-42b1-46d3-887d-f9a975a5abd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548607, "uuid": "5327fb29-d558-4793-b0d1-d1b782b4b68f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2bd0dc-a4a7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675527424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527424, "uuid": "181a7f87-d838-4a95-bdde-0c417c8cc247", "comment": "Malware payload", "value": "2ebbb60b2ab044530ccbc3ad8ec37723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527424, "uuid": "ef809750-34f2-43a4-b5d0-46e8dd0412a8", "comment": "Malware payload", "value": "73f645dccb9d90394fe0dc485c9cd3d7919c20de4dab6a118d6421c94a09e2b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527424, "uuid": "28ac1385-7e76-4175-8717-ab4e39c28a4f", "comment": "Malware payload", "value": "fbc327030739c9e40fa254ceed64f62c5828bd48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527424, "uuid": "a6ff8c3c-f053-4bc4-b0fc-2b97a55f742f", "comment": "Malware payload", "value": "b087a935c44511111b6a3300d95e6e6ceb5461e0c0824d3fa7985dda39c6982dcf720486251da6c20dcf9b289b3c4654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527424, "uuid": "e7330b36-68b1-49df-9bfd-0cbe42d35604", "value": "T12A136C3278E0C072C27351309C64A6A5FB7A6D2153B5DC276F280679AF31AE1933B797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527424, "uuid": "84215f68-4272-4bee-9360-ee44fff8c089", "value": "768:kqYB1sfZK+iNtsfByhu/7iVXchIXgLdJV5O3hAbzI/MgC4:ETIZQt0T9TLbV5shj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675527424, "uuid": "7f32e6c1-c478-4fa3-98d1-f6d1582ad82f", "value": 42848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675527424, "uuid": "ab9dac4d-b872-4419-9702-694853719d76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527424, "uuid": "ec8e5943-ccbd-4f00-8ce0-4f71b7a653cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0474de4c-a494-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1675519115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519115, "uuid": "e4a749e9-60f2-4c27-832a-af098dd67ae6", "comment": "Malware payload (RaccoonStealer)", "value": "08ae52f0e8fc87fe61b0750f79fbcff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519115, "uuid": "55ca33af-31b6-4090-8412-fe60123e883b", "comment": "Malware payload (RaccoonStealer)", "value": "748aa5ee3f5e51911bfd0bbaf90c9ea41be3aa272749f205dfe7d2a972e874d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519115, "uuid": "5412b294-fe3c-4aa1-ad31-cfce4ed0cfaa", "comment": "Malware payload (RaccoonStealer)", "value": "cba4d327d56cf2599156d163dcd4e8ad73c1f4f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519115, "uuid": "d3b3d5e6-7b4f-4475-8dc2-9c1548695721", "comment": "Malware payload (RaccoonStealer)", "value": "603c389829043f22cab96b97fe0abd7058c888dafb603842b5a7c94d09ac90885cc52c0f8d12c12bd28df66790eb5f6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519115, "uuid": "dcf2bce9-3c28-4d91-9c58-63f6de8cce8d", "value": "T1E114D0333A98C072C17B11304864EBB9BBBEB5315679950B7B6417BE4F70EE0673621A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519115, "uuid": "fbcba34a-4c7a-4cd6-997c-202bc43ae02d", "value": "be7581a01c1ad2f53e81adb31665eb55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519115, "uuid": "b8dc859e-445f-48d0-8721-5f3692c3f904", "value": "3072:qVlr+HY0wH0XLRr9sBgWV55ucjlEMmYD+acunpD+9G0KQZlV:qVliHlLR5UgRY0iFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675519115, "uuid": "01c05a6f-d08c-4f04-bf27-b515fe7e3625", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675519115, "uuid": "8e07ab74-c456-4dcf-8827-e7c4e97d65f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519115, "uuid": "13d8722f-4911-461d-9ba4-66026586bba7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd68adbd-a49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675523720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523720, "uuid": "8b84c304-299d-4592-abed-b9fcc05d9bb5", "comment": "Malware payload (Amadey)", "value": "063f02de8cca4f2d41e7cdde6787a289", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523720, "uuid": "11123b40-1c80-480f-96d9-20322f9d6ffb", "comment": "Malware payload (Amadey)", "value": "74f010b32c985a9151cafa95da88071ad790d7cd5f966b0d5acfe4d1b578b5a4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523720, "uuid": "d4426607-eec9-496e-bd76-678de74ce237", "comment": "Malware payload (Amadey)", "value": "3d6521e3ada5da2daa689bc39c9613ce47e80ca9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523720, "uuid": "c1dc2f6c-0c73-419a-b6b7-46e4703b6047", "comment": "Malware payload (Amadey)", "value": "510dfe394f78d49b7f55d7a77b8f1125b8fa904de85d052911165e1f329944ba149f7c391beb32837384544d7261341c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523720, "uuid": "6d0d8de5-9c1d-4fa5-b6b2-d46c6f509083", "value": "T1A1B412237180C0B1C5AE60345858EAE4BFBEB83144B5C9AF77983B9E5F346C15F2671A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523720, "uuid": "36a47dce-a971-4363-8d9e-3ae983be7bcc", "value": "be7581a01c1ad2f53e81adb31665eb55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523720, "uuid": "6cb7fa22-c54c-49de-aca6-9505eef5b6bd", "value": "12288:tZNnsmt5299ObMwUDpbG0yA/MAfnzLv3FQUI4YI+yq6rr:tT3529K7UDJX/fz78W+z6rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675523720, "uuid": "a3c9da00-0241-4a1f-99b7-7982f74ebfd7", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675523720, "uuid": "55356552-6591-44c3-b6db-dd94b04c5e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523720, "uuid": "083863ea-19e2-4a13-8eac-7e8e0f2b1c78", "value": "063f02de8cca4f2d41e7cdde6787a289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a4e7e7-a4bb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675535891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675535891, "uuid": "ecb874da-ab51-4e57-a132-27f55da4b538", "comment": "Malware payload", "value": "ae515bd03dc8cee038f9c9b8cece41af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675535891, "uuid": "ad5f5ccf-a8c8-4025-b71c-2cf7a95e7da7", "comment": "Malware payload", "value": "7556c0211e3fb8bf3f4d2861b66ad572d9626331a1957722d9211cdcabafd946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675535891, "uuid": "4fdc70b7-c553-4bae-943e-3d912d5ddc43", "comment": "Malware payload", "value": "a0d18cccc4aac544348ef9288c4668ea63db04ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675535891, "uuid": "2daaff74-ea57-43f5-a282-26d2b84c04f7", "comment": "Malware payload", "value": "85122b22df20f462cfed1db96e2efd4db3c45ab2f123d5f6746ce14b0bc59cec3b6c34ab656a1f1da98aa7886def13ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675535891, "uuid": "78a99b10-39fc-4dd3-bdda-9c719d142a15", "value": "T16F17339D57D86CE6E9E7A13F4D2FC018D99AFD054368D18B4289864A0D67BD03CBBF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675535891, "uuid": "f498aa1b-6ab8-49ad-afda-73c38bb5ea69", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675535891, "uuid": "94c17953-65d5-47a7-99d7-8f5fd0ca2eb1", "value": "393216:yu7L/OtASFuldQuslN/m3pDl9AJ4ZoWOv+9fPV4aEs8JaKCYYA:yCLuFydQu4KRS4ZorvS31ClCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675535891, "uuid": "53f7db3c-cee4-4252-91ce-00b2f90d5b6d", "value": 18831158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675535891, "uuid": "2864b4e6-d05a-4eb8-8bb3-b6e1a39881f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675535891, "uuid": "376cb3df-7308-4758-b451-2feab209f3d7", "value": "blackcap.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e514585-a459-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675494033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494033, "uuid": "ec27f05a-65a2-4145-aa5e-54693ff6f712", "comment": "Malware payload (RemcosRAT)", "value": "a06614c188d065ad72275761891c0f00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494033, "uuid": "e2029ab5-8849-419e-bfab-f2dcb7b375a0", "comment": "Malware payload (RemcosRAT)", "value": "75f6fa2b6b27e284e274706113a51d756d313d7326cb515d77abf7617c4a8295", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494033, "uuid": "8c25cb08-12d8-42a2-9ae9-65095bf9b321", "comment": "Malware payload (RemcosRAT)", "value": "dfe7e3037ea5ea699c6491988b09e207818a3793", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494033, "uuid": "7ef0cf80-47ef-4cc7-b068-1b8bd1c8c849", "comment": "Malware payload (RemcosRAT)", "value": "5c23ac37e3692ec9fb4bb416d1bc69ee130d0a38497d38512b3090887db6717d53c41499e896679999cba42576ba1d57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494033, "uuid": "30e78972-b1f9-48ff-b63c-d2d33c0a6d12", "value": "T1503633F5A0EF8492F147CE815964F9A505B230E3EDD90C79432EB744CEBED953A48A0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494033, "uuid": "b08dc4c3-d659-4b31-9399-d3daf53a2154", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494033, "uuid": "5b231aa4-4f97-4a21-91dd-1e32db8f7d15", "value": "24576:8ahlMa/PkO7hTqcaIqZUFUMIzsqZXr46240TNdv3pPZmypz:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494033, "uuid": "6fcdda20-6740-48e1-a45b-01d8a9bea63e", "value": 5110272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494033, "uuid": "fcf4d493-37f6-470d-a0d6-1787ebc6194e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494033, "uuid": "fba67adf-42f8-4cab-8602-59c6c12a66db", "value": "Aaqaybpuu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28125928-a4ca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675542368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542368, "uuid": "7700a0bf-1e1e-401e-bc88-7f9ada296b87", "comment": "Malware payload", "value": "c358fe0e8837cc577315fc38892b937d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542368, "uuid": "1589862f-6267-41f7-a7d7-4c566d3ae47e", "comment": "Malware payload", "value": "773d147a031d8ef06ee8ec20b614a4fd9733668efeb2b05aa03e36baaf082878", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542368, "uuid": "8603c527-99a9-4827-ae9c-0dc28bff441c", "comment": "Malware payload", "value": "5e5c89147d248e16d24d673a1f77589c892db6f6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542368, "uuid": "07608263-9ab6-4fa3-89c7-2994ccb2bd46", "comment": "Malware payload", "value": "1d3be25c08ef24493580c88b556f891c05a6b2b701053b6e321b7df590b42b65673cac70949aae9a2e0ca4290f456277", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542368, "uuid": "e2a8aee2-62c1-4658-b234-f33a51b33dcc", "value": "T10431ED108D0A506967234D6D8E8FA822836D64872A090BB53FBC43966FC5E33D5E2E6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542368, "uuid": "7005ab69-159b-4b0f-a631-bcafdf6f9111", "value": "24:ikrdE3YtloKYj80EpGBMvTJ3kOlq1csJC0ZTinv40g9X0jof5Os2L6:ikGYtyKg80QGB7Kq1VJCrvuXEVs2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675542368, "uuid": "2db417e3-0588-4c8b-9974-7d748af0c0d9", "value": 1626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675542368, "uuid": "877d6db9-b651-49cd-b025-66b5f8699ef7", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542368, "uuid": "a4318370-1b94-43eb-94e9-b062594747e5", "value": "5e5c89147d248e16d24d673a1f77589c892db6f6.rl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc39659f-a45d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675495828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675495828, "uuid": "dd06cc5f-dff6-432e-b82f-f8b6877f4a3a", "comment": "Malware payload (RedLineStealer)", "value": "f6295519e01aa832395fcef430ddeaef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675495828, "uuid": "68c57c0f-d7fc-4d1c-b660-3cdc401d370a", "comment": "Malware payload (RedLineStealer)", "value": "7834f71c64d4fae1c1bfbc20683f95c7cc768a590a9951ef6a98805b2d0d226e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675495828, "uuid": "eda62ba2-0a27-48f3-9eee-653e1b3b7530", "comment": "Malware payload (RedLineStealer)", "value": "5ffd22bd3799e4c5ebb5aa9de52cc4111e48b931", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675495828, "uuid": "9514e440-54cf-4c68-8fad-911a63c5a932", "comment": "Malware payload (RedLineStealer)", "value": "f6b99437df04f1cc6f1480314b1760c006d6c356ceb9a2dc6e91373dc0414cc0d7c7a562e13605ae6e6c4a66605141c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675495828, "uuid": "349a127a-26f1-48a2-b35b-9960d45ccea8", "value": "T1A1D412363AA0D0B3C4A614300C25EAA42BBF95325539BBA77BA5037D9F306D17A37753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675495828, "uuid": "43de32ce-e4e8-438d-aa26-ecb8aec77e4e", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675495828, "uuid": "a4ce9d9b-729d-4f01-8c59-62c73da70654", "value": "12288:WtQICG3UBfGUzZBzkbkCW/jsPrPqF+W/EkZJBJ2:WYAUf9zZARW7orPqlnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675495828, "uuid": "0c43af89-001e-4dd5-9721-80e6cb2e0f64", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675495828, "uuid": "c3aad035-a2ea-4581-802f-1ada2a0310dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675495828, "uuid": "365af5da-e8d4-40e7-a9be-cd4218527640", "value": "f6295519e01aa832395fcef430ddeaef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21883c60-a44d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675488670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488670, "uuid": "5d5bf340-5fb4-465b-9058-8dfdf8447ca9", "comment": "Malware payload (RedLineStealer)", "value": "c5b51a588ffa8f0f6b7c48d4b99bdaf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488670, "uuid": "28f778dd-cdfa-4f4a-a638-30e0e5bc1aca", "comment": "Malware payload (RedLineStealer)", "value": "7bccfe9c03119443d84f9298d0af6553ae3746ee3a7dfdedee5f33ca9e2f012a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488670, "uuid": "84f6361c-6ec5-48b9-a0fe-cb7d6a9d7dc9", "comment": "Malware payload (RedLineStealer)", "value": "57f6b09163d756a19e4a1e92edeac1858e1d18e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488670, "uuid": "a595d9cb-2c08-447a-b239-bad162288178", "comment": "Malware payload (RedLineStealer)", "value": "d4a43afc00e7e3d59bc66fa4c94769d1564678a69305a7694bffbb74ed78ef541c24f5b023651f988751336c711d9e94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488670, "uuid": "a8b3bfcc-71a8-4044-96e9-4429fef54c3e", "value": "T11754F12235D0C4B3C06F55344C35DB65ABBEB53056BB5E07B7981BAE9F202D09B3A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488670, "uuid": "84b60744-4b38-4a52-9696-b6a0d100f97b", "value": "99cebe82e9a09163c3069dbc31af6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488670, "uuid": "35b0a245-0a44-45e6-894f-b3b051cefde6", "value": "6144:PV1L0mAoAb+sbLkAYC5D7T3fT/fTtJE1Ya/PoY:PV1PAoW+svD5XLf9JIYa/QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675488670, "uuid": "33474251-82ae-4c55-acf7-7023ade35604", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675488670, "uuid": "79c1c432-4140-4680-a7d9-53bcd40b93f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488670, "uuid": "c9528b52-0a6f-4227-b1f1-5f51f638e8e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefc294b-a4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675546137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546137, "uuid": "c8918aae-6d71-42d0-8a24-7107a866594a", "comment": "Malware payload (Mirai)", "value": "b97851317dda77d9a2c8fe318d6b4428", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546137, "uuid": "f97ce9a2-f493-45cb-9dd5-f0b1682e770d", "comment": "Malware payload (Mirai)", "value": "7cd300b495316a6ac0f5179e12c7e52e098735c80a1a5120abc0b280215cad59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546137, "uuid": "ff1112f4-180c-40bb-8e7e-fb6d1e4eb78c", "comment": "Malware payload (Mirai)", "value": "171feae8502ca8c16675a0299625ba0ee0d2243e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546137, "uuid": "4a1ca042-b8ef-4f15-82d4-9e10c6d05690", "comment": "Malware payload (Mirai)", "value": "fdd97dad05c296b3e885b8aea7d58d10d27a8f45ae302c2d972404e524b44204e520500d812c9902a02351c6e3bc732d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546137, "uuid": "3384abd1-c3a5-4bec-ad05-c877f72669c7", "value": "T1D3438D36E96E1E74C04641B074748FB56F23A5C883972EB61AAAC2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546137, "uuid": "1c6d3948-8730-4ecd-8221-317c699651ae", "value": "1536:Naa0brW/Od9hlCRAKTf3KwXQCcpvDCM12+W2:Nv0brWGd9XMTf6wapvDM+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546137, "uuid": "eecf3221-388f-499b-9bbc-a7aa8772468c", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546137, "uuid": "527cbc4b-a24e-45a1-896b-721c5791ddbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546137, "uuid": "c6d19046-1d97-4d8c-867e-51acbee21e9d", "value": "b97851317dda77d9a2c8fe318d6b4428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63457019-a446-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675485773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485773, "uuid": "3f3a11dd-f301-4756-b143-3bbe94658d20", "comment": "Malware payload", "value": "1321f863809722c82fa5328c04ad26b7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485773, "uuid": "e9f9bc89-1a7e-4cb4-a70f-1c6e8c501f5f", "comment": "Malware payload", "value": "7ce0cc47a57168c2825a99766755d04b42e9c56b750049145ec039f483a0fe2d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485773, "uuid": "a434b942-06f4-405a-a6ff-c8cc492922ae", "comment": "Malware payload", "value": "446ef123946c6be741c2ef0a078c529de5d27a60", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485773, "uuid": "a8909849-b7b0-43b9-a584-d7651699bc27", "comment": "Malware payload", "value": "f9c7d0bac00d62051a53c119499b6843f1be1777b5635a4cfd30bcaea7d76b45af9f1a8bb405a8117d357100e5f35e77", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485773, "uuid": "8a8acf29-9a64-4c42-ac69-47e42808f43f", "value": "T19211B704E7EF1408F7DD2BF1A34D574B5FA4B25B242F414FBC2416105E9027D0A28E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485773, "uuid": "365774c0-c214-43d7-9562-2d46f0b0e55f", "value": "12:5j4ccJimWcX0NhuLkevkMKr+0wiSrGcLwd1I1fpcy7X2i4r2c/fILvMsJ/FjazX:94c4lYsL38SqcW1I1fpL7mLX05FGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675485773, "uuid": "27d78ab1-f775-4410-a62c-08e8ff5b8b97", "value": 938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675485773, "uuid": "a9d381d2-7abd-4671-85e5-d6504585389d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485773, "uuid": "0c573657-265c-43d5-bddd-b1aa913ae91e", "value": "d07130ad56d9f6b1917b49bf3ae19272384c9f41e0372d7b37a8360383768dbb.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feee00f3-a43d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675482169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675482169, "uuid": "baedd52e-b06f-4a4d-b2ed-e8c24e3f73fb", "comment": "Malware payload", "value": "586fe828570cedaa0ebd1eab18754f67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675482169, "uuid": "95f7e736-4d67-49c1-ba24-ec0f5704cb9e", "comment": "Malware payload", "value": "7e249ffb8db944b165e17ab86ced8c85112b691aa7bbd83f5795b31fe6efde19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675482169, "uuid": "9a539ebc-9566-4892-902e-2048a2ec0608", "comment": "Malware payload", "value": "89c09e2d9fe284a79a94b2f8886e5dc6b16dcd9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675482169, "uuid": "87f330ae-e1af-452f-a21b-93306a0bd3c2", "comment": "Malware payload", "value": "a4afbb8f3829c0f771b01b4bc85cd55d4951e90e782e832f747e1ccb8f9161a937ad62df8c897f79d75753b7567945fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675482169, "uuid": "9605d1be-fb0b-446f-9b6f-b3b6080a0739", "value": "T1AA76334472F4C1FED6E110B5BE9A7ED271B6D2900F04AAA387A46E2C7D3D4B4C45A339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675482169, "uuid": "bab07755-4fc5-4fdc-9f08-e1932a37cdf8", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675482169, "uuid": "a27c61cb-a003-4ca9-a25f-64de445c617c", "value": "196608:91ObHVM2/VDraexOFPNqE8E369JIS/vOgl8DdJ1OW7aKK:3ObvzxEt69JhvO+qJ117a/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675482169, "uuid": "164edd8b-35f5-497a-9c39-e69dd1a34a14", "value": 7625065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675482169, "uuid": "e7f9b32e-e415-44a3-bde8-1e7eac6d9882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675482169, "uuid": "ab0d0d2b-fadc-4ec4-8785-72f64e2356e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3171e790-a4d1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675545390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675545390, "uuid": "d53d83e7-a00d-4f02-8d21-91641c042341", "comment": "Malware payload", "value": "a9f8d43ef90db53a76e40448e47b7295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675545390, "uuid": "39a1c076-23ff-49a3-9575-b34ccff310ff", "comment": "Malware payload", "value": "7e4e31646e02175484cde11fafad1166ac9ca3735c07ee4623257698c155e0d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675545390, "uuid": "62a3067d-af84-4cc5-aff8-79185dd7cb75", "comment": "Malware payload", "value": "057bee69ce08a7f3ad6b33dfd499443a5463922e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675545390, "uuid": "5e7a1466-827a-4ddc-a74c-1107ec8ea152", "comment": "Malware payload", "value": "f25885398859108c2f7915dd1eda62be06f056d212716869ad69c2aae6e47e79166aa71301126d0fede3569c6c950e9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675545390, "uuid": "ff12ebd7-b750-4e82-bece-2ffc87932736", "value": "T127B5EF165C98E0ABE0C88FB0DCF76DFA5C54ECB9D0B4491791143EFB3A32E522C46669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675545390, "uuid": "50aeace9-3a57-485f-a216-bd00249a485f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675545390, "uuid": "822a232b-b85d-4b94-9ebf-6c578755b690", "value": "49152:d3ZtAgrV5cogxS7iB+NInk6DGamGLdPpLCgv2MR:XO+gzSY+qnHJNFv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675545390, "uuid": "5bb7379d-cd7b-4ebb-98de-658adfa9e63e", "value": 2318555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675545390, "uuid": "bff192c7-46fa-4a0e-bc29-fc4612629d6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675545390, "uuid": "8d33f27d-c211-49d7-bbfa-b526f3719b0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39f365d-a439-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675480378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675480378, "uuid": "cc728ec1-82b8-4c57-8b3d-c4199dafbbae", "comment": "Malware payload (Gafgyt)", "value": "9130254c72a0b70e31ebfd588f59bdcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675480378, "uuid": "63825287-f8b4-493a-9f8b-4bb26abe9b0e", "comment": "Malware payload (Gafgyt)", "value": "7f3cd9b2bacb776652c82b934d9c5f2ef522fc1d2a8aebd216ef47d9e65680f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675480378, "uuid": "be7974ad-3b66-4d22-b77b-558d4db56c62", "comment": "Malware payload (Gafgyt)", "value": "61fed0b371ebfa565fadf3cecf0cef575e66b281", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675480378, "uuid": "5762fe7a-9eab-455a-84f3-2b1987788867", "comment": "Malware payload (Gafgyt)", "value": "3fd4ba85b671145634895e4463dd26e919c4eeb8e40fd82f5af810659690440f6202fdc727154383b771c2b4c4799f17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675480378, "uuid": "e753a89b-75e1-42c1-a96d-4dfeba120502", "value": "T187C30944F901875BC3D327BAE78E438C77355E6857D733156A38BDB42BE1B982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675480378, "uuid": "7b8221df-696a-40a6-97d7-ded44abb8094", "value": "3072:7vqBNvuXzGZ8XIsRKsf3ohQSOUmyVUQuiXfQd6W:GDuG8YcKsf3ImyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675480378, "uuid": "e147b0e8-6673-4ed5-a367-11fbf11cc29b", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675480378, "uuid": "80068755-6705-47b2-b778-43837f6973dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675480378, "uuid": "aaf41be3-88ee-474b-a1a6-459b495ad965", "value": "dss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3571db5-a474-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675505745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505745, "uuid": "9ec2c1e6-36b2-454a-b3fc-d976d364f706", "comment": "Malware payload (Mirai)", "value": "51883505f9a5449a6180c63eef2138f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505745, "uuid": "b4bd8d89-c9af-4666-bf0d-ba27153119a5", "comment": "Malware payload (Mirai)", "value": "7fe3dfc83279dea4dcdb9dd5b6ef9b1a366df00022316d1fa3be4244f07a8922", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505745, "uuid": "241d91a6-603c-4e5f-b5f1-97701039239d", "comment": "Malware payload (Mirai)", "value": "48fe35f8376b0e19da80303388236491ea793898", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505745, "uuid": "9e3c08c6-53ef-4cd4-ba5f-67876812ac9d", "comment": "Malware payload (Mirai)", "value": "f8266e719d76b862a052fac64899ccf101de4206c3f533a9a1011d5cd5a2f8bfb7603337de701c2b21c251562a00fdd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505745, "uuid": "1981fe1a-6c46-4a26-b5f5-5335297e1191", "value": "T154731A86F9618917C5D416FBB56E50C8375A53BAE1EF3203FC210F147A8A94F0E33A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505745, "uuid": "6518ffb3-c20b-4573-ad11-e77bc2122a1c", "value": "768:mPzccZ4vx6q3I4+fF9rh317TlELjyP+IbDT/VerSoTKmANqxdKoTb6xGN2NDkxNC:ocO4vu9r55GGT/DAAqdjOdkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675505745, "uuid": "0a162554-5061-422c-8d1b-f5d620a6ab92", "value": 77008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675505745, "uuid": "b8ae80ba-bdcc-4570-bc28-3237f5a49cca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505745, "uuid": "c9d49d2e-b189-4257-affe-a54463b1241f", "value": "51883505f9a5449a6180c63eef2138f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa06230c-a482-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675511796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511796, "uuid": "01c9b74d-8316-411c-b534-27a969542bfb", "comment": "Malware payload (Gafgyt)", "value": "8d9af2bfde790267b4751f3cd0e71294", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511796, "uuid": "7dbfd215-6c1a-4e27-a541-b0b2f337f26e", "comment": "Malware payload (Gafgyt)", "value": "8141d0c3aefe6da1ac96f2e563e5ab7398e1c897782150521ce282a2681e0e09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511796, "uuid": "c5010b04-0cbd-4a37-9750-17c65721e505", "comment": "Malware payload (Gafgyt)", "value": "e6bfa8c410c59d2890b42b2edccdb517e5362bbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511796, "uuid": "cef2c720-58f2-4010-bddd-525141c76723", "comment": "Malware payload (Gafgyt)", "value": "5576584822366b6bc9ce93ea535cbf131ef14d99181ced00420002cf9047f0ecee55878039c2e360ca5e5202f9606827", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511796, "uuid": "ff272fed-0991-43f2-9181-f0893119c045", "value": "T195B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511796, "uuid": "2b3e69ed-772e-44d9-8796-9f599ae9d99c", "value": "3072:R/4tNF9U4vvXKw6J73x8UmkiSFxfKxbXe:BUNFK+X8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675511796, "uuid": "92138022-ad46-40fd-940a-deae8d86730c", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675511796, "uuid": "49bdb86f-2363-4a10-883c-80f986b25ac9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511796, "uuid": "74eed0e7-090b-44c1-b3a9-1f6f6c9933b0", "value": "8d9af2bfde790267b4751f3cd0e71294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b0eb73-a490-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675517506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675517506, "uuid": "fd6b1bfe-d438-47aa-93bc-6451f7dcb631", "comment": "Malware payload (RedLineStealer)", "value": "b34be158f2e9e03270012ac49a472f68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675517506, "uuid": "daa1ed70-d5de-4812-98ae-866c8264464f", "comment": "Malware payload (RedLineStealer)", "value": "8390f4631e557db48aac726a712df742343af5a547f01b87de444cc414133962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675517506, "uuid": "f364532c-b1d6-4fc2-8354-5c6e0fc5aaf3", "comment": "Malware payload (RedLineStealer)", "value": "9386ddbec5604b0f3866698601fd5d91c3ab729c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675517506, "uuid": "a30bf48e-bfce-49c8-8763-2538bd126306", "comment": "Malware payload (RedLineStealer)", "value": "e354ce70dba74a8756ebb5348765239273aebe8e22ea116a76dc989903142b0ec930d9a7f52dc48693e970a4e310219f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675517506, "uuid": "02869589-6e53-46a3-aa46-37f3f3cdd137", "value": "T1ABB41231F682D071C8AA05306865DA60AB7F2D7211758B9FF79907BE5F30AD06B37236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675517506, "uuid": "c77f36d2-ecbd-4031-8409-d6da393503c8", "value": "aea30aa8311fa7a3ea56995ee020184d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675517506, "uuid": "81279e67-9406-48bc-a1f6-d7f70549994d", "value": "6144:sf6LnZ4+J0ZkXmIWGPxbbG3ueOJ5DOGYLw8jwpZXWDpdkAlWbfxa6BS8DrAxZ7ap:sf6V4+2WhM3urDPYLw9GD/2daErop+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675517506, "uuid": "0523c92a-1a38-45c6-9a5d-50a219b10198", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675517506, "uuid": "7e3f65da-f115-41cf-98dc-d1cc705e6d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675517506, "uuid": "027dde06-f025-45a4-bbc0-12aab37884d3", "value": "SecuriteInfo.com.Heur.Mint.Zard.52.12865.3235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a76565-a44d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675488623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488623, "uuid": "b9826a3f-3ba5-4032-8180-aedef6997f57", "comment": "Malware payload (GCleaner)", "value": "d66a70d8eb9491183d27474982c96a30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488623, "uuid": "5f1a6227-cdc6-4598-9e8f-09049653b867", "comment": "Malware payload (GCleaner)", "value": "83ae1e9f79143939910bd2410f8d9756b475ca70d4d92eaedb5617ba853c9db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488623, "uuid": "4cfcdb5d-00a0-407e-a339-150cf7a3b7c2", "comment": "Malware payload (GCleaner)", "value": "68aa03f02d928871f3d772595a1cc4d744b80408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675488623, "uuid": "673cca35-4b31-4c2e-9d21-2b216d903aed", "comment": "Malware payload (GCleaner)", "value": "b6a50187f1135abfe8c3e49375c6458697db54c7882469534b3dbeb5fca14b8fa1a12e4d78bf9756c7126bf580553385", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488623, "uuid": "8ef0480d-50d0-445e-b6fc-6cca258d0de7", "value": "T153B5DE021D99E4ABE1C98FB0DCF71EFB4D50ED79C0B8591391047EFA3A32E522C46669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488623, "uuid": "16a60f34-930f-46fc-9047-f27bca157002", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488623, "uuid": "07bd0c5d-740f-46a0-ae69-263e23f0a596", "value": "49152:A2Z6wG/SZX2QxGQOAXeYaXTby8JJJ3QjwiLUN+LCgv2MR:NrcAXeYaDbNJFTo3v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675488623, "uuid": "4c9bd590-3c84-407c-b752-b83efe9df945", "value": 2320141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675488623, "uuid": "132d769e-e49d-40b5-8ffc-1f1397498d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675488623, "uuid": "340563cd-c864-4b6d-97d9-62f3c12c9915", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e57b16-a4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675546147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546147, "uuid": "eb2d372d-ad18-4892-b8d7-82232e87dcd3", "comment": "Malware payload (Mirai)", "value": "4cdf000378b2a830db3b7ded67aa9a17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546147, "uuid": "910ca289-34f7-4e58-957f-d4e708baef25", "comment": "Malware payload (Mirai)", "value": "8409acd2d640eb9bc18b9d5b6dacb1baf3bb55c0a90a1500ffc7d5047f18ad2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546147, "uuid": "a005c37c-9278-46cc-9f5f-954f2c180d70", "comment": "Malware payload (Mirai)", "value": "9042ca0d132a550ff0d0bb23a420e1d517b6987d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546147, "uuid": "2014bb3b-d3cb-4678-8c91-62c97c1262ee", "comment": "Malware payload (Mirai)", "value": "bf22755a4134aefa8c33fcc267cc17a036baf59f4f1dd31a961782491e8f355b87ce35cf27b92d39dabf059f3c67e5e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546147, "uuid": "35671795-e7fe-4b38-a94d-b0797d0a76b4", "value": "T13883D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546147, "uuid": "54b4a7b7-e0f6-4edd-bf77-5322cf3182bd", "value": "1536:iVLyh95Kolkj752dCexuV/8UZlDwfkJ4MYfWK:iVLybgfFezxu5VD1eL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546147, "uuid": "73dae956-8175-4e39-96b5-cebcbb0ee153", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546147, "uuid": "19cd0f47-1f46-4241-89aa-3a4dfb704645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546147, "uuid": "5a48c4e6-5ea2-49d5-8101-b0617824798a", "value": "4cdf000378b2a830db3b7ded67aa9a17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f306a2ee-a4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675553446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553446, "uuid": "59e76c10-6326-4f08-b16a-ec62372e73a5", "comment": "Malware payload", "value": "746a4c879ac597f6efcde77b49d261af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553446, "uuid": "8141d243-6c1a-44fc-aa35-81caa7b17c76", "comment": "Malware payload", "value": "853d470cb6c7a48e716a178ab202715abbd3972e04f4a580c3b335624c6e4062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553446, "uuid": "c111e02c-fa90-450c-98be-54d7cc160309", "comment": "Malware payload", "value": "054a7c5a2a09e42fdfa244ee10b6437f5ce18634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553446, "uuid": "54df2c4f-e3c9-4cb7-90e3-3baba05c803b", "comment": "Malware payload", "value": "a5734c760a6aff45178da65d6fd206bfc6b2709473446dc4d8290da4d110bbb648f250d31170e0bc8e13dd34d024480a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553446, "uuid": "c79102cd-adcf-4284-b656-c19e0a798a8e", "value": "T18984F13335C0C472C5AA51748C78EBA96BBEA43149748C473BAC16AD9F703D1967B38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553446, "uuid": "9d228997-ad43-4785-bf14-6087c5e7a6b8", "value": "9d027e1822da283963b2da86a5b0354e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553446, "uuid": "fc054945-f332-48e1-8e2c-f8d1bcf953a7", "value": "6144:4MfgiHLO/okooAC0L+QuuxjwgJ7hlCNJSVovOceL:4MfgiHi/okZdZRuxjpflC/SVeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675553446, "uuid": "7202630c-c8c9-437f-9316-1d43aa537802", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675553446, "uuid": "a523037b-c756-40b5-9a9a-103c608e7b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553446, "uuid": "22e04efa-e02f-43bd-980a-4d3ad0441a0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2621379-a45b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675494926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494926, "uuid": "dad70590-ed92-43eb-8627-0a029e4ea22d", "comment": "Malware payload (RedLineStealer)", "value": "910f6315d9c1d93fde70721c8c314209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494926, "uuid": "fb262bad-02a7-4030-9759-c2f4d306f05e", "comment": "Malware payload (RedLineStealer)", "value": "85b23d055ec1ed780b24ab997ebe9c42f6bd601d74443cf551553de74709299f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494926, "uuid": "9348ccb4-327c-4aed-9fed-b79a8db9cb0d", "comment": "Malware payload (RedLineStealer)", "value": "cf31bada86be3f197c7c3e2175b204a667bde206", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494926, "uuid": "0b7720e1-fa3c-4035-ba89-13ad8d41d2ef", "comment": "Malware payload (RedLineStealer)", "value": "1c64399e42c87c9a6702310f70ca9de3bf573bc4ab83ac9bcf0da1051193e486fa955a5bde1764e6d831f5e56d9423a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494926, "uuid": "5456506b-920b-464b-b5f4-2a5d29373b11", "value": "T1E90523233580C0B2D47A11769810EBB96FBDF73945B60643339E1BFE9FB07909A79246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494926, "uuid": "c7897368-c4d3-424f-ac42-7fd00c14aeff", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494926, "uuid": "cd21b989-1afc-4865-859a-a2293e556d61", "value": "12288:ttCaPRif5B5hvoI2C1/cBLskwqFQitL0eAuT3uEe1+TdqSgAnN436ZhbxFURCJgM:txAHw3C1kLwqhjwqhgAnN4qjt2CJgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494926, "uuid": "7dee12da-5445-4a94-bde5-54f7d22e8e03", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494926, "uuid": "8982cd1e-0152-4b1f-a88c-ffdd63b10b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494926, "uuid": "fa3077f0-2c73-4821-936a-2a35bf8c4b02", "value": "910f6315d9c1d93fde70721c8c314209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cad1af5-a4a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675527343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527343, "uuid": "4c5ced37-0be9-4936-8785-53085569faf5", "comment": "Malware payload (GCleaner)", "value": "1c7f1cd573fa8fef9bc4c87148bae3e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527343, "uuid": "cd78aa4b-5db8-4b8d-9757-8159bbadb92a", "comment": "Malware payload (GCleaner)", "value": "86c2f1d69d48924ccb724db2cbf491eb1bbc6ee56793c23152caf7f081a6c25a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527343, "uuid": "dac87ee7-69e0-4091-804b-926c81cee270", "comment": "Malware payload (GCleaner)", "value": "52b654eccddfe86ef2eb05453d352e6a724c4315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527343, "uuid": "2e6e2f1f-715f-4d50-bdb4-8639b86f33e8", "comment": "Malware payload (GCleaner)", "value": "da702c556d82578ad78206239863ea960fa132f4089357ff0774a36793ff1512f48e8a283d1e03abba4b7159d8218613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527343, "uuid": "ae118ddd-a108-4b67-ba25-e22626b2e9ff", "value": "T12FB5DE521C98E1ABE0C98FB1CCE36DFB0D11ED79C0B9581791453EFB3A36E426C46629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527343, "uuid": "2bc10833-b853-4481-9003-4f01afd7699e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527343, "uuid": "eabb726c-f455-41ed-a907-22f89b7c0849", "value": "49152:d3ZRyzhPy0Kow+MWKuZCpCYKGsGKazjP/snioXRMSLCgv2MR:X6pKFWKpBKG9KaX1/6v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675527343, "uuid": "3c4429dd-2f64-4c94-bd51-1ab26e615c52", "value": 2343050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675527343, "uuid": "a932f8b8-7a5f-4987-8e1f-3acae92eb2de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527343, "uuid": "416f5abc-fab9-4f14-8d8a-00cdbe0f3068", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85865ea3-a481-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675511171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511171, "uuid": "34920eb0-f629-44ed-a678-9ccd15165569", "comment": "Malware payload (GCleaner)", "value": "0de157d3c1950da0c509f00c136701e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511171, "uuid": "361c7bb5-fa40-44a8-b980-4d6dae6df59e", "comment": "Malware payload (GCleaner)", "value": "897fce21c1c165da68ff32555e3ada5dd2ce7cf2016d54b6627d35a5ca8426e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511171, "uuid": "b6c76fb3-c8be-4f0c-ab1c-8eeca754baca", "comment": "Malware payload (GCleaner)", "value": "2d4546e705e8803732f200a850f807195fc940a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511171, "uuid": "780ad764-3287-4145-b615-5cac1d9841e2", "comment": "Malware payload (GCleaner)", "value": "a84c37851a492f6bc182f72c8c5717f27fa8de3cf02949aaf07b3fe70d9e3cbd6acf855a45f033ad262a45633b2724fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511171, "uuid": "4e08353b-145e-413d-b892-744282e9b188", "value": "T15DB5DE465C98E16BE0D98FB0CCF35EFB4D11EDB9C0B8491791053EFB3A32A122D56629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511171, "uuid": "e7f4d24d-1f2d-4f18-a176-7262944ee84c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511171, "uuid": "b26f32c4-585f-4987-b569-260632b5713d", "value": "49152:d3ZhuGmsxUxzc+SBwxDoDIAqTAMIoKwhKGLCgv2MR:XhuGmDZc+SBwxg0AM2QK2v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675511171, "uuid": "1b2bb443-1b00-470a-8e42-44b48cbb9c4e", "value": 2328867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675511171, "uuid": "c2d2d742-1965-4792-9053-14b775481667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511171, "uuid": "6ccd3239-ee17-4b67-8dc2-d431df28258c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f62efe-a4c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675539973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539973, "uuid": "bbb9ec93-af25-4f2a-bb1e-a67dc8a3d585", "comment": "Malware payload (GCleaner)", "value": "3b1420530e17581f0c50c489f3a2f125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539973, "uuid": "a7c2709a-536d-45ca-95d4-2ca32806daf8", "comment": "Malware payload (GCleaner)", "value": "8aa188fbd5a35a4a39544c38c63ee6eefaf87a82b07e3763e894ed6bb63ca269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539973, "uuid": "364ee7f9-d029-4a58-b7eb-866efcdea06c", "comment": "Malware payload (GCleaner)", "value": "e7b1ebc6b5007bbdbcdce305b9103dcbf3199e23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539973, "uuid": "468c5b83-aa27-4e05-9b9e-c9f0b32c774c", "comment": "Malware payload (GCleaner)", "value": "0ee4313d54ec91769999cf79242b478296215b26aa9664d30a3ebab266a2b87cfaa2df090eedcf6f01051844a3abcff0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539973, "uuid": "f747b0e0-4179-4dc2-ad83-066ca5d90f66", "value": "T1A5B5DF465CA8E067E1D88FB0CDF36EFB5C11ECB9C0B4581791057EFB3A36A126C56628", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539973, "uuid": "467aaca4-7e68-4d7a-bd5b-0733b6df424c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539973, "uuid": "8988e3a2-8727-422d-86ca-123bb60fda69", "value": "49152:d3ZSLRAlhQbhjU3YKxIlcTKsOh1PIfw2rtvlLCgv2MR:XujyY3l2O3PUvrtvZv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675539973, "uuid": "9a69dd4e-51fb-40e1-9dc9-19ef38e41b7f", "value": 2353571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675539973, "uuid": "f266a138-3a32-4c44-beef-eb6fac84cdaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539973, "uuid": "53eca380-966a-4b94-a566-503a024d1624", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bdece8-a439-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675480348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675480348, "uuid": "a0b05700-21b6-4933-8b3f-e4e0793584e9", "comment": "Malware payload (Gafgyt)", "value": "8a990a35674bd96ab0b00b72553f2fcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675480348, "uuid": "6067d791-82ad-479b-b6ae-31376108d2df", "comment": "Malware payload (Gafgyt)", "value": "8ca22d18b2470436fb7322fdd28cb2c76c929459485a5e0cccc1da0f06b48d08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675480348, "uuid": "74a92569-b401-4fc7-896a-dc46d1046522", "comment": "Malware payload (Gafgyt)", "value": "2a8888f94cecb06955d4ea5116af57b291a5e68d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675480348, "uuid": "6fb92ef7-6578-48b2-8acf-1ac12e472516", "comment": "Malware payload (Gafgyt)", "value": "0b869e55c317c8ad77163589fd026a0c11313a719d85d7a88891d340bb40deb652000ce38c819569f9900184ad0c8222", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675480348, "uuid": "e5738841-9f34-47d9-afa4-44adede4f240", "value": "T18DB30913B7B1DABEC08352B12BDB96F19422FC7D0732622B33957DA41B398D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675480348, "uuid": "15454fb0-fd19-4081-84ef-8421779d10ee", "value": "3072:cd0wszgewzipy+8U4SNcqavFgmDk1c8xF6KjW:qo8x86gmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675480348, "uuid": "36fff776-0aab-4fe8-bc84-62a6dc24fcec", "value": 114793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675480348, "uuid": "a46c29dd-fbd2-4be7-92b2-be7f688542c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675480348, "uuid": "a7520fc1-bb78-4ad6-86ac-3e1d1b183e48", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6413b0-a432-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675477385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675477385, "uuid": "b17815a3-3549-43ea-bda0-cd3a3cee6bc4", "comment": "Malware payload", "value": "b278d6e0e46b9446f95bb74a8df404e9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675477385, "uuid": "fbae92e0-56f1-4126-aac0-dd3a2027094c", "comment": "Malware payload", "value": "8dd7be6559a7588298096b4f0848fa63984abf1f3be960c57f3f4d605874147a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675477385, "uuid": "1d863680-898c-4e20-abc0-ce1d69116844", "comment": "Malware payload", "value": "a24a9a749ae0f88199218059828290e243695542", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675477385, "uuid": "8d32736b-c4c9-4c39-b5b5-38791d94aa5e", "comment": "Malware payload", "value": "1c0b34b1238d774e664be3c44ebc3c11e2ac059a5bfea0b4230bba27a72491a398e0dde24514bd3cd750d83df884d89d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675477385, "uuid": "b6919c2b-4a0d-4709-b791-b2d71f73e0ba", "value": "T1F806DF96F758992FCC7344320DAA5235629B4DD68E83AB877844371C287B6D80F9DBCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675477385, "uuid": "bd098205-8bce-499e-b57c-d2749479e383", "value": "98304:jxiIXD8jEQXAsTbTWiOScvnT5YrKvf7i0rpl:9EEQQs/aRlYren", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675477385, "uuid": "e1368f01-4940-4710-8c6d-9a526f647bb7", "value": 3840257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675477385, "uuid": "d7bb7f6e-2089-4d30-96e3-9996a5471f6f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675477385, "uuid": "9f2b6971-cad3-43a2-ba9a-7554c16e1152", "value": ".apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6528551f-a46d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675502527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675502527, "uuid": "53c1ef04-284e-4d68-be9b-cc4c3dc7c33c", "comment": "Malware payload (RedLineStealer)", "value": "85f3d3d780112dcecaad57d890be460a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675502527, "uuid": "1fe0eb40-2a47-4317-af6a-6a24158dcfb5", "comment": "Malware payload (RedLineStealer)", "value": "8e2939be4a35e5f3ceab0342b20b0a7ab4415f8ab035ac47301ebec3f8caf8b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675502527, "uuid": "e34ffd8b-3b94-4f9b-9c71-79cdf087023d", "comment": "Malware payload (RedLineStealer)", "value": "d743725f17c81a0eb33af44d52a288b8133a4a53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675502527, "uuid": "27bf9046-88df-470b-bb49-7e96c95922e6", "comment": "Malware payload (RedLineStealer)", "value": "36411c7f345d9970be93a97313dfa0f5fcee191e00e3a55a9d56a9b0d73804f946c19bf8b7e1071ce853cb8ac24ef3fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675502527, "uuid": "51c53b26-a64a-497d-b520-4b4df592cdd8", "value": "T137D4122136A0C171C87A41314C64FBB17FBD69301EB599EB776C0AEE9F341D29A323A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675502527, "uuid": "4999c522-0fa0-4ba8-bbe1-9b8901709ca9", "value": "907f840d18fdf01b512ca68660ff51c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675502527, "uuid": "8118045e-947c-457e-96c9-522084fb1623", "value": "12288:WKdEMGaYbLuU4XeHLL8jCUd5e/mQJ5QjAWUmKFx7B:W8GUmX1UGOQYs57x7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675502527, "uuid": "c0e0e7a2-fd06-45cc-a86f-e4158d232f8a", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675502527, "uuid": "f3278729-53c1-445d-b029-2f710b75ab86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675502527, "uuid": "93cf01ff-b460-4c17-acf5-1c18074d67c4", "value": "85f3d3d780112dcecaad57d890be460a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dd2401-a4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675546124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546124, "uuid": "d8dab251-c4e5-4f52-a00c-b3d56c196c59", "comment": "Malware payload (Mirai)", "value": "ea96dfefb48ba87d38665328fa1f46b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546124, "uuid": "78c3c024-0176-48ae-a106-5ed6cf7128c0", "comment": "Malware payload (Mirai)", "value": "8e345deacb3fa39f4870e2e2724005cbcc73d41564f9ec081995e7cec03ae548", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546124, "uuid": "ee179864-2d35-43e5-9227-b964c3df2e22", "comment": "Malware payload (Mirai)", "value": "13ab003bd42c4bd29990ff3c9653871a74f683b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546124, "uuid": "c0125ec6-5080-47d9-868c-5d627462783a", "comment": "Malware payload (Mirai)", "value": "7c1a6801a59aa9465e59e625cec9eea3c6cd2b8a2b7358b2f95252c027276173804c6bdc5798963b3549f32a23c25b7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546124, "uuid": "063b525b-c75d-4313-8dff-0728fc321dbc", "value": "T1CD83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546124, "uuid": "1c84104b-6d8a-4d3b-b392-76e576eacfb1", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2zIwHKRH0I84EH6UTpB7ZDYovZ73x/nL8y8y:Rakdn2Eo3egu5GTpBRYo99Be037WO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546124, "uuid": "05e086f1-67e2-4715-ab94-f4040562fde8", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546124, "uuid": "b3388575-8d8f-4b7d-9305-10a06e050b29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546124, "uuid": "a2f74382-5ddd-4108-9408-b9c28bd7844b", "value": "ea96dfefb48ba87d38665328fa1f46b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedf137d-a4c8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675541788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675541788, "uuid": "6e22a73b-4d2d-423b-9252-92dbc179ef86", "comment": "Malware payload", "value": "8b6483cdf9f44ed4dbda543559a0efdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675541788, "uuid": "04e94a0a-b934-423d-ba2b-664d356aaa5e", "comment": "Malware payload", "value": "8e3fac5baf21230845a8a182b10b7ff23cbb651d58377119d053f98ded161d47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675541788, "uuid": "d2c62eb6-af55-4f7d-bd5a-daf19970fd7b", "comment": "Malware payload", "value": "2f57e44347b33389244da448b7907044f770095b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675541788, "uuid": "efb9c1cb-5598-47f5-ac9e-d5aef64450be", "comment": "Malware payload", "value": "ab2ee340c3b5326605c08237217aba88049be4dcf651ad81f08a5c92425bdf75d6d85d82a775701762aff935fd9b7307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675541788, "uuid": "333c2a67-7d02-4c82-88ce-c7a6f9a3ad02", "value": "T12CB5DE025CA9E0A7E0C98F70CDF35DFB1C11EDB9C0B9481791143EFA3A32E526D96669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675541788, "uuid": "f35ead74-f73b-492c-ac5a-f1a3a1f6fcf7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675541788, "uuid": "3b04057c-8e54-4966-a614-afca465b3d51", "value": "49152:d3ZVeoy/rBoiQRXzgHWRAuHC7UafA01UNp4GfLCgv2MR:Xsoyj3QJzgHJt7DI4ev2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675541788, "uuid": "8007c9a8-f5f4-495b-9a73-ac1ffe2bbbf2", "value": 2305921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675541788, "uuid": "e564f476-6330-43c0-a054-87832d2cf924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675541788, "uuid": "613ec0ca-44a0-4d1b-a82b-83f2640e0b73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d744cae3-a4cc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675543521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675543521, "uuid": "fe5ed02b-af51-45ef-a6b7-7e2448bff6fe", "comment": "Malware payload", "value": "266ddf9413c3bf15368a1e1eec22db22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675543521, "uuid": "dd1a9a9e-1a49-4117-987a-0d853d10bbc0", "comment": "Malware payload", "value": "8e4c9df672a4ceef6d42e95bc711c164ca7d5254cd7d3ca03b526d9400f29c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675543521, "uuid": "7083cd97-df8f-4ad4-a4f5-098db65ac4c2", "comment": "Malware payload", "value": "0b06ce46301d39d653ceb1320fbace09d92276c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675543521, "uuid": "53a68311-6bce-4d0c-a8df-b2f05949dfec", "comment": "Malware payload", "value": "2e445e4188d103c0eadaede0a187409e1f8d0c456c3f78eea7b9ca3bdbe272bd358e6ccf990b3d3950d57c7035466203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675543521, "uuid": "6d7388a3-59f9-4d86-9251-996fa7f2cbd4", "value": "T1F1B5DF165CA4E56BE1C94F70CCE36EFB5C15EC79C4B8481791043EFB3A32E522C96629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675543521, "uuid": "aa742f0c-9bc2-4337-940a-acffefad4da1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675543521, "uuid": "65e02faf-7556-4e99-baa2-bbc25d6c9516", "value": "49152:d3ZDq9Ini7hTLvzc/Ija40XmqW0cYQthKod4Kj7LCgv2MR:X29nhv7aXmq0Koxvv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675543521, "uuid": "a4f2e6be-1ac3-4c07-9b77-b05f2ab29721", "value": 2276190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675543521, "uuid": "f8f97565-d004-4f92-8a28-e3824d941093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675543521, "uuid": "a11709e2-bf60-4f98-914d-b6756797f09d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7935b7a9-a4bd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675536920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536920, "uuid": "980bac09-c1dd-4729-88fb-071721534bf1", "comment": "Malware payload", "value": "771f78eec820f0d6c6a160ad99cbe9c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536920, "uuid": "47bf840b-d62f-4e0f-8a8a-e2768fcc0459", "comment": "Malware payload", "value": "8e4ce102a531d540a1f643396d6ddfc0da9acc963ca995bcba9d07909ebb58e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536920, "uuid": "a68844e1-5dc8-403c-ba55-6e8a4c1dd621", "comment": "Malware payload", "value": "3808c4f9e5f6515d941cf5bb1e310cab44382d6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536920, "uuid": "8cc7af39-fa9c-4c0e-b4b0-30d4234efd9b", "comment": "Malware payload", "value": "9c1c275f61c4c60678621fa307031f85a175f029055f8e22ea7e7edb8d037be7b9cf9cc913741f748e85839c76480c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536920, "uuid": "f646ab1a-b74b-493a-99e3-750392644d94", "value": "T1210733A11B5849D7D9E8A13FCC4FC81C11A4ED121794D6CF92B9A31E5F33292AE37E90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536920, "uuid": "65332fda-6130-4081-84c0-8fccafbc3584", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536920, "uuid": "5850ec8e-e773-4558-b445-5de6c3520c7c", "value": "393216:hxAlndYX5fT6K4/m3pFFqyoBgsSzUG9TRx7:MldYX5fWK4Ky1HGRRx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675536920, "uuid": "7f14cc81-e57d-4688-acab-507550016da3", "value": 17142635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675536920, "uuid": "c2c8db95-8889-450e-880c-aaca6609f43b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536920, "uuid": "53188e5f-f9da-445c-9e19-4f55236ffc29", "value": "luna_new.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9da9fd-a494-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675519290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519290, "uuid": "1a316143-6854-4756-ac11-1187d4495803", "comment": "Malware payload (RedLineStealer)", "value": "8ab33151e80b4ad72c40b7648434c133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519290, "uuid": "f8660937-ad43-4f95-8789-1bb85b06ec2f", "comment": "Malware payload (RedLineStealer)", "value": "8e504b23e591de2e63cb5da50be2ac23bc761cee7c5cf482db4b51abdba99b70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519290, "uuid": "9380b4c7-8aaa-4f4d-9edb-243bf5b9445e", "comment": "Malware payload (RedLineStealer)", "value": "8de0556537068cc2b76800d40a23d5cc7659ba97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519290, "uuid": "bcb9414a-8149-4339-89d3-01aee3b13bef", "comment": "Malware payload (RedLineStealer)", "value": "1cecdb5b55815df4b31ffe6f4f9ee3d9f168b391e0efca55dc1899882ff94e60f11d1b667ad5e54981e4f168b05c9405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519290, "uuid": "80ddb212-65f8-4e01-a942-85b88f96bf95", "value": "T1265401323190C0B2C5AB11305C68EBB5BBBDB53259758C3B77591BEA9F302D1963A31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519290, "uuid": "70ab7c93-73cc-4d17-b293-04638954c49f", "value": "be7581a01c1ad2f53e81adb31665eb55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519290, "uuid": "ab29986c-091b-4a46-81fe-286b0086f52d", "value": "3072:kiprcj7uPLOzYw4WbZ5GPw8nvudyq7JMCj7tR7yzWRADX6slNJZOIVHHV3lZEWe:kiptLkh4nPln2dF2Cj7tISGBTZ9dEWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675519290, "uuid": "961ac294-5dfc-466d-bf78-c4e53634965c", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675519290, "uuid": "082c6500-3271-45f6-8764-3b3c234b50fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519290, "uuid": "8d165660-758c-4e23-bd9f-0e69f599ebde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe7720a-a4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675528925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675528925, "uuid": "4024a551-cbf6-4dae-b6ec-a1c6cb497f7c", "comment": "Malware payload", "value": "f55eb4dcb854ca07539f3138d5ac20cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675528925, "uuid": "1c324c57-bc44-46e4-a2fa-73782b24a75e", "comment": "Malware payload", "value": "8e9a83af5087a9ca2d86ec0f0f18859fdca7aa12ff4561a10b90342e34aa9776", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675528925, "uuid": "dd123264-9f11-49e8-a3ae-782bb49a80bb", "comment": "Malware payload", "value": "8d3012db66eb53b407031b3a3047c5b53183efe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675528925, "uuid": "98787255-a66a-467f-8d5b-18f043126c1e", "comment": "Malware payload", "value": "e0b24f8539885e99202c9aaa303b426ffcd4219832185ec36648d1458e3c2333662ed56c3fb1ed57da2fc3a528876d1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675528925, "uuid": "24a1a807-3c13-4f92-896d-790f0147adf4", "value": "T141036B3378E0C072C27351709C54A5A6BB7B6A2153B5DC276F280579AF31AE1933B39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675528925, "uuid": "1c5a2e97-0c92-45a9-9e8d-fba2d92eb6b2", "value": "768:kqYB1sfZK+iNtsfByhu/7iVXchIXgLdJV5O3hAbzI/F:ETIZQt0T9TLbV5shT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675528925, "uuid": "b0d7a488-8e3e-4fde-a459-ec0bece51970", "value": 40616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675528925, "uuid": "9d5d901f-47a9-4802-a53c-0f328003dbb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675528925, "uuid": "d982decf-ae14-44d6-91b4-e5f10bfc5900", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bea369-a4b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675533611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533611, "uuid": "30134b27-8f16-4226-b904-59fd681ef7c7", "comment": "Malware payload (GCleaner)", "value": "5441daca0d28d6eda01b210bf0ea6f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533611, "uuid": "a155a2fb-f6be-456e-a489-f4bc3efaba62", "comment": "Malware payload (GCleaner)", "value": "8fd252a96657e5cc2cf702778aa5e4b2385a3f0d10f342a41caa2ed335ca5fc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533611, "uuid": "97da12e2-0f53-4684-94aa-a3b1755edcc4", "comment": "Malware payload (GCleaner)", "value": "b51dfeaccf362d94f560e99183c98914fe8b7a3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533611, "uuid": "2c1a7102-7ff3-44f1-b96c-93dc3a4ffe60", "comment": "Malware payload (GCleaner)", "value": "9df2517dfe697d096b007571f3aad487f7013c19b035893440ef1be0a5b070c39bcdfbdad0c9b07ab185d74e03eba2a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533611, "uuid": "d2b01940-2bb4-4655-a98f-cd77049650f1", "value": "T169B5DF124C98E5A7E1C98F70C8F72EFB5C50EDB9C0B8581791047EFB3A32E522C56669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533611, "uuid": "961df014-a770-4c71-985c-535df1667902", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533611, "uuid": "55c81df8-5ff8-4754-8eb2-28802738c22c", "value": "49152:d3ZLVuye5cdCIfP1aaOpQ/BDaFSX+yRPwB4e0LEsLCgv2MR:XLVuyIcdCU9aaOpQJDo4e0LLv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675533611, "uuid": "cf6983cd-bc4b-4cf2-9bdf-12ed4473d291", "value": 2292147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675533611, "uuid": "b17a969f-66b5-49cf-bff6-a3f90699263a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533611, "uuid": "5563e35f-68c0-471f-bcfd-4919b5374fd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f55028f-a494-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675519241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519241, "uuid": "90e16760-ecf6-4d9b-b265-9d22915a76e8", "comment": "Malware payload (GCleaner)", "value": "9d3422b7c24afac1ffdd63499d78eda4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519241, "uuid": "ed7fea04-9fe6-414b-b8cb-f5af47d12b49", "comment": "Malware payload (GCleaner)", "value": "9010e28289c18e4bf177652d019d9da9b07064a347ac1e04d66374d12bae6793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519241, "uuid": "d419aab8-634f-4d3c-9795-39c0886c9870", "comment": "Malware payload (GCleaner)", "value": "a994217caa4e9106007837bc7594a42ef5ff988c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519241, "uuid": "145e813d-f82a-47f7-8cdd-5f7eb42c0d6a", "comment": "Malware payload (GCleaner)", "value": "c455fcc28d09bdce68f90171cf5018275f27fb1af0a71207352ce3e512e6dee403683d762efe79eb476e3bb71760a2bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519241, "uuid": "58073f83-4a22-4f81-afa4-f49b9ccfa2dd", "value": "T185B5DF025CA8E1ABE1C54FB0D9F36DFB0C14ED78C4B9591792043EFB3A36E522C46669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519241, "uuid": "088f70dc-c72c-4028-811b-203e9ff5d32a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519241, "uuid": "f474a8a9-50c8-4935-b802-7ab5c4c5116e", "value": "49152:d3Z6xtvmMECsV8xKCfC9GAMRsyXbdEgkAFNoeR0o4miI6CbMzLCgv2MR:XMt+MEtMfLRrbCd8SeR34vMI3v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675519241, "uuid": "0bbfa8e3-a698-4fd1-b059-10a4a7f551e3", "value": 2342709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675519241, "uuid": "ed0f1847-3182-439c-bb6b-9617bde5e6b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519241, "uuid": "8351cd45-67a3-42f8-baee-542e0e1a00ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd776ed-a4bd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675536851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536851, "uuid": "6f929233-dac6-4b6f-8eb9-4f17525306a9", "comment": "Malware payload", "value": "6147afcb98efab7f0621a910a843878c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536851, "uuid": "22690b85-6176-4ffa-87cd-8a22e51f1785", "comment": "Malware payload", "value": "924ec909e74a1d973d607e3ba1105a17e4337bd9a1c59ed5f9d3b4c25478fe11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536851, "uuid": "2626ffd4-9310-41f5-a547-e6544dedf9af", "comment": "Malware payload", "value": "f8acf9e686b49d20a61aaf33da3d3ae72abebced", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675536851, "uuid": "1d917adf-87d2-4c8e-825f-8eb94b3fe6f3", "comment": "Malware payload", "value": "f0a253d8e6800f187e50ee3fc3679c1a40f4111444fb6e7ce13c50fbe61324f288a6b95bad3462d725dd23208370f6c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536851, "uuid": "7f4d9605-503a-4f84-8119-84d55126b295", "value": "T16E341800F54ECBE9DA9343BC4916A602FEFB318067548AE7D7885A310E075C579BDFA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536851, "uuid": "29bf8dc4-f7a9-48bf-9f44-9005ad64f9a7", "value": "cf173f5b43e2dd8a6a3952081c406e61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536851, "uuid": "11992d0e-e605-432c-81b2-4b8abf413187", "value": "3072:ZO459Ejzjz10wKaEcKBIacm6QBDOmkm9wXcIfGBF5UgbB67rMx3zti:T8HzKxhcKB0VQBLk7XcIkbkoti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675536851, "uuid": "4e3ef52e-5d06-4631-b153-0355505b3d0b", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675536851, "uuid": "7aa6939d-6821-4845-b95f-d67c4f918627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675536851, "uuid": "bf61ccac-7cda-4f3a-8f89-72bd843934f2", "value": "924ec909e74a1d973d607e3ba1105a17e4337bd9a1c59ed5f9d3b4c25478fe11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e020c4ae-a482-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675511753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511753, "uuid": "918e2644-ced4-4b40-b940-357ba86c8a19", "comment": "Malware payload (Gafgyt)", "value": "a88fc033f99df8a07af8afc0ce830908", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511753, "uuid": "3ca19325-8848-45db-bc51-3ddb2b15d517", "comment": "Malware payload (Gafgyt)", "value": "92c76fbd7b9affe55dcb92b205d42ed78a70da172d42883138ce342859e2ca5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511753, "uuid": "0b5713c0-a3dc-496c-8307-d078c4260d60", "comment": "Malware payload (Gafgyt)", "value": "62e12b560014f0c736a42c5d3ed7406782ec3ff4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511753, "uuid": "1d17b9e1-a9c0-4d2e-8810-e5ca795938da", "comment": "Malware payload (Gafgyt)", "value": "b1effe984c80a8a2529bd2d4e4667e30be299b75a573f745d762a5f32ad6bc705ff275aabbef6e4da4302f2817ede02b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511753, "uuid": "7d9b999c-c13d-4bc9-b613-7f5b19343d66", "value": "T178734A47AD628FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511753, "uuid": "6fb5e3a4-abcb-4405-a453-52a1a4d57041", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/Cz3yzTN7mj9VqYLe8f26e:v+eefvyoWWF/A3Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675511753, "uuid": "bb7fadaa-6079-4766-b5bc-3aa17eead2b1", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675511753, "uuid": "e89c8f42-733b-4348-b8db-37c90f824724", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511753, "uuid": "ec9fa157-496a-4237-ad8a-ba79f276a5db", "value": "a88fc033f99df8a07af8afc0ce830908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4350201c-a45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675494310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494310, "uuid": "e65a47c8-18af-4baf-bb23-0f1c3dbcbd1a", "comment": "Malware payload (Amadey)", "value": "fd02bf0f245e164419efd8783fd5e536", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494310, "uuid": "1331775a-9aa1-4556-97f4-d50e74f2bd44", "comment": "Malware payload (Amadey)", "value": "9304facbca381b53fba6af1758e913f9ff1cf1a3ac4b1ab0c5909c47b414a1a5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494310, "uuid": "d1b0be48-6de7-448d-bb4d-825e85b8c37a", "comment": "Malware payload (Amadey)", "value": "e3efc6c4a901833b1564ffd04c0ddf9e250538cc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494310, "uuid": "62d09236-b455-4496-900a-2e7e75e58976", "comment": "Malware payload (Amadey)", "value": "b3b87366c8f66eed1edb8e724afc0980d93f0fe4ae3f6a427a34da49b5a5513fe98714f19f1b75bb483b7a8989e6ccd7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494310, "uuid": "a5626376-205b-4942-a617-b03bfb05bed0", "value": "T10E14DF323680C371C16E62305864DBB57B7DB9314675D92BBBA80BBE5F703C0563A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494310, "uuid": "746705ed-0717-4cff-97c5-2e3c8cca26f1", "value": "99cebe82e9a09163c3069dbc31af6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494310, "uuid": "074fc540-96c9-4f1f-a69a-27108a6da0de", "value": "3072:rmbjRjJULXxj6oWa65Zs0w1/dVOp9WSiVoGjm5VXSg2qX:rmULhuoEs1FQpjiVBm5nJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494310, "uuid": "fe4ddc29-1670-43a0-88d5-f34db36b0c5d", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494310, "uuid": "07d1360b-8094-4ae1-b42a-9b00408cb4ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494310, "uuid": "6992b0d3-18a6-41c2-84cc-c5c27368b0fc", "value": "fd02bf0f245e164419efd8783fd5e536.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12abff32-a4e4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675553499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553499, "uuid": "2f6924b0-23a6-4a59-bf97-1be75644921e", "comment": "Malware payload", "value": "2e2dc96a481a57495083003da6ce371b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553499, "uuid": "d0acd4df-0f34-4741-958c-f3898311644f", "comment": "Malware payload", "value": "931fc67dd057247c3a8e2cb76ce3526e62f37711e5e537bc3df42b4768b0180b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553499, "uuid": "048cc1fa-e36d-4cba-8d24-461d8a0f8e99", "comment": "Malware payload", "value": "76a04fbcafe95a0c3ead1f5e3897a6de1a06cacd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553499, "uuid": "d5edd074-c7a5-492d-a835-73e677ab4473", "comment": "Malware payload", "value": "7e463d5f2e838d3dca51e2dcd025564c652eb67465ff6c115562d4748d7a4ea9ff989baad1333af1d7eecb4ee9b283a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553499, "uuid": "426036fe-2d3d-49de-9f9c-7f2f5b06e4bc", "value": "T186A5DE465DA8E06BE1C98FB0CCF36DFB5D11ED79C0B8081791443EFA3A36E522C46669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553499, "uuid": "f1796828-e092-46dd-a862-b012c859c575", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553499, "uuid": "2b44561b-71b5-4052-a664-9e3546ee8847", "value": "49152:d3Zbr/ZyYI7w2VEg0cjsydQCfajm2ZKWd3t2E0OFELCgv2MR:Xbr/ZNww26gLdlUmWnVuv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675553499, "uuid": "132fd27c-689a-41bc-afb3-141310b976cf", "value": 2267655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675553499, "uuid": "6d2c933b-2106-4170-82d0-0d5361b7c17d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553499, "uuid": "3e4fa94d-6f8f-4357-a2d1-329cb8fde343", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f2399a-a48b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675515651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675515651, "uuid": "bbcc8454-a953-47a7-b4ce-694db6975b9d", "comment": "Malware payload (GCleaner)", "value": "4ae56300180e9a10d75b1ca197451715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675515651, "uuid": "32fe0de7-b527-4262-98ff-de9c5ca5c8e4", "comment": "Malware payload (GCleaner)", "value": "94a1295a1a4278b01b955c60cca6dbcc61737d0e2eddf7841b7f4b531aaf1cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675515651, "uuid": "fdb22152-f790-4e6f-97a9-02297d78323b", "comment": "Malware payload (GCleaner)", "value": "253a0eccf76396de6ee02804847389391d5e52ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675515651, "uuid": "dbda90be-b2d5-4834-955f-32035d4e0e31", "comment": "Malware payload (GCleaner)", "value": "facd6beac9038d977325039bfa5ed34bf4b3a0ba6e7a727287dd53276847467b1161ea0330edfc22eb2ac78dba410031", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675515651, "uuid": "71f2d205-2b44-4870-b2e1-f0c6a014be42", "value": "T151B5DF525C98D167E1C58FB0CDF36EFB6D10ECB9C0B4482791493EFA3A72E122C56629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675515651, "uuid": "7a9960e0-26d4-4a31-b24f-763fcaa01b18", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675515651, "uuid": "5662e818-3c6f-4916-be92-3fd6f944d415", "value": "49152:d3ZQQLBvQi8UPzrWEGO3vEgDTlBrvssSwPRl/Uf1SxGxbMUVpXZ5LCgv2MR:XjhiULrWEGovBBrEiRl/UtSsxjvv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675515651, "uuid": "42d9c465-aa63-44d2-a5ba-8d4b59aeec1d", "value": 2269477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675515651, "uuid": "eb5ca55e-eb21-4e41-8f95-08838fc94aff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675515651, "uuid": "e259e3ce-3bd1-4d07-a613-29d50c621225", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2649d9b-a49a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675522091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522091, "uuid": "09fc5ef8-f738-470f-b19f-73f75469f8d2", "comment": "Malware payload (Rhadamanthys)", "value": "982e4ae4559538cfb529dfaff0507880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522091, "uuid": "1365b93b-2575-4707-942d-785dfb7aa19d", "comment": "Malware payload (Rhadamanthys)", "value": "95a08f9fd8741d2b265a43143289af012ca24cee776609bc79337d63988246fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522091, "uuid": "3d46b5d9-ed56-4907-b1e6-4d1f88b1b8dc", "comment": "Malware payload (Rhadamanthys)", "value": "a3b0e3989d6e40792134286e40448004ebeda077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522091, "uuid": "e9c65643-c15a-46a3-97e9-691b779ccc91", "comment": "Malware payload (Rhadamanthys)", "value": "a83412bd6f687eb5b39e4b7819abb87d9263a33877e402d13b5baa3aca0f67bfba667e0f5585b826e78280131a6c4b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522091, "uuid": "bff8eb77-f271-44f8-8697-71a873da0f96", "value": "T131921059A47BC406C063DE762CDD96B7CB59D8F2350C723B0298A32BBF817648D47AB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522091, "uuid": "6e3dee0e-24de-421b-aedc-658259869bb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522091, "uuid": "22485a5f-cb90-49c1-b1ee-f9ef07bf3d66", "value": "384:/LVHmcPXblyCKGK9dnORWsK7PPZzcuIYZKJHtZW39cDpbJO:/hHHPbICKJEW7PPeQKy6db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675522091, "uuid": "d7259a3c-c085-407d-a0dc-afea83fca8b5", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675522091, "uuid": "94761b3d-740d-4d7d-bf08-7f8eee076bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522091, "uuid": "b76be672-c1dc-42de-842d-1af46e975e85", "value": "FortLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca87aff5-a49a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675522024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522024, "uuid": "788b27d0-38ac-4ff3-aed9-14f7b23344d4", "comment": "Malware payload", "value": "b549451167f712fef1aa7f8a9ee0b3ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522024, "uuid": "ceea07c3-137f-4d38-8466-5cbbd8811cb8", "comment": "Malware payload", "value": "96174568ff77362f086033f6767cabda2a34a2fb7e34f8fed4299a2f2bdf1e25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522024, "uuid": "710a020a-c7bc-4d55-a254-2ee96f1094b2", "comment": "Malware payload", "value": "3f35ea8e09f67d97819bf12023110a5d0ff2fce5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522024, "uuid": "d60e296f-e247-4660-aadc-f23b9d1b7ead", "comment": "Malware payload", "value": "eb09d5658d04f87222ee99ee1a7ff77722e640e182ce2cde4e4ca90648ecb3d32e90f7c0e9c7d6840d76fe148ba5d93a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522024, "uuid": "876cee93-7d23-4f93-af98-9e674162491f", "value": "T16A76337032FAC5FFD5870431AD092FE9C5EDE6980F520A93A7099E3D94391C9543BAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522024, "uuid": "d80baf20-763c-41c0-9e60-b28472c8ecff", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522024, "uuid": "fda0e3b1-9576-4d72-a3ee-43098c281b08", "value": "98304:91OA8jk6KtWUnyryUZmDJSVwhqX4qzxuPKLtmClVMRm5Y2sMGCPm3a+cSwxowIr4:91OAWkmUy+UmDlk4qduPKoC2QmKoIx24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675522024, "uuid": "e9338d43-3ead-43ce-ae8d-eac9221766bf", "value": 7626736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675522024, "uuid": "955ccfea-889f-4e58-ba95-b596cd65ff4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522024, "uuid": "53628b05-00d3-4b8e-9596-b5cac0a74bc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed0ab9e-a482-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675511804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511804, "uuid": "77c5ce4b-42bc-4e5a-97e8-2f1f857d4eb3", "comment": "Malware payload (Gafgyt)", "value": "4a2e2308f14c3c94d1c95eb07f13bf66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511804, "uuid": "a2b82469-6f2f-4460-905f-420a030f9d90", "comment": "Malware payload (Gafgyt)", "value": "9654ad191e4a4e64cc1a7cf85d6d7dc92791962ffb59a500c81d44857908f1fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511804, "uuid": "fb9e8cd1-3b45-4511-87fc-630e251bdfdd", "comment": "Malware payload (Gafgyt)", "value": "e1694e7821a7a121edbd2b786ca1d0a330e46e91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511804, "uuid": "639845f6-ff64-4c4b-abe0-a747bb155a36", "comment": "Malware payload (Gafgyt)", "value": "98c54ecb5ed743f8e279a6cb37e20e5a99cfa0a3bff0511b72cc0f16a5a4d66910a9ff72f54f72338f605af6933b535e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511804, "uuid": "af750f6c-b429-4e76-9ae0-7f80f02494f2", "value": "T1F2E32A09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC27995E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511804, "uuid": "c5281fe0-df59-421d-8f41-d15ee7da6e5b", "value": "3072:fuNaNpF4uVN++dkhnxEQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnqQennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675511804, "uuid": "1a9c8cb9-7046-4a0f-9d7a-eb8331e777e3", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675511804, "uuid": "cc501930-7ad2-4634-818f-96970535180c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511804, "uuid": "6a742e04-aa3c-4916-aae7-c8a29ece9292", "value": "4a2e2308f14c3c94d1c95eb07f13bf66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3c5543-a4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675526591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675526591, "uuid": "4e493bf6-8553-4687-87de-2276825413c9", "comment": "Malware payload", "value": "69d6a232c37f2f8cea8e6f334bb9089a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675526591, "uuid": "ac8862d7-ec68-4f5c-94d6-48d6c6233a91", "comment": "Malware payload", "value": "967f01dcdec47eb742f5efeb2fe43b97e79dfb6a01c5450d29fc4a9259705331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675526591, "uuid": "10d11d6b-ac6e-44bd-baee-f8f5081e48bb", "comment": "Malware payload", "value": "077f5ebad7e18b6e62615cbc82d7754a39d7aad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675526591, "uuid": "be1fe3d8-00f4-4baa-b6b7-27ff7c12fa60", "comment": "Malware payload", "value": "3e2c1354aa26eaccb453a40f81cf5c9e9f200a44984141edc646fd6ec2275e7c0a03156d5d7782ac543cfc743c4d75aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675526591, "uuid": "28e9a7e6-e41c-409e-ae76-98bc03c4853b", "value": "T1167633213CE3483BD800957CAD646DDB9099A1A50F2489676398CE762F7CF76B406FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675526591, "uuid": "4b6a0f24-2f85-47c9-aad5-8589d9367318", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675526591, "uuid": "3a2ed519-07d2-456d-8e68-0e7ea69f614f", "value": "196608:91Oy1GIJ8Nrr4AErIG4EDR+B49X1hAsCg9dSMP4it:3OyN2N4jUGx9+WNCgrSM5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675526591, "uuid": "5c183fde-6cec-476a-99be-9d3bf07ff800", "value": 7604243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675526591, "uuid": "92b1bb6b-a371-4db2-a738-2a0c2fd72c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675526591, "uuid": "3a14dc39-4876-4ee1-baa7-a0263856930d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406a67a5-a432-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675477125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675477125, "uuid": "259f39cc-597f-4606-9a60-fc1b73590b61", "comment": "Malware payload (AgentTesla)", "value": "3d69e90beabb8da1b4d0d75731d2af1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675477125, "uuid": "65ae12de-1cb0-4f17-96bf-d2ced35b0768", "comment": "Malware payload (AgentTesla)", "value": "96c4ff43a964578b8d6e88df75059042c2c7fb55ffafb416c797c36324fd459d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675477125, "uuid": "3cfceb26-ff65-47b2-97e0-6b8f0e22f481", "comment": "Malware payload (AgentTesla)", "value": "6ee5dd6ee090a7f2f7affced709925aed5e926e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675477125, "uuid": "fb61b234-6bf5-4168-be25-6d4de2b02ad1", "comment": "Malware payload (AgentTesla)", "value": "2ce6be8cbb6658e184108fd790c155db657f17e8940fcfcea9dddd53a9430213de8a1995a1b33a33e0b52a57525b3fa8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675477125, "uuid": "076dade4-4b89-4b96-8414-fbc9e7b83842", "value": "T16BE413D6C329CEFAC7C9027F2274004C6B313AAEF5A5D709125F6629C48F3125A766DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675477125, "uuid": "f3408a6e-aedf-4c0e-a152-694542f21b7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675477125, "uuid": "7d8f1f17-3b8e-4210-9026-e9a832d9ef43", "value": "12288:tkBSTU8XiRwWc5s4HOKv5WObO/yoYALERWeh3ih9H1A:tAIiA5s/KvZhoYXBYTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675477125, "uuid": "7c535b78-021a-4747-a670-f8cd65b43bc3", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675477125, "uuid": "80843a06-5d66-48b0-99dd-0f5500c19ea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675477125, "uuid": "50ab8fff-8396-47ea-857a-03778a4fd0a0", "value": "Tender QUOTATION _LH22000309AA2022_PDF____.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0ece31-a4de-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675551048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675551048, "uuid": "9da38d97-95b0-489b-8f7c-a0d87b878e73", "comment": "Malware payload", "value": "d7888d43e420750e20340645b33a4786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675551048, "uuid": "d3cbb5b8-0dc0-4669-91d0-35c9075a35fb", "comment": "Malware payload", "value": "97a768dde6127b1e497a924f0683f8807754a68b0260a76ebd171f04e839a607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675551048, "uuid": "b4fde6ff-b135-465d-9f89-2f74db691635", "comment": "Malware payload", "value": "4a7c59e0205e9bb078aa0dc8fb6adbedd6bb4bc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675551048, "uuid": "91a5bb10-367c-4bdb-a08f-502dab2154b9", "comment": "Malware payload", "value": "3066d4a36dd8bbc45d1c436932e9e7f0f2aaed80e1fd9b57796651eec0ab358d2462f59fe6c6ffa15e7f4bad3bbe4f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675551048, "uuid": "dce20dde-9c42-40f7-817d-bdfda16b8136", "value": "T1C314D0313790C072C46B18314C24FAA46BBEB93156F5DA97B7681BAD8F312D1633A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675551048, "uuid": "d4f12c05-3965-45be-bde9-9a06f0edf143", "value": "9d027e1822da283963b2da86a5b0354e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675551048, "uuid": "551cafcc-62ec-4cdf-9b6e-166914cdfd0b", "value": "3072:IQmORhbL8kDL8uHWNr53z/uZoHK7V2HRSPi6+q6gHQE4nEmc:IQmklDLpH6zeoHK7V2xSP756gwRnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675551048, "uuid": "122fc0e8-2e5d-4791-9c75-2fa07e70a451", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675551048, "uuid": "e683442e-e668-49fb-9730-e988e6f1510c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675551048, "uuid": "6dc67d0d-7a1f-4fed-b201-f6b5c004ae49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247b33fb-a4ca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675542362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542362, "uuid": "d2696e18-bf43-452a-9072-ebc7b62e2009", "comment": "Malware payload", "value": "6c73f0f2cf552ee27cc85c723427ffc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542362, "uuid": "8be8fdad-a64f-4f73-a415-138d6bf60d3b", "comment": "Malware payload", "value": "97eaa27d2a1a91deff8b99aed65e4ef6e060f07dd84a8f874008c2ad9db39523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542362, "uuid": "5f25745a-146e-4e50-bd55-7cec7c841e3b", "comment": "Malware payload", "value": "9a791362cadb8d664c6db5be0861e8b71502e446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542362, "uuid": "12467b14-0ba2-4dc0-9e3f-182e220c8fad", "comment": "Malware payload", "value": "f38a8e97824adffbd177602832a61ca51c137bbd9ba8663064fb010484273af648c4930aee68abd3d3467875cb9b23c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542362, "uuid": "50667a77-c309-47ea-a328-157e8eef321b", "value": "T1D514DF3231D0C072C4AA55345C24EAA16B7EF8327779DD477BA80BAE8F702D29676347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542362, "uuid": "3c741b21-f0db-4c17-9670-ea2498051fc5", "value": "847f96cdadc895b3547edbb7a505a62a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542362, "uuid": "a5cd044c-3f70-43f8-bf2f-3ceebaa6e5b2", "value": "3072:mpjBoVHcxC/LVC9ffhWsCdLZ5792n4q7r4L3ovxD8COEDfsP+:mp6xqWLo9nhVeTtyK3gQCjDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675542362, "uuid": "f7e6fbd7-e072-4b63-863c-9074950910d9", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675542362, "uuid": "59c22318-eab3-4549-8854-7ca58b1d784f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542362, "uuid": "d05e74e6-4ca9-4b4e-b2e0-ba23293dd970", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8154c6-a4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675546084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546084, "uuid": "fa235ec3-ee4b-40c8-bfe8-d017c12a10a0", "comment": "Malware payload (Mirai)", "value": "b983d809cf4e126ea74f74946d1c697f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546084, "uuid": "f565becd-bd28-4437-bf63-6b38dd097d84", "comment": "Malware payload (Mirai)", "value": "984d7ecc5d7cb8d13a20015464c2b5b6dee2b7ff4eacf563098a64d56a614377", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546084, "uuid": "cd1be694-535f-4eac-a744-59ddb839be45", "comment": "Malware payload (Mirai)", "value": "0777051a4da9365d4aed4cae9f53edd827e9a9b5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546084, "uuid": "d52b6ae0-87cd-45de-a5c1-b00a9c7a1ffd", "comment": "Malware payload (Mirai)", "value": "9215e463832f0cca6419b74724c0a27d8ca143fb05ca3f7bee1ec6379b812584141f8db66b3ebef0c7e631ed869aba57", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546084, "uuid": "5f19ec85-2465-43ca-8fc7-9170b9999de0", "value": "T1CA534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546084, "uuid": "1d830614-4b8c-44ce-867c-cd028cab26c5", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/NDiQOLiKimfFoktCe3fYRMN:WShU3q7cEDlCK/ND29i8Fok06fYRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546084, "uuid": "a0a42c89-fdcf-4fe8-a4d2-fbc32011f400", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546084, "uuid": "96c82f85-d336-4f38-b7f5-a082144434bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546084, "uuid": "bc992807-d0e1-4c04-b512-ad4c24f404be", "value": "b983d809cf4e126ea74f74946d1c697f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3a5021-a4d3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675546299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546299, "uuid": "8355e738-d9a9-4ee1-b7da-b3c8eaa7cd49", "comment": "Malware payload", "value": "8fedec6f46daf2c894e3ecc2dbbebbaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546299, "uuid": "520a691c-8ec7-4f02-a2d1-ea707867435a", "comment": "Malware payload", "value": "98b338db8e45e180cdc512c6dc83128354d3a6f64f5da8d538963dcc9c6a2342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546299, "uuid": "10ad2330-3608-40bc-a053-081865d64f3f", "comment": "Malware payload", "value": "365ffc9767d3e9818353d0091aff3e145cc769d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546299, "uuid": "8b346dac-226c-4b21-828a-e1ffe916296f", "comment": "Malware payload", "value": "f8e4a2921d29f8cf675cc3c54ca19a69278b7ffce52e75b7b411462a6457966c7baaac2740e294bb6bd1ff83a0cd8d48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546299, "uuid": "fd20521b-4037-4f69-a846-6239ce4ff80a", "value": "T10C84F1323AD0C072C16A613448A4D790677EE8E157749A5B7BE807FE9FB07D0933639A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546299, "uuid": "fd6521dc-6c9e-4d92-9633-51b11a4cada8", "value": "9d027e1822da283963b2da86a5b0354e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546299, "uuid": "47c64e71-819b-444c-bc6d-63a45a3f1eeb", "value": "6144:mtEYbQLbm+Oyaw15OQhuYw2e0fKUrhGoq2gGbIfdKchsPhN:mtEYbQPmRglV1f3YHdKcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546299, "uuid": "c6deeee6-3790-41f6-b0e1-eae68e50727d", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546299, "uuid": "ff5503d4-f747-45de-9b45-13f81866315a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546299, "uuid": "137a7f28-b815-43ab-b443-7aa7b02d13e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2906a2b9-a49a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675521753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521753, "uuid": "ca139eb3-56e2-4531-bd62-8d59271ce50e", "comment": "Malware payload (Smoke Loader)", "value": "bdaf15e3a3aadaabfbe3f409f68adac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521753, "uuid": "c273aaae-46e8-4478-a207-f64ae640f362", "comment": "Malware payload (Smoke Loader)", "value": "9a1389ebd25cdb7a22c716f6ab3fcb7c9e23a3de85ecc19439ba5333bc5c073a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521753, "uuid": "f0e4b5f2-97d0-4d48-9f4e-6dced17378c2", "comment": "Malware payload (Smoke Loader)", "value": "e8c2668c0897b57cc94ef958f447cd7b12c82b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521753, "uuid": "e45cf624-3bb4-451a-845c-501b0349c34c", "comment": "Malware payload (Smoke Loader)", "value": "ed2c317866896c2617794eeeb1886a3e52dce522a595857bd269e85726fdbd8fe3200f837ac993f6ebe790c309489080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521753, "uuid": "e050bbfe-88dd-448e-8862-27b1d3df29bb", "value": "T19C156C07C25F4B8EEA152BB409272915FFA98A799F7A6BCE94CF40E5305D3F00A650D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521753, "uuid": "ddb031cf-62ad-4142-bc7c-12f680d29191", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521753, "uuid": "8b5e4835-8520-4b8f-a3ab-400a5fe6d980", "value": "12288:pzPdI363gz6+34pnTRqkJJv3cJFrlfbxeHlvrBVUulgy7rrss5Qlsx80Irzbc4pT:fIK3Q3IRjJEHSttWL4csn/QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675521753, "uuid": "39d4c65f-2ba0-4bf3-a14c-5135a8c22568", "value": 929184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675521753, "uuid": "95f72aec-6083-48d8-a4aa-a11b87f157fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521753, "uuid": "81299cb9-b335-4af8-a8be-0f47c2637f44", "value": "Paralysis Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2e974f-a482-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675511743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511743, "uuid": "9e1079d9-b55e-4ac5-91e5-8dbbacca4b65", "comment": "Malware payload (Gafgyt)", "value": "955e0c3a9861704f2db44df13c749b2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511743, "uuid": "9db8f336-f5a8-40ba-8e8e-1e147081f46b", "comment": "Malware payload (Gafgyt)", "value": "9b5dab17b04d7464e55ec39a6c0903a118fa720ec829764aec9bd5750f22f68a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511743, "uuid": "e7a111db-3414-4a81-ba47-dfa79ebbd833", "comment": "Malware payload (Gafgyt)", "value": "09ced3789a9d38a594fcac37ad5a53a37bc3cdbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511743, "uuid": "bb8db825-0867-4c9d-9e93-5fbf907b684e", "comment": "Malware payload (Gafgyt)", "value": "61aabfe8e769f671f605bb778cafb9a2324d544f7c4a0c96015615099081d5ced582a23007a15c864370d143f88be16f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511743, "uuid": "ede41b99-5210-458b-af74-224d9a55b4bd", "value": "T10F930892B900DFB6F40ED77A04D34724B670FBA24E532672731779A6AE322D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511743, "uuid": "ce4aa756-2b28-4b83-997a-d86c51840e55", "value": "1536:4wZTvNTV8V9eEG8ktQmzn5h8Jn9/QT60ydwg/T2fDhXTmQ9VqXjewf2Le:BjT49m8KT8RQT60ydwe+RmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675511743, "uuid": "fe67e1d2-4126-416f-bc2b-c57478658e97", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675511743, "uuid": "7b8d5b16-4d07-4001-844a-d623ead9778c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511743, "uuid": "f96a8a3f-6da7-46f6-a9aa-638ace848cda", "value": "955e0c3a9861704f2db44df13c749b2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1863b179-a464-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675498533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675498533, "uuid": "3c95cd23-b3bf-4c33-b1be-2dcffeddda68", "comment": "Malware payload (njrat)", "value": "ba00bfba9ed3e725de6fa5b02c948e38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675498533, "uuid": "7a3304a6-aef4-4880-a471-cf61be238c8d", "comment": "Malware payload (njrat)", "value": "9ef98978c58f868120a005829543bc81136492ac2a53033767b01e8d44b6bb05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675498533, "uuid": "f5f281fc-c0c9-41af-87f9-3e21764386b1", "comment": "Malware payload (njrat)", "value": "ff6c4fa84ed44b488e7d2acc9802f6b092ca4f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675498533, "uuid": "01900002-177f-40fb-bf77-8491108ce531", "comment": "Malware payload (njrat)", "value": "f8aa3f47cfd0d735d52313367c5d0962bf7f28718620650e855c9e8d8c4103025b01e255235900ab11991db4943d5212", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675498533, "uuid": "9e9b94ec-7fa4-473c-a6c4-d08b244e2ce0", "value": "T1D795010536496E07E25575B4C9CFEAA807F1ACCCFEF2F2646B89730C1E21765899138A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675498533, "uuid": "c2b5890b-f122-4874-88bd-7463b9613790", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675498533, "uuid": "6770c87a-cc4a-47c1-bad2-afea78a7c1bd", "value": "49152:EuiPZi3333m3333333333TjgYbAgoPBy:Euix5jgYb5oPBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675498533, "uuid": "12ecf01a-d295-4787-bd7e-ab43ed7e5d94", "value": 1926144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675498533, "uuid": "455909da-64fa-46ba-9e2a-859df1e70ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675498533, "uuid": "1d8ecc99-b8e1-42f5-af49-a5fe013e98ef", "value": "HEUR-Backdoor.MSIL.Bladabindi.gen-9ef98978c58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8d1212-a4c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675538454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675538454, "uuid": "7f83daee-b3b6-4b78-853c-4d15390507fd", "comment": "Malware payload (Smoke Loader)", "value": "a9047c06acdeee9a216cd0f6ae58e279", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675538454, "uuid": "aec7a1ab-627c-45e4-80c6-29652087e34f", "comment": "Malware payload (Smoke Loader)", "value": "a09028f47b1df79e4161e3f065f48f9efb2f68ed84881c6a93a64cd857c4cb02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675538454, "uuid": "7591ba9d-c9e7-4090-a83f-5539af3b76a4", "comment": "Malware payload (Smoke Loader)", "value": "3277a44f322bac15fc0cef1baf07b2e424f99b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675538454, "uuid": "4a8f979e-39a4-4d55-afaf-24f653784a6d", "comment": "Malware payload (Smoke Loader)", "value": "92a2090cea8e86d6a28fbfbc1ea36b7e919e768967cf3d084505dcb1888b73ed34269141c279f8979d54c5bc33021124", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675538454, "uuid": "5b9ddbfc-de53-4d0a-bd0e-9c3d2ef94b48", "value": "T18314D0B23AD0C032C57A15305C64E7A0ABBEB4305676895BFB681BBD5F2D2D16736307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675538454, "uuid": "2fdc2317-db77-40d7-a33f-98aa68e766e4", "value": "847f96cdadc895b3547edbb7a505a62a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675538454, "uuid": "5e946b66-b4c4-4c3f-a733-67ba5aa95ab7", "value": "3072:igZM6j5neLS89aoWih5hNMwi35NqYU0RJaDSitxee71oQ7qog:igreLjAovGwip3U0faGi7eEhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675538454, "uuid": "c0abb9ce-801d-4828-bbbb-0fd8b2320cf3", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675538454, "uuid": "3c75946b-62ed-44dd-95d1-07d90c3b05a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675538454, "uuid": "279ddf57-50e7-44c6-bd73-1a24a9fec703", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0736ea2-a49c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675522920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522920, "uuid": "ce148d7f-8f66-49c2-b98d-0f4d08eebf37", "comment": "Malware payload (RedLineStealer)", "value": "afe8f71beee2e5678e9edd11bf33a61b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522920, "uuid": "68039482-a1bf-4190-82c1-78362d1f4a4e", "comment": "Malware payload (RedLineStealer)", "value": "a0eb22ecb0d5658c82d19d67df932896149bc9a5156f11e1605612ffd373d516", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522920, "uuid": "e5d6ea11-edfc-458a-b359-d2970ce1f2a3", "comment": "Malware payload (RedLineStealer)", "value": "efef6dba6cd8a3dfed3585f955bfb0666ef6df65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522920, "uuid": "b071746b-bf0a-4637-8d5b-3e52fe5ee1f7", "comment": "Malware payload (RedLineStealer)", "value": "35848dc773a97ae57ced97904118c39d74cfaae6b17f163b69fc4d2425062f93a6fe8128ee9aa19b7de9e99be9493db3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522920, "uuid": "e1b8b7c8-43ea-4af4-ae6a-e79b4218753b", "value": "T19E84F1333AC0C072C7AA15305861EEA47B3DA93096369D4777A907AD9F707D0977A38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522920, "uuid": "0d613556-39cb-4cc0-be5f-27f85b3b7517", "value": "be7581a01c1ad2f53e81adb31665eb55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522920, "uuid": "49674f76-a86c-422b-84d6-2df6fad4266b", "value": "6144:z8ZTwp5L0yutewDIWaL3q0x74dDmhjn/3HwHVu7LkoeGQRYF:AZTko9tfi3hz/3woA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675522920, "uuid": "4e7a1bd3-9c99-4a49-8e69-f9f56ba59cac", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675522920, "uuid": "edd24798-2291-41f0-b2af-a1fb564c7073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522920, "uuid": "5693a81f-6f35-40b1-b14c-7345db6245a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876d75ef-a4db-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675549829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675549829, "uuid": "b4a52865-92dc-47c6-828d-dd1a57ee855f", "comment": "Malware payload", "value": "c62b2aaada0a93fc22b195b4fe213254", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675549829, "uuid": "9606cf60-ee30-43d7-a8ef-2cd71c56d217", "comment": "Malware payload", "value": "a2224d02026b17afced0929449070dc642ca5682b7993dd892aa56ff1dec45c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675549829, "uuid": "d1f1641d-f621-4f2a-b997-d732bd3279c9", "comment": "Malware payload", "value": "03bf8674a064bd3d7ddb69adb83f883d7d26a7a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675549829, "uuid": "da880383-3dc1-43ab-9235-5de24e47aafd", "comment": "Malware payload", "value": "9a4c8164f237f082e6764d5ad4c410028bf89001b462dae686af68fbfe727727480a2691ea3b0c8895fb5d74661855a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675549829, "uuid": "5283c87b-95b5-488b-b043-e904b66f7544", "value": "T15584F1323790C033C5AB55309920EAA52BFEF56497B0C9D777A817AA8F303C15736396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675549829, "uuid": "f3dd1855-1ba1-4c67-963e-e35adc6e53f1", "value": "9d027e1822da283963b2da86a5b0354e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675549829, "uuid": "af276570-b764-4844-bfdb-0e55ea49f114", "value": "6144:9MMFjb4LvEJ3K40ahX303rhAlTOwQhp4dD5kL+hAH4:9MMdb4LEMeK3ralvUAKHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675549829, "uuid": "5227755c-f91b-4d93-90aa-097960ff5e23", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675549829, "uuid": "f0e9dd0f-9a26-4d7b-b2a4-54320f68667e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675549829, "uuid": "1eb07c9a-7b69-40a1-a127-f8ad4b7114c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c75371-a4a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675525553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675525553, "uuid": "fee4a25e-c22c-4cd1-a2b7-a57c2ec566f3", "comment": "Malware payload (GCleaner)", "value": "a0a246d833754299daac9992ee2c5b35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675525553, "uuid": "59486229-b5c4-4e5f-828c-81c519511066", "comment": "Malware payload (GCleaner)", "value": "a232d928b4814d7eea6a91cdd82b192c8440a51c1303c86dd135321b98abfffd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675525553, "uuid": "6dc6ef0c-e880-416b-a9da-0f6a382936fe", "comment": "Malware payload (GCleaner)", "value": "c9597c76d7e25a06e4096a2817345ca08b99cc58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675525553, "uuid": "3529d833-dcfc-4cf1-a27a-39daf73737cc", "comment": "Malware payload (GCleaner)", "value": "5e20a0a854ef73449348550edbdd5fc71edd34856b98caaf10c423872a4ccdb58b1837d18b224ca1a6d9ca9e1933d747", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675525553, "uuid": "bdcaa89f-009b-425a-ac42-f3fa804fb812", "value": "T1B4B5EF121C98E167E1C58F70CCE36DFB4D12ED79D0B8481792087EFB3A36E526D46A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675525553, "uuid": "8834f2f5-1842-4edf-9831-189dd8d30f3c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675525553, "uuid": "8dd2e7ec-64ff-43e3-98d1-fdc6aca7bbf7", "value": "24576:d3n3Jll3UrsQqg1gehAUAi0qXiUHfhQIP41NP7jZaL/3lW2AQfhBiEtmwWWQZNIc:d3ZD3qxqwAi0gW9Z+uLZiuYPELCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675525553, "uuid": "b76e5361-e385-4e92-80a9-a0bd0c082661", "value": 2341109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675525553, "uuid": "74a9a5dd-a282-46c7-807f-262972620232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675525553, "uuid": "7b39d523-150a-49a8-9207-69aaa4204e45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03897402-a483-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675511812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511812, "uuid": "3d28a260-8bd3-4bca-ae55-16e8380c3fba", "comment": "Malware payload (Gafgyt)", "value": "d477f981511d1cb243e7c3097f167367", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511812, "uuid": "979e332d-2706-45ea-953b-3bc622fad645", "comment": "Malware payload (Gafgyt)", "value": "a47ec2bbca84194ffc0f9acb222e95a00874733a6ee708bd36136b233b49250e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511812, "uuid": "9936ef40-9501-49a6-b5c2-8eb091bf53b6", "comment": "Malware payload (Gafgyt)", "value": "6ff7b331ff2a1f008ad047f3a96c981ed8f24c9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511812, "uuid": "e407f7ef-fbe2-43b2-be13-bcf3ae937e37", "comment": "Malware payload (Gafgyt)", "value": "9f7ed4e3aa1ef7ce6f205b2c91c88ebf542defb4a967e3d1ef3020042053b52f5b2516bd9d8139c1d846e145fade9556", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511812, "uuid": "82ad568d-2200-496a-a9d9-2a4d4e783aaa", "value": "T152733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F55F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511812, "uuid": "84061a0d-02a2-4956-ba9a-918a45d689de", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzM0MmLI2VOCjXUfJRk:45omr0xKFn6J+OPMmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675511812, "uuid": "bfdb38cc-ed8c-427f-9faf-0ce57c2e0051", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675511812, "uuid": "48bf6ee3-599c-430d-9b44-87aa34686541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511812, "uuid": "9fe8cf25-d800-4128-b9fd-0bd77282ff50", "value": "d477f981511d1cb243e7c3097f167367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1246665-a4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675546114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546114, "uuid": "b99d878b-69b5-453e-9783-cbcc35282f86", "comment": "Malware payload (Mirai)", "value": "b7c05d8a5e67880c44a0f33e18396d51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546114, "uuid": "4fe30424-8918-4db1-9a9e-5a2cb49297c3", "comment": "Malware payload (Mirai)", "value": "a4b0e1d0fffee702071120548500ac586e4a5f84ec9503cabebb3e0914a96da0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546114, "uuid": "71d109d6-41ae-4ad7-ae0f-1331949d3b99", "comment": "Malware payload (Mirai)", "value": "0cc6f9985c30f3bf850b956e959b148463945b53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546114, "uuid": "0f247ba8-f0ef-4dae-9a8b-c23b9bfb117a", "comment": "Malware payload (Mirai)", "value": "7c23f714e54c8e8baaa433050473dc18b1f9ba53305f4ad36b932c1ce738a5a94b96a3654e7a722ba8129a6621cab231", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546114, "uuid": "f4c03ca4-31c7-4c20-909b-f6d0181977ae", "value": "T18E03F751BC829A67C2E1137AB6AE4A8D332063E8D2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546114, "uuid": "15562c31-f54e-4d6c-a0e6-54cc84b8a648", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0a7rDUXoTt/NYwW:svbUG5fPlUlDf4Sycv+nU6jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546114, "uuid": "915cdea1-f324-43a2-847a-e32fc919b777", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546114, "uuid": "4254b095-537a-428f-a9ce-7a2595e7299a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546114, "uuid": "45a6ce16-d6ec-45ed-81be-e9e1da112864", "value": "b7c05d8a5e67880c44a0f33e18396d51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb90f559-a435-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675478620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675478620, "uuid": "cf733720-ce79-4b7c-a6bf-b6bf2fa2d1ee", "comment": "Malware payload (GuLoader)", "value": "91c0c4710db096a4689d40e2ceb3814d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675478620, "uuid": "03b467f5-92f7-41f7-b4df-95f1fd2d5a11", "comment": "Malware payload (GuLoader)", "value": "a4d4961d124ea4276512c1584f1ebd30951cd469659b3a623594d6361772fae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675478620, "uuid": "d7a42c4a-2edb-4998-a773-4c04d3703211", "comment": "Malware payload (GuLoader)", "value": "63880c602b960c5f91e55cbe4d5d18c7b8f1d63a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675478620, "uuid": "cce8f6b8-44d1-4df1-b25a-17d76f46fb2b", "comment": "Malware payload (GuLoader)", "value": "384457ceb3d5b8951d63270e26123038ab752fe653e5d0edbb55b14932a5bc3b919f069ae7b79a2067ecd6beaaeb638a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675478620, "uuid": "7acc086b-3fe1-4c04-a03d-9636b646d900", "value": "T1C6741208B548D9A7C9630932ED628AF67ABDDE613BB1A70733006F7C7D312618F45365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675478620, "uuid": "0937e651-62bc-4518-9636-0c631315927c", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675478620, "uuid": "67658235-c23f-4860-a296-a8aa0d6fcc22", "value": "6144:twq3NpWyFr7S0HFwnNHF6pmK2DIuua9ma+T4cX+tTMZP3qtTaPwkYn5inpT4:tzayFfDwNg4RE864c4MZ/c2UinS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675478620, "uuid": "7e33c45f-55ca-4d2b-9dff-6c5c464fd562", "value": 348136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675478620, "uuid": "4465c988-23fa-4de7-b875-524b950befd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675478620, "uuid": "a06cfff7-8383-44e6-b6a0-c0850edb8fde", "value": "DPR602859651100125001V1100125154830E 3-2-2023\u00b7pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9dc8ce4-a440-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675483368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483368, "uuid": "eafb2168-c1b2-44db-ae98-797e81e67653", "comment": "Malware payload", "value": "9baad723ef510f618ec2d48d485d87ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483368, "uuid": "7e72f933-8ec2-4105-afdf-5936be94561f", "comment": "Malware payload", "value": "a62771deeb32372a8bde1ea920bf6566d3212a853d7bccecac0ae86645777045", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483368, "uuid": "e94449a0-6493-4249-9b34-eeb380f58d4e", "comment": "Malware payload", "value": "2fab4c2a78181565cc2a10aa238319447050d3e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483368, "uuid": "59ba7df0-17d1-46c1-9c76-dd23370b861b", "comment": "Malware payload", "value": "2be4fe624e667973a07377d5076543f557caba54f8ec03f71a93d2f7fba35876e0b43b60cc9392d1bd614b0450c5bc2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483368, "uuid": "624d39d4-9fe7-4006-8f01-341636cec3e1", "value": "T1E97633B5BAEC5EB2C44909321D52CEFE69EBA0107D34580F2FAE4E2D1C7D6C4B192B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483368, "uuid": "b64b27d5-7f24-4ff0-97ad-c87d19eb3ee2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483368, "uuid": "ae1569f9-8360-4295-a93a-111958812d3b", "value": "196608:91OYUlpUH+7aiNVHU9qRuzg094Yp1PmSgSCt0fKe:3OrqSaiNVH3Rucm4OR9gBt0fKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675483368, "uuid": "341601d1-b3ca-4621-811c-0500c596151a", "value": 7623439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675483368, "uuid": "8c13d555-1bba-4ead-927f-5c26d6809fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483368, "uuid": "50aa5fca-8f07-47f0-8655-992157dfbdd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c78a79-a4d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675548586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548586, "uuid": "4d609435-f22e-469f-89e4-9f237a7248f8", "comment": "Malware payload", "value": "e57bab886b8c4c253d7e15eea4633288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548586, "uuid": "ea92ca62-cead-4003-9f74-dc6de9d4853e", "comment": "Malware payload", "value": "a69eb315a4814f172caad6c278e4b40a961a7b8252bd3d1b6e6471bf919df11b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548586, "uuid": "33df43b7-9404-4819-89df-2e1c12a42bcc", "comment": "Malware payload", "value": "12970f8d3af2405eca8092b0a0c6927852215a34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548586, "uuid": "b44a7f54-656f-48a4-bf5e-19711649f725", "comment": "Malware payload", "value": "fac05a489a18fae97a5d71206a2b120e6cd70fd0a5e7bfb25bcbd7f5d99d4cc81e43a03af9667ab9a8a1affe5b19a19f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548586, "uuid": "5156d43d-a616-471d-bc19-0619970005e2", "value": "T17E76333371E44CF7E7C07030C95B1FA6D6EA975A1B22842F5BC89A086DB9D9BC23C651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548586, "uuid": "f89daa44-9c90-4f1f-94bc-0044a6321f8c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548586, "uuid": "b9332f52-661d-4c59-b735-b6b889d3466b", "value": "98304:91OEuLpLFDhLSufVpIC2F1KPK5xneb+ldozXvljEegTsUtlB0iK7XQM/UFXDwnZv:91O5lLjzVpdsYKXeb+OfG0vzgWL9Rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675548586, "uuid": "1473e035-18c1-498b-bc6c-d6ac12ebdddf", "value": 7637501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675548586, "uuid": "8b7cb302-cac2-4f30-b08a-18e2ac049735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548586, "uuid": "44dae46b-a518-4682-a786-36893c567489", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94218022-a4ca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675542549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542549, "uuid": "0156c0ae-6dfc-4ad6-8106-6ab2eea8fd58", "comment": "Malware payload", "value": "27246e9d0ff6b1af16da94b4451fa398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542549, "uuid": "9c3148fe-e3a0-43b6-815f-14693a50eb4e", "comment": "Malware payload", "value": "a6bd9b1d5d8b0272267c81c0d15d869ad022b4cab31ae3965a7627bedceb9dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542549, "uuid": "5621f3b8-aa76-4491-a9bf-6e299cf497a0", "comment": "Malware payload", "value": "add9664ccafd1f108671e481271baf40313e98a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542549, "uuid": "6c8d8b03-b251-4479-8868-0b1f68670ccb", "comment": "Malware payload", "value": "9b9d260ba41cebb4e417ed46b76abdd989b2150d22099f8a3f4e5bcfcfd63cb1402c076fa097e751889d6333df417008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542549, "uuid": "e37e81c4-ede8-4767-9024-e237f4ad45a1", "value": "T138763311B3C21EF7D46228722D19ED70E0FEDD688E730C17BFA5431A4EBC4A5A951B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542549, "uuid": "61b8405d-6bd9-42c0-9099-84d9483eeab0", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542549, "uuid": "4463025a-ab0d-42f1-9f9c-9a9c25bdad58", "value": "98304:91OYiiZkNV/sFj8QoQ9WYeAerJQhvE3HZt/XRhmMuzXI9FEOffukg/P7kUTyPorL:91OYuNNsFLHycE3DBhf9C14oyAPwjhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675542549, "uuid": "f909ead2-1e82-42c3-90cd-18bf98ecb651", "value": 7588029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675542549, "uuid": "176048b7-478a-4d68-8c58-2e7df3c80286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542549, "uuid": "2b182945-40ef-4741-87c8-8437627fc8a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22e2fb6-a447-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675486308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486308, "uuid": "43c4432d-3d76-47ff-b2f0-0f0c5b624b84", "comment": "Malware payload", "value": "4a00098f2f95e07b337e7912da8a2f79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486308, "uuid": "9f7be38d-a62f-4466-b71d-4340594f3f99", "comment": "Malware payload", "value": "a7e4055f492823ade6b7bd6a9db7370ab8f356a9ec5d97cb9391d7e465f08e7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486308, "uuid": "084dca8c-6752-453b-89ff-128d8131f525", "comment": "Malware payload", "value": "e90072fa72eeed52516b8075d465b79129cb4bda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486308, "uuid": "ec2779dc-7c7f-406e-a6fd-c1c751cd8abc", "comment": "Malware payload", "value": "92455d727b4a0dafcd33924b548283b95fbd5d2177461764a3f000fffcc35a141a31110a9baf6115e79868beb8f1255a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486308, "uuid": "b693d682-c767-4577-a50b-430b57b6c7e9", "value": "T1AAE633E1136849E6EEEA613FDC5FC40AA465FC061398E98F436565191E33B123C3BFA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486308, "uuid": "dabd62f6-0a2b-478a-af43-220437bdda72", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486308, "uuid": "897016f6-7749-4fe0-bf5c-54038375caa5", "value": "196608:Gq/lOqPupb7KX/x1HhyehNJm3AqdKDnO8NpkSgsAGKaR2xbi9mEypG+A/pCV:QqPuYXJBb/m3pgDOEkSgsv8uQB9uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675486308, "uuid": "9932ba62-d8a3-45d8-b62c-6ab8d72ca73e", "value": 14551912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675486308, "uuid": "9024aad6-eaf0-4064-b84e-84f5cf783da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486308, "uuid": "75800631-17ff-466c-ad42-df96ba2dc4c0", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be46519-a4d8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675548521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548521, "uuid": "0605d176-1888-4660-a03d-5f00fce07f7c", "comment": "Malware payload", "value": "4e1bbbe21b1f7b12d5a8d09dee8d19f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548521, "uuid": "fe86ad31-6935-4576-b7d5-d04ffeb581fb", "comment": "Malware payload", "value": "ab56e8a253ce2a386cb936751ccbe3ff7d32deedb4adcc32bfd8ba29c561a4fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548521, "uuid": "b253e440-87e6-41db-b243-5baed901f485", "comment": "Malware payload", "value": "5dcab8a96c620afa4b14f895ec24653bbd610c08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675548521, "uuid": "c0600356-9525-455a-9f44-182a3d094cee", "comment": "Malware payload", "value": "d737fea92e70309c085c5d75ce9f43f1d16f551ef91d61d37b7ff8d0bf263e8a37ef332663b83d54736c3509b26d8d28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548521, "uuid": "dfc69542-fe4c-46e2-a1d9-f20d171facbf", "value": "T12B14D03135C0C072C66B58718828DBAC6B7FB8305674895B7B981B6E9F317D0A73A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548521, "uuid": "e498be44-25cf-49f7-bd77-6e55587a6844", "value": "9d027e1822da283963b2da86a5b0354e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548521, "uuid": "06463e8f-acb1-4967-b1c1-4e0e5221c726", "value": "3072:ZtGOkY/x7EqjL0vWDWzko5xM0dpwEvPuF95/+btHIS0X1q4TUkK6GN:ZtG2JfjL0eDnWwEXuF95/CHyF6kKjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675548521, "uuid": "ca0b6e97-732e-4ac5-ab55-03fd77e842bd", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675548521, "uuid": "757a6237-7686-42e4-a89c-965f3454cc66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675548521, "uuid": "7759e880-3fb0-479b-8b43-f6649864d3e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a686cd1b-a46c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675502207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675502207, "uuid": "2407b15e-187f-4058-a995-8c83990172f8", "comment": "Malware payload (GCleaner)", "value": "64cb5bf1b86eb2cfa9066defc730838d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675502207, "uuid": "7fc87444-a7be-41d8-badc-9bf8d52e4562", "comment": "Malware payload (GCleaner)", "value": "ac6adffa22ce3bc96e1ac20703608a81d4d312150774ab2247962c186628729d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675502207, "uuid": "f2ee72cf-5ed3-4328-a2fc-8121cb27d4e5", "comment": "Malware payload (GCleaner)", "value": "b66efe22e89bb0adc56261e219b9004ed998c3c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675502207, "uuid": "3fc2e154-866a-4137-b5aa-9569a698c1af", "comment": "Malware payload (GCleaner)", "value": "dc0d247ba5dbf03f2c538effacbf1d88dd103acd26988255c9fd2d1fbbe9a50cdff9806426d14ff776919b40220ece84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675502207, "uuid": "79ac5268-2cd5-48d5-9210-61bd0fb7d181", "value": "T1EEB5DE465D98E4A7E0C58FB0CDF76EFB5C51ECB9C0B4181791053EFB3A36A422C86629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675502207, "uuid": "3e83d178-bbc1-48c8-8dcc-e7680150f40c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675502207, "uuid": "98a3c83f-d0ad-4d3c-9498-a163e12e2564", "value": "49152:d3ZLLlBHT3b8syB+QeMeMrTX4DCQJtphwEhxHWNuLhOcpCLCgv2MR:XXlBHT3YsyU/MrLOJnhwUHWNuVdqv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675502207, "uuid": "322b04c4-9e1a-4a3c-aecb-f5741e2a4ec1", "value": 2282177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675502207, "uuid": "637bae38-7bce-4be5-b2c9-2247ba758f8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675502207, "uuid": "c5e73fcb-bb2b-474c-a5be-19a6e4361216", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dff346-a4b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675531944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531944, "uuid": "1712afc4-ee57-49e6-a174-b955d3609f11", "comment": "Malware payload (RedLineStealer)", "value": "18156c3c36750eec33fceeb1439ee16c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531944, "uuid": "171fd3a7-e345-40bf-8e71-6e6b91c07d1d", "comment": "Malware payload (RedLineStealer)", "value": "af289afd122890f39a8bebe48bc8e831f646d34bf2cf05f81510bd7c9bd5121f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531944, "uuid": "ba381032-cde1-4658-8452-a30132960d26", "comment": "Malware payload (RedLineStealer)", "value": "8bd0a9bda651090ef00384281a823a70a37f8f0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531944, "uuid": "7e2bfb84-6437-48ac-91c9-8f1c179f7039", "comment": "Malware payload (RedLineStealer)", "value": "1252451d5c8b3ff0f69feeda07d502a8763faafc105d981c1c6c200c833a2162769ee5056f5939e198ad09fa52bb6e5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531944, "uuid": "03faf53d-bc0d-4f5c-a0db-fb9e31593404", "value": "T14C84F1123AE0C073C46754714C54EB95ABBFA9305A76990377A806BD9F303DC6B3A78B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531944, "uuid": "0bfff025-2f5e-42b0-81db-3fdfc9aa6a63", "value": "d7c1b4fc37e4a9f47e4b98f16dcd9a1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531944, "uuid": "a11920e8-a312-4b16-8d90-7372773bc080", "value": "3072:fRnjcl8hLnl/Hce+WvSh5H20SreYsLcgS6bftfx9nYjzrbxfqBZS9k1tw9NlLTXU:fRbLl/8e+fFSqVO6ni3dGZGSSLdMoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675531944, "uuid": "3bd480f7-abca-4fd9-b0c9-0df7818a4f5a", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675531944, "uuid": "4d4ec24e-af37-46c7-a9ae-80d1a5e73d04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531944, "uuid": "626abd5a-b95b-4b50-9774-3f0641703c4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d9e740-a459-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675494017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494017, "uuid": "bce51a42-94c8-4e38-a37b-263b735062fd", "comment": "Malware payload (RedLineStealer)", "value": "bf1bd93cc768163375b04155e0dfb864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494017, "uuid": "a6e915b1-2f27-46e0-8939-f0ce6722b851", "comment": "Malware payload (RedLineStealer)", "value": "afc76705bc1341ef989831e39b74c4ab4de644b9a18fd1e6a08950414f2d2b66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494017, "uuid": "f9c6d86f-4366-4b5f-a5dc-04a8d3871e6c", "comment": "Malware payload (RedLineStealer)", "value": "9f9303af6487db2727e7135adc178374972f2435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494017, "uuid": "a5c74744-1e48-44f5-a02e-7187a37fea31", "comment": "Malware payload (RedLineStealer)", "value": "bb81d7c8f0d94ac9d920c569e3b698af866b233a07b8ee1dd5bc561d7bc203a9913725291bf95f80e350bb9db3d7a01c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494017, "uuid": "e433915a-f17e-4609-8b00-345c0e4adab9", "value": "T1DFD4123239D0C072C17A62305C34DA582BBEF9311BB9994B775EC67E9F702C166BB216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494017, "uuid": "7ebec5d3-1eab-45e9-aeb0-dd586e0f0a28", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494017, "uuid": "1bd4a68b-e0e7-4a53-838c-b5349e3f5cdc", "value": "12288:MBePId/dLPWTMH2FicIuOhwhYD2i1g1KyhLPb:MV1PWTMWUcNOhcYD2i1gHZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494017, "uuid": "81f8edd0-ba44-41d4-8c0d-bca1cb45f984", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494017, "uuid": "b30372c5-5a00-49f6-9b32-0541da2889d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494017, "uuid": "dd69cb53-508f-46ea-bf2a-2ebc681db48c", "value": "bf1bd93cc768163375b04155e0dfb864.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e2ef71-a494-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675519445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519445, "uuid": "a1c95c01-e4a0-49ca-9e21-4eb382c21fe5", "comment": "Malware payload (RedLineStealer)", "value": "b8d2b0c7d2de02091a625ce8663de62a", "object_relation": "md5", "Tag": [ { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519445, "uuid": "acf970f4-7b0a-4f9c-9e5f-34ffe769493d", "comment": "Malware payload (RedLineStealer)", "value": "afffc120e4957b53be47ae958c6d537d4058de6c556471e02c8658c605cc0c49", "object_relation": "sha256", "Tag": [ { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519445, "uuid": "db8c90af-5c8e-4910-b7f1-f9dfc9fc2772", "comment": "Malware payload (RedLineStealer)", "value": "1894eca1d09b0fb559fc0ab374fb5beab25eb0f5", "object_relation": "sha1", "Tag": [ { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519445, "uuid": "43ccae2e-544f-499f-a5b9-2cc10ecfcc08", "comment": "Malware payload (RedLineStealer)", "value": "2b40b9650f9b3ac3d6e42b9f42cdb20fb23ac463ed7edb5d277d030b9a7fffdd8b5fa0bcfed5876aac2d7cd3f49c3dd4", "object_relation": "sha3-384", "Tag": [ { "name": "crypt", "colour": "#70DED5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519445, "uuid": "464d14a3-9c20-4fbc-a906-4c6eab21adf8", "value": "T1351622BCB9C2A297D56DB7DCF303E63CBB9639B5132421C2B2A1F157984C4998934E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519445, "uuid": "36ffc5e9-754b-4158-ad43-f03258392aef", "value": "98304:uuf6KaikkCoEqnpH0NflTWghMph/DxWSEd:uuf6LcCBqZ0LSghMp1DxWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675519445, "uuid": "6ace1d03-5b7f-4791-93f3-171d4711c0ac", "value": 4271302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675519445, "uuid": "7c5b0739-9775-45a4-857c-a6e2948ea05a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519445, "uuid": "baca7674-8deb-4a9f-b7fd-ff0746796a9c", "value": "AtmosphereLauncher.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed9cc94-a492-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675518676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675518676, "uuid": "18d416bb-36df-4659-ab75-20387ce455e5", "comment": "Malware payload", "value": "5eb7683a742213357a5b4dbac8dbfc98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675518676, "uuid": "1d2c84cc-d204-47e1-a1c9-d167a2bb1d73", "comment": "Malware payload", "value": "b4d5769afba91a132b484b1f4e7b7e7708a1bb3aae4cb324cdd824cb91fec74f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675518676, "uuid": "0f82b364-b6be-4c63-b6b1-0173416614a8", "comment": "Malware payload", "value": "13fe5e839760f038b295224913129cf92da4a4b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675518676, "uuid": "df41562c-9b42-47aa-977e-8dd92b723567", "comment": "Malware payload", "value": "140151bc1b8ceacd2135cb10333f8d12b72f6d3328b0cb678ad2e53b2a097c9c33ac7703246812f9f95df240246aab33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675518676, "uuid": "236c8552-c279-4b65-9a08-f555c883e262", "value": "T18F76331434C8CC71EA4D1D32CEB10EAB63F0EA28066594EB67115B2D7D3A04BF6779B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675518676, "uuid": "91846851-8d78-4e23-8c4b-d912a4e21050", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675518676, "uuid": "d2025c64-4db5-4c96-8604-d21d3cf8a5dd", "value": "98304:91OSyHBRVbnx8J/lN+PMJ8vdqu+lBtQn+pNIl1+pEr5v7epmH/PVEkw0cenOPTr:91OzVbdF8t2+p7Kr5vqmHVEMcxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675518676, "uuid": "dee16d1d-ed3a-43e7-bbbf-93be65c90298", "value": 7594370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675518676, "uuid": "cdd9be06-180c-4a1a-b31b-5bc996381de5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675518676, "uuid": "7a0da23d-d5c8-4afe-a8a3-6f5c94f57330", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f29b2a-a446-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675485717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485717, "uuid": "153c0c96-41dc-4ba1-87b3-d48744787cb0", "comment": "Malware payload", "value": "63c45a64ef9f8b719d50bee9116ca722", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485717, "uuid": "5ec3ecb8-f4a5-4efb-bb01-7666b98c4b92", "comment": "Malware payload", "value": "b4de682b2d63bd472995d424db13b6ee7794c96402755603856c9a558d721669", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485717, "uuid": "3b4c287d-5853-4d46-9f3b-c50db9f9fb95", "comment": "Malware payload", "value": "e58c652c9c1836d3153701384ce49c82f18c5643", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485717, "uuid": "32927373-a1e3-4245-ac41-6651d01ca179", "comment": "Malware payload", "value": "29071111aa65e70d1f351ae09b776499169070081125d2f6c8430968e435a5eacb7bb405fafcf2a3faf51d89687c609b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485717, "uuid": "90c72259-b6bd-4c09-b8f3-81e60f75b3ba", "value": "T102F0E189364E7441F3D32B35F78A0B53AB28515895787A5B5E40FB041D50170DD83F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485717, "uuid": "b5216d86-6d6a-4553-b76f-0023a540215d", "value": "12:5jdlyHn7BJSSd6Jz2Cml4JP4XuJvecRv11yHPabk:901c6qzDml4LheV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675485717, "uuid": "651ae355-5057-4337-9043-ef1f63f4e794", "value": 597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675485717, "uuid": "1aa1223d-ec91-497a-9211-d2fc4c4d5157", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485717, "uuid": "ced963aa-cb90-4790-bd32-bebed1668bd4", "value": "8e422eb6de1fcdd6128e051b3795f80819695bf57147f6c250d0096fa3778c10.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abfb4d0a-a487-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675513813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513813, "uuid": "19419b7f-7d55-476b-a259-1e797794526c", "comment": "Malware payload (GCleaner)", "value": "143e021c7102d557259c71b440177dd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513813, "uuid": "55bc7f15-cd50-4075-98ef-d8cb3de3192a", "comment": "Malware payload (GCleaner)", "value": "b57580762165a46aea468edce21e4d497294be335edc3e336aa64b0e435f390a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513813, "uuid": "ec0604d1-d963-43f1-a198-2e3584d22695", "comment": "Malware payload (GCleaner)", "value": "7ce7a062c1ad97f062a1ef21e7e152c557b10fac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513813, "uuid": "51dfc214-e2a9-4ee7-b65c-c5cb3847d5eb", "comment": "Malware payload (GCleaner)", "value": "57f62a578b8358ae8d70901b9db7d50bbd2a3419109b72262125b8bc53b506483713c4f5f98344258c2ef6cdf8b5403b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513813, "uuid": "a9c61938-0c06-4166-9466-03d052b6d972", "value": "T1ACB5DF461C99D06BE0C98F70D9F36EFB4C11EDB9C0B9581791183EFB3A32E422C56669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513813, "uuid": "6e32384d-f619-4732-8ebd-4665201bb58a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513813, "uuid": "a7ce0f4c-411f-4df7-8a2d-33cbdb439aa4", "value": "49152:d3Zs1BAXJcDtDFeq4hEg5CZXdDk8y1bG9Ooy+LCgv2MR:XQCJcDtD6uZXK8SRev2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675513813, "uuid": "2d02c268-aa8f-427b-b20f-4ec6e70f8dbd", "value": 2321606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675513813, "uuid": "9368d441-9659-47c5-a098-54706063a5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513813, "uuid": "b20e8184-835a-48df-a4d8-3360ecab2893", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca16b8f-a45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675494272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494272, "uuid": "32533249-ac8a-401c-9699-c6647638aee3", "comment": "Malware payload (Amadey)", "value": "c79b74d8fec5e7e2ba2f1789fd582a15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494272, "uuid": "3586cb40-4ba6-4a9f-bea2-57c7a1871590", "comment": "Malware payload (Amadey)", "value": "b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494272, "uuid": "546b4f0e-b3c4-47cd-a176-e888b26efd6f", "comment": "Malware payload (Amadey)", "value": "78a1e5d99dbaccc5e07b125e1dfb280112cb3128", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494272, "uuid": "3336bae7-a595-4856-bb31-0fe1cd802177", "comment": "Malware payload (Amadey)", "value": "629bcfc1ee534b18dd96c91ef6c533ac000be1357ac8e83a6e9c66ee89c46612db99e84587bd9872ffbafc40db60e827", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494272, "uuid": "026ad6cd-2fe0-425a-9d38-f3441451f441", "value": "T182936B1030D2C071D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE36D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494272, "uuid": "21aff9d4-9c5c-4c55-b40b-0eb5f8505aec", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494272, "uuid": "ca5f2e86-f442-42ec-83a7-c8536ea390a9", "value": "1536:Fto4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU7dz5QIaB89p:roUCWbBNpplToUs1uNhj25LJUDaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494272, "uuid": "058fdc86-f28e-449c-bef9-fe2901a703f2", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494272, "uuid": "9357bf31-3bb2-4317-96fb-bfabef9ab48a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494272, "uuid": "41627bee-97d2-488d-a366-5069f5ea1516", "value": "c79b74d8fec5e7e2ba2f1789fd582a15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac878f86-a4ca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675542590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542590, "uuid": "ac2e54e8-97e6-42c5-a5b4-dd2ec0196a1c", "comment": "Malware payload", "value": "a9429fa4db9a5fe059896653a5d4d35c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "royal", "colour": "#57A996", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542590, "uuid": "0d233e3d-f82f-4385-b7f9-67f94f3a985d", "comment": "Malware payload", "value": "b64acb7dcc968b9a3a4909e3fddc2e116408c50079bba7678e85fee82995b0f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "royal", "colour": "#57A996", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542590, "uuid": "a1b72b3b-0efa-4dd8-a162-cbeb943fc9ac", "comment": "Malware payload", "value": "9874546fea08fee04b3271a6366ff6dd3ad6fae2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "royal", "colour": "#57A996", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675542590, "uuid": "a1b75b8a-1383-4c98-a0c2-a62a0e5c4db0", "comment": "Malware payload", "value": "3e40bff3fd12a89b57e249ab7b7eb3516bd2b6fbd948305a9a704957250f78a79c22a54cd3ce52bf45bbb04dac35d505", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "royal", "colour": "#57A996", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542590, "uuid": "7c726f30-69d2-449e-9f2e-d4c8029f6da9", "value": "T133C58D27B8A610BDC9DED430866F8132AA74B45C43607F3B2295D6313DB3F286F1AB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542590, "uuid": "01ac8e89-5d35-4df8-8331-b82cce1107a8", "value": "49152:2bZPXEinhLENX/bX40MA4sDM9RIfiv2eZRBqnlptIU6iQnkgWbwL/KIRpvggSuj:4KinhLEBo0MA4sDoIqv2eZOnlw+QnHpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675542590, "uuid": "d5bd852d-98f3-441d-aa75-659f0ff4fafe", "value": 2558055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675542590, "uuid": "740dd9eb-16d4-4744-8825-cf8517409ad3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675542590, "uuid": "eefa881c-320f-4cc6-9b79-2dc77bdb369e", "value": "ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86fa0ba-a4cd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675543952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675543952, "uuid": "c34b004f-bb8c-47a8-b12b-053adab6c9e8", "comment": "Malware payload", "value": "76b1a8a3814b82aa92b7302509c2f31a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675543952, "uuid": "5e425c58-fe2f-483d-a70e-3fa85d9b42fb", "comment": "Malware payload", "value": "b6a68af1d4852476d62b6aa231f9629260ec4cbcaba051feba5742913ffbebe7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675543952, "uuid": "7596a890-d95d-408a-a44c-870f2f4c19cd", "comment": "Malware payload", "value": "ac0e13cd3c3508319792e0eee3fb1da422f20c98", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675543952, "uuid": "4da8d8b4-d6d5-4c5b-b16d-7a10d1e3cc85", "comment": "Malware payload", "value": "2a8a143947010f35af562e5556a41ee8bfa3420303e424fbe3e53e426dbc01ddeddd09489b08bb0265f3c3d66367af86", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675543952, "uuid": "827ea010-b845-4f8b-88f2-d34316de1de9", "value": "T1B9248DA07091E032D05B0439621BCB7E5BFDF9F41271A447BBD81A5AAE72393EB19347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675543952, "uuid": "46946b36-b648-4cf6-b121-ded35244a4dd", "value": "0bc418575efc832b308d227b31192688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675543952, "uuid": "5d024630-cf71-4803-a9b3-b0dbcfc828f9", "value": "3072:nr/YXMJJciFoSYMoXYQlwfv/gF8jua3PX4Ns5drwolUtXL5kuN:sXkiq4wfv4Kjnv+srwoG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675543952, "uuid": "da818d8c-1ade-493c-b340-5cec00d6a189", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675543952, "uuid": "69872367-8da1-4f5e-aead-12619aca0867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675543952, "uuid": "dae6b0c2-900a-4e22-a0f0-a1e0d91ffecd", "value": "b6a68af1d4852476d62b6aa231f9629260ec4cbcaba051feba5742913ffbebe7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236cf482-a46a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675501128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501128, "uuid": "257440c3-8457-4b3e-af26-ac4f1c272e62", "comment": "Malware payload (Smoke Loader)", "value": "1223c74eb57983ba37fbb692ad62c4b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501128, "uuid": "b0bac219-3bfb-4d67-8214-73b5ca9e96a8", "comment": "Malware payload (Smoke Loader)", "value": "b73414f68028d4e5e3f90bff3d879455d62a04642f58dbe1c454ef7a2760b0fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501128, "uuid": "0ea54e94-804b-4f47-9dec-82c1a7aa8056", "comment": "Malware payload (Smoke Loader)", "value": "40eab059bfe16add51e66e574e030550220b221f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501128, "uuid": "2ec52f59-d8f1-4987-9536-48dc9d6c806e", "comment": "Malware payload (Smoke Loader)", "value": "b9e126dc5c719ea69a457e3f0e071ed87082e11b80ba4747d58302c35cf50e7ad69b93b95063b24d55a796ed113fb62c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501128, "uuid": "3d496992-f73b-43fe-8ca5-29fa1430a174", "value": "T15F54D0323680D072C17F11305820DAAABABEB9315579D9477BA817FE9F306D06B3634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501128, "uuid": "0aca5ae5-79f0-417e-ad43-47fc38d1f65a", "value": "99cebe82e9a09163c3069dbc31af6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501128, "uuid": "d94b443a-195c-4390-8a09-4e1ffd385007", "value": "3072:3m2H7xwhKLQAbNenWBGr5eOWC0N0OhQ5+dNM7OYCj+saX:3mBKLNsnlh+0OUqn7jaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675501128, "uuid": "4313603b-8506-459c-9770-dd61d21f8b22", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675501128, "uuid": "451a461e-a73e-4216-92c7-08528fb5b9b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501128, "uuid": "b464c1f2-6e7c-47b5-8dae-8ee1f81dd4ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b10cf5-a49b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675522229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522229, "uuid": "9e88bfda-6cc3-425b-a5c4-f68f4eb02a06", "comment": "Malware payload (Smoke Loader)", "value": "f2260a03b3348ceb46b7ec6151e421c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522229, "uuid": "f8ed8971-e272-404f-a0bb-0b31a2bdbc8b", "comment": "Malware payload (Smoke Loader)", "value": "b74d3c2f0d2c772619704f13fd1839671ae5e0b4732064018e65e98562c46a06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522229, "uuid": "ab88720a-e496-4ae4-86b5-da98e67a83f0", "comment": "Malware payload (Smoke Loader)", "value": "c816c3f3ac176ca73fdf14186f47c425b9254431", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675522229, "uuid": "b1f78d1a-ff10-44ef-b649-d860047d7336", "comment": "Malware payload (Smoke Loader)", "value": "1a6494254aaaa91a47793bb45cee46f01e87c52dfd2ab6a7e200fd06e776464f3a4df3324f37eed199a6f402e8af2b2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522229, "uuid": "1cfc5dbc-c052-4376-852a-449563cce659", "value": "T18414E0333AD0C072C5A760349C74E6A4ABBEB8319675890777A417AE5F333E0673634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522229, "uuid": "08df5a72-4e96-4fba-968d-0703b8d52659", "value": "be7581a01c1ad2f53e81adb31665eb55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522229, "uuid": "4e48c754-05af-40d4-acf5-7bd6cd6b0058", "value": "3072:sIZs05Tv8ALdrOuuOWo5olX5vY8JlZJLGR7Bh+c1nCIqlxOf/RsH+Iz11dSM:sIZd3LdKpO8l1JLJLK7Pn3Xc+Iz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675522229, "uuid": "219fb46c-bb9b-44b6-8461-c73df0aaa9ec", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675522229, "uuid": "a0ed448f-7efd-480b-8381-30acf6c3fed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675522229, "uuid": "3f35a088-7f13-4713-a46f-f6d2d26bc0c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca253a4f-a45b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675494965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494965, "uuid": "a70d346e-5580-4f5b-bef5-f31a6bc7e8aa", "comment": "Malware payload (GCleaner)", "value": "a92dd040d5ad0210a16f56a53c31893e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494965, "uuid": "d46a092d-5b8d-4368-bf20-a609d7d333ed", "comment": "Malware payload (GCleaner)", "value": "b7c72f9eb6efabdf84f2cd4d093561e701a4f78db7074c3230166ceb2b46d72b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494965, "uuid": "d9b0e40f-a7a7-4825-8822-682c8c540716", "comment": "Malware payload (GCleaner)", "value": "b4e009e510a3618a0edf0104ce3e3c75451ae1d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494965, "uuid": "cfea405a-cb3c-494d-bae0-5995e2d34edb", "comment": "Malware payload (GCleaner)", "value": "7dd37e2c53bac973c313c181ba97f3f2cb57a9ce151901f2ed579dc8c291d2e5ef0b7fd1d209deb967d17b9a8a54844e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494965, "uuid": "80e286d6-c2ff-4828-a85b-9ae7aaa9bcf2", "value": "T1BAB5EF565C98E56BE0C98FB0C8F76DFB1C10EDB9C0B8095791043EFB3A32E522C56669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494965, "uuid": "4b2c46be-ca63-44c3-a3a7-87a5340a01ea", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494965, "uuid": "17946a3a-af4b-4f4c-b44c-ccad779f9d0e", "value": "49152:d3ZqclH5R+9ClTdnilvO5ZIhzPP52AAuKr9cLCgv2MR:Xp/eClTaW5utJ2A4Cv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494965, "uuid": "fb30efb5-bed9-43ab-8fc3-d525d8b63443", "value": 2294756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494965, "uuid": "3f2dfea0-2982-4fcf-89af-437d6c286503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494965, "uuid": "7fd013c8-e5e6-4cf4-9d72-da0272ed7dc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99a2a88-a439-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675480415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675480415, "uuid": "e17025a1-2df7-420a-964a-50bf69b1be76", "comment": "Malware payload (Gafgyt)", "value": "1ffb85ff4f55fb993b90a25f3f76dbac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675480415, "uuid": "3b6de311-ad80-43ad-ba44-fff42a755160", "comment": "Malware payload (Gafgyt)", "value": "b93c1755809aa89694dbc26326124aed1bfc94feeb465c427563e614514d6049", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675480415, "uuid": "e0ac933e-002a-433e-b9c7-5abb506039d2", "comment": "Malware payload (Gafgyt)", "value": "308ab0828d900dce355d7ef6de32a4a1f8ebe78a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675480415, "uuid": "b6a9c8e5-68e9-49e3-beb0-e21376504832", "comment": "Malware payload (Gafgyt)", "value": "b5349a082329f575a794372369e95fda82bdbf0fc44e4e4010a007a48cebe86608aaeff383bc8c57a00a166819ec0716", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675480415, "uuid": "ce9db983-8691-45f3-9b0e-5eb397c411db", "value": "T11BC3093B6B270A23C0D9507102E31332B9B9DE5938B943D7AAD07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675480415, "uuid": "406f0500-6e1f-40a4-8125-120c91fb80f3", "value": "1536:yvOm4GtVAcaKoXN95PUtfbYtSBRdxyonMfm7ypwYujl3IdnuW:6JoXNPhGwOMfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675480415, "uuid": "ff8b0770-2d49-4edf-a059-3c654b5700c6", "value": 126430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675480415, "uuid": "54822a19-7273-4689-9066-81ac6995ca68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675480415, "uuid": "f8aec5ab-7d1b-42d3-9f97-88a0e58a6065", "value": "dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12b0c48-a4b4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675533176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533176, "uuid": "370ab928-29c1-4f50-8d25-48ad5ecaae64", "comment": "Malware payload", "value": "183eb9f4dfdb013246670c67fd46a234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533176, "uuid": "a9fc54bf-83f6-4cbf-9db5-25cf268abb91", "comment": "Malware payload", "value": "b973d20f7964f71bb99241b1b25c6161dfc7d2fb2c03ff30f1a1f18c415861b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533176, "uuid": "6933b558-3d4c-43f9-83b9-61a22c614866", "comment": "Malware payload", "value": "ca291f10ae22abad5630df42a7454e9552cab94b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675533176, "uuid": "82bd3eba-0b69-4dca-9626-206d3a3282ee", "comment": "Malware payload", "value": "56aded8a917c240893fe5d76a0fd4989f03ffe86b1b7da8e7c18ff20c50e3e944b8fd09d24ccf38512df1ff7974645e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533176, "uuid": "0b60332f-908f-4657-82b4-cbd6466feb7b", "value": "T14305AE4476CB91F2E572143A5539A7321F3A6C1203329DFF5FC03AB869309D86E726B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533176, "uuid": "87fb83d7-281c-4523-9934-7b9771b8dcc2", "value": "1e80af93b195fb557b35f70c8d199fe4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533176, "uuid": "f10dfe28-16cc-448f-bfc8-c207d57ff53c", "value": "12288:2O6EZJLqTUnXP32FDhHvannB0xJtjSl+MRKd+iSe6dqjgw00Bn0rNu/3Xm:2iXwUnP2ZhPi+McxSel2B8/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675533176, "uuid": "c075a520-1f65-4a75-af16-f394df90f4b5", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675533176, "uuid": "cbb3c9a9-d143-4313-b409-994475fd49f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675533176, "uuid": "1906a4e6-0058-435f-96b9-4be179756ebd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005bd57e-a428-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675472723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472723, "uuid": "4863f5d3-a12b-49a2-b326-84d6078172d6", "comment": "Malware payload (RedLineStealer)", "value": "10ea41fd11c557045c27e5c2c6c2e7ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472723, "uuid": "f8d64a48-4ad0-4b8b-a59a-d2e1f4bb56d1", "comment": "Malware payload (RedLineStealer)", "value": "ba6f1f7315c383583acb3caf2f7a74c89d3977cbf5ee19bb8bcc1a1455dc9317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472723, "uuid": "b73680d2-0f57-42a4-9e58-7adf8f734d24", "comment": "Malware payload (RedLineStealer)", "value": "edaaa8fb82e0aeb17e75a6b2d151433cc03751fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472723, "uuid": "90618999-8a0c-4711-a5e4-70f739cb37d6", "comment": "Malware payload (RedLineStealer)", "value": "2cd87eb367176ef545bb4a06f9778d07796784d8caa5ba281ff3f43c87fd8c0048ab256167487e99a7b28ed583d84c87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472723, "uuid": "613af857-2614-4f42-bcc5-47402efb9658", "value": "T1D7E41353EAD88132D9B55BB018F612870E35FCE2ADB087BB1715649E4C73580FA74B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472723, "uuid": "cb7f7326-70fa-441f-bf10-8fcebbd1b0fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472723, "uuid": "fb014341-d4a4-4568-b715-fd30c9ca4e84", "value": "12288:0G7Fy909rmBsLOCgFSiYBwwSP43mjc+I3/VWPbajAw3TJDuQTJyNiwF/NJi5LTg8:fyirmYOCw1YMg3m+/VS+p35BdGF/sLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675472723, "uuid": "f3f41dfe-896e-4a2b-84ae-3bf122810d62", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675472723, "uuid": "03245382-fb6c-492e-b9dc-f2a65a11bba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472723, "uuid": "a846e975-880c-47d3-aee3-11ebbe991761", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12faea02-a45d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675495517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675495517, "uuid": "c078fe00-633b-4940-beb5-280039036bb3", "comment": "Malware payload (RedLineStealer)", "value": "7a0ae59f583d7e0a69f565d805c022f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675495517, "uuid": "75d450d2-9f6a-4b32-ab24-c79db26c47e4", "comment": "Malware payload (RedLineStealer)", "value": "bac993e4fe8260c16d8b3936e4a2c0d4a4d37589e45f9860743432aff3804197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675495517, "uuid": "d7be1d2d-11d0-4dfd-afbe-fe659a36daa3", "comment": "Malware payload (RedLineStealer)", "value": "f9f72bfa5357d8e0e98f38057385a7029f6d1531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675495517, "uuid": "3abfe607-bdd9-46be-8f1f-13bc5617119f", "comment": "Malware payload (RedLineStealer)", "value": "cde5740c3e6dc2a4478768dd7dbcb8108b8a3e4e5cfda63d75248f3a1879c3b1877ef7eaf4a18552a1d7fb9c1cd92430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675495517, "uuid": "ee5ebefe-2d84-43ce-ad95-8bc8b67b18c3", "value": "T1EDC413217AC1CC33C1E622774F2AE2A52F76B232A573CA47B75C061E7F651C06A5D21B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675495517, "uuid": "8603254d-c875-4a8c-a2ca-b95beed12dc8", "value": "d8db521c1aabdcc02e1c1d2a0eb59db9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675495517, "uuid": "8fd0a0f6-b3f2-4ad7-bb31-49439dc76b1d", "value": "12288:zakDrY2LfVti8txDtTqeG+gU/EV0wt9xN4602JI24:zae95ttQePgU/Cnx26HK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675495517, "uuid": "b6d570af-bed6-402b-a937-443cb72e659e", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675495517, "uuid": "8ef91556-ddcb-46aa-8cef-43202388edaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675495517, "uuid": "baa8fa67-6340-4ce3-bbc7-7fc52744069b", "value": "7a0ae59f583d7e0a69f565d805c022f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edd7167-a4b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675534836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675534836, "uuid": "6c882f29-8d61-4fa8-811e-f4bf318d253e", "comment": "Malware payload (DCRat)", "value": "b5762235085feeefbe6c526e9a829346", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675534836, "uuid": "23f378db-b4f4-4399-b156-86bba8a3164a", "comment": "Malware payload (DCRat)", "value": "be25d59082e0385eac3802a664fb78212c70c460fee29b634ded6cca406f70ec", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675534836, "uuid": "7d0190ed-f2ef-42da-af95-6612e0da2bce", "comment": "Malware payload (DCRat)", "value": "184d14c833f873c794f4679c9b122464809425df", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675534836, "uuid": "d271f093-2802-49d7-ab46-19ba5a7d7fb6", "comment": "Malware payload (DCRat)", "value": "ec42a7efd4f24a9e743f20d3f7c2ff25ee3a11737861d1783eb37eb9697048c22200724a6b00feec6dd3568d2cc2eda1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675534836, "uuid": "29583bb1-bbf6-4657-bb3a-739c2fc22047", "value": "T10B454A027F54CA12F508163BD2EF854847B0E95166AAE31B7DBE376DA5123A73C0C9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675534836, "uuid": "fa13ca7f-5ee8-430e-9231-dcf4d9c6ece9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675534836, "uuid": "28b7920c-893c-4a22-9180-d813484cd98e", "value": "24576:6bPgFhUBboxtHrU7xkhuwhdgK/wkqDbxhVJR:6bPYuyt8xAjwvkMbDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675534836, "uuid": "1272702e-16ff-4a81-8d31-3aed0680f621", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675534836, "uuid": "120a7591-7ea8-4621-a4b1-0392d2698a81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675534836, "uuid": "46b7fbba-970e-44dd-b734-00b26f93166d", "value": "b5762235085feeefbe6c526e9a829346.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45da59f5-a4d5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675547142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675547142, "uuid": "38c4df9f-a284-4a2e-bc06-27bf0f832d5f", "comment": "Malware payload", "value": "26b187dee746556c82c17edfc1341ef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675547142, "uuid": "33bd8e89-f570-4727-9b23-59d5469843b8", "comment": "Malware payload", "value": "bee11b8a624c941e91169b0d56c071317d7aee3ea006c2996147a931098eb8c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675547142, "uuid": "6b33f1fc-12ba-4696-9c5a-92a5e28e6a29", "comment": "Malware payload", "value": "f46e2cd3d2928a26421aedf497404fc1ac7708a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675547142, "uuid": "2fe13d5b-15e1-4f62-8bfa-21df6497d7c4", "comment": "Malware payload", "value": "d852f91ae22979e91a5646c36562662db119342bdf078cfb95e5ebc6490545539db545b40f10a100453554489bba53f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675547142, "uuid": "a6c6b6a3-75bb-4cf0-aade-c5d05380bc86", "value": "T114B5EF125CA4E1A7E0D88FB0D8F31DFB5C10EDB9C0B9481791497EFB3A32E522C56669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675547142, "uuid": "c90b9bd3-06ab-42e8-9051-7edd56272f05", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675547142, "uuid": "9270306f-a3de-4bdc-9dee-665e457d2ec0", "value": "49152:d3ZreE6+iF6VnrgxBTnptH2Rdk7bqsqubd8UKLCgv2MR:Xr1I6ExnAUeqdAv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675547142, "uuid": "ee9d77da-1517-4cfd-9bfb-fb10b801fcee", "value": 2278893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675547142, "uuid": "a58d342d-d95e-46df-a9d5-610a0b8b7811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675547142, "uuid": "912312e3-97d5-4fcf-881b-e2d4123499ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36dd8a57-a47d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675509321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675509321, "uuid": "18b51a59-cf5a-474f-9769-0c96f4889487", "comment": "Malware payload (GCleaner)", "value": "e7717b49456e2ec458a484fed15af11a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675509321, "uuid": "d20d167b-0283-4906-99d5-5411707d622f", "comment": "Malware payload (GCleaner)", "value": "bfb91b2835e2d71107280a16132a2f8a9a12cea1fa9f05861a9808c7ed64ab60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675509321, "uuid": "a0f73a41-3f7b-402e-b669-657cc9443d79", "comment": "Malware payload (GCleaner)", "value": "2e026d2d682dc85fdc76bcd4fdad82048bb76b40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675509321, "uuid": "c2d689fc-dbf9-4fd8-a976-0a620ec5e7af", "comment": "Malware payload (GCleaner)", "value": "7f15e68f8a03b9519882799624c566109d0b3f6cdf586df286181d0bc7b037978fee8f9f875f3215cf4e8e824fdf4713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675509321, "uuid": "3f0cb682-73f2-4cd1-8058-c31d2b0a5dc7", "value": "T17AB5DF165C99E06BE0C98F70DDE36DFB4C51EC79C0B9481792443EFB3A32E526C86629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675509321, "uuid": "975bf23d-9319-4e6c-a04a-3bb8a1702401", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675509321, "uuid": "cd8bebf0-3b7d-4c33-bfd7-303d51c25a2c", "value": "49152:d3Z9zbDVKbaneD9vDbbDauciHAu1jmNQJ5YtvAufhgELCgv2MR:XJfFehvbe2HTx5MnhVv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675509321, "uuid": "9982edc1-55b4-4768-980e-200f773e2b02", "value": 2320841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675509321, "uuid": "afcfbf76-fdb1-4e74-9876-78c72a1265a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675509321, "uuid": "bf248e63-43b8-49a7-aca1-7f098b8bde8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7f19d3-a423-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675470810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675470810, "uuid": "f17e9f13-7082-403f-a16f-8d5c45bc49a6", "comment": "Malware payload (Formbook)", "value": "f2769730779af1c856407766809f903b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675470810, "uuid": "cd16f36b-7b76-4c7a-91fa-8a267865f8b9", "comment": "Malware payload (Formbook)", "value": "c22ffb1522b40b4001842f39254ba673194f53e0b1470f5e091cd6ff8998f507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675470810, "uuid": "b2d73031-aeab-4f62-b92b-c1b833933451", "comment": "Malware payload (Formbook)", "value": "ad04b056ba47a6d2cd760dbec3076340e67994a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675470810, "uuid": "51ff4fe7-2958-495a-8458-e156e9fe19a6", "comment": "Malware payload (Formbook)", "value": "5d287f73b2daa40f63c5acf42157945ea987c43c0711387175a2595390c0703efc297adc7f2f7d460073e979153add65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675470810, "uuid": "3a963050-fb20-43bc-8dd0-143d275cdf7e", "value": "T17715CEC5D2588AA5DE1893B96A36CC3453333DBEA870D51C29DE3D673BFB38210215A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675470810, "uuid": "459a4d03-b86a-4412-8918-c872216fd691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675470810, "uuid": "0828fdf8-c95e-479e-9ca4-5e6bd4956d78", "value": "12288:7VG787CFk9Ma7OHrFPkgi5B2fFUgXCcZukVT1kEvEVWeh3ih9HdAhP7r9r/+pppf:U787mkaa6HrFjOI9UgmkVL8BYTGh1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675470810, "uuid": "2d06589f-50f6-419f-8bcf-bcfb58fc3359", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675470810, "uuid": "920abcdd-def1-46a7-8745-e69ceef69969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675470810, "uuid": "c41232de-f2d7-47c6-8a8d-1a24715871c0", "value": "RFQ12345HG7Solar&Wind Procurement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009ac33c-a4d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675546167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546167, "uuid": "0c3021d1-bb4e-446b-8a7f-2c1927615c89", "comment": "Malware payload (Mirai)", "value": "1e8fcc3486570d2aa02fc0d90e309946", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546167, "uuid": "d03ca775-3ae1-40e5-826a-b2560b0ce365", "comment": "Malware payload (Mirai)", "value": "c36791971a3fa9eb2199dd2f15ebbc8d83165f2fb165bc1d0e53409ffe6c9d51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546167, "uuid": "159f42a0-8bec-447b-9088-93f2b4a668e7", "comment": "Malware payload (Mirai)", "value": "5ca8822d5c515435a12ad77667b89991dd36f020", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546167, "uuid": "d2bce48a-821d-4e15-9036-1b1d4fbb0059", "comment": "Malware payload (Mirai)", "value": "c3cbb4f4dcb02ec82ece8fd648c492d540e05a08a96326264e2008f9e8ea5f72cd003b5419647535d151993044545d3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546167, "uuid": "8924a95f-262a-4772-93e4-70f691ec930f", "value": "T10F730856B8814B12C5C5127AFA2E128E332317FCE3DFB2129E246B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546167, "uuid": "85e3e88f-a5ca-460d-bfd9-29d0ccad6252", "value": "1536:mln25xPBXk1wnnkL7+KEU07krVkyazN0bIqvikNnsvHTGsV5GYIWv:rxpXCMkMfkja4NnsvHqsVER2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546167, "uuid": "b29872c6-3c7e-48cb-80a9-9f5cf9337cd6", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546167, "uuid": "850f5ca2-c67d-41f8-b413-1153f4de2273", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546167, "uuid": "c14caf10-854a-45fa-b752-657f0e591c0f", "value": "1e8fcc3486570d2aa02fc0d90e309946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c41a85-a464-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675498553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675498553, "uuid": "384e105a-2a68-4191-9c53-e5414a1e1de0", "comment": "Malware payload (GCleaner)", "value": "2ed9da96d24a70f27d15619238f336d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675498553, "uuid": "7ae96933-246a-4abe-bdbf-d1dab4a4045b", "comment": "Malware payload (GCleaner)", "value": "c3b7db7937d4b82f22d38cd4830e04d00ae75c9348ade3c0c942712a95da7a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675498553, "uuid": "508bbf3a-8e07-4422-bcc5-af54fa589ed3", "comment": "Malware payload (GCleaner)", "value": "e705181cec1261b934dbfd1222fb29483f765ab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675498553, "uuid": "bbc257a6-4a1e-443a-b815-d4e9528c611e", "comment": "Malware payload (GCleaner)", "value": "1961556d88a598bcf4f7c0c65d9a09f1966ec9a7e88f1fb87805661cf72f609b83583d8b1dad9beaf00bd498814e78fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675498553, "uuid": "06948184-bed3-4806-94d2-f096b6a65f23", "value": "T178B5EF065CA8E0ABE0C98FB0CDE36DFB5C55EC79C0B5081791443EFB3A32E426D56669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675498553, "uuid": "ad9ddf12-ac08-4166-a711-2e34b689a06a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675498553, "uuid": "fc4f3c5c-c595-4943-9eda-0fc73d03479a", "value": "49152:d3Z4IX5yeMvqIXZZ23l2W5weDel4Pd6KoxwhuiMV3HJS5+LCgv2MR:X4MgBpZjbl4Pd6X8M5H45ev2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675498553, "uuid": "45f4c7dc-b948-4dc2-b121-e724e68ccd81", "value": 2309327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675498553, "uuid": "679b3a3a-724e-43b9-b394-da0ab038a54b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675498553, "uuid": "5262c42d-883d-47b9-9695-7c208ec02cf2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97698df4-a49a-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675521939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521939, "uuid": "a9314e0e-0270-4c25-b5c5-04c2bab12d8b", "comment": "Malware payload (DCRat)", "value": "d8e9b5caad373e52ed596049646d7348", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521939, "uuid": "319cf5ec-28bb-4838-80d6-d0716cb95e28", "comment": "Malware payload (DCRat)", "value": "c581b1d1c0abd1760397edf1f1eacf74ab339821842b28cf7d4cac61e0cb1115", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521939, "uuid": "5d47d37e-aa8e-4354-b246-4544e00bd735", "comment": "Malware payload (DCRat)", "value": "3c5895f0d9139eb3554a81a9efd31a2c4fd9cc1a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675521939, "uuid": "60ae1bba-317b-4d45-a26d-56f20500c011", "comment": "Malware payload (DCRat)", "value": "c60e0255529583d8121ebf091828d54d97bd751a237fcff6ca4314391e7a824912da6c63f7ccf276590d0b94d270a4a5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521939, "uuid": "85eb8f14-6db5-4166-b614-6d99399797c2", "value": "T155050C346EF91619F17FBB3896F078A6872A7AE36713D90D04A243870617749EC8463F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521939, "uuid": "bdf9293a-8880-4ee5-a675-1b5077662b9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521939, "uuid": "b6516e1b-d395-48e4-8eda-38711906c6fc", "value": "12288:MqnOPGypi7FqYEwxj9hL/5NsMJOvMf71XR3PK8UO5KMBLy:M+O+p7Ecj9B5d3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675521939, "uuid": "cb090085-a913-4a73-a9eb-11c390b90323", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675521939, "uuid": "49748ce8-5907-4454-aaf6-6468fd02b7e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675521939, "uuid": "926c652b-d91d-4dd8-a208-981b19338118", "value": "HEUR-Backdoor.MSIL.LightStone.gen-c581b1d1c0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cc7379-a430-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675476575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476575, "uuid": "1fb936b2-7587-4750-9087-8fd703d8aec7", "comment": "Malware payload (Mirai)", "value": "49e115a08d48c1abe6031d65d362eb28", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476575, "uuid": "b8a17b7f-0f59-48e6-824f-785dcd6bdfd1", "comment": "Malware payload (Mirai)", "value": "c5bd2146ebbe575a47a666e07b99eb526d46d74e0d7758bf0bf5cb5b3adaa55a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476575, "uuid": "cb5e4c64-87ea-4923-9118-1d14e27d4f15", "comment": "Malware payload (Mirai)", "value": "efa072753fd15dd0111aefafed90a3dcea8fbde6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476575, "uuid": "acdef81d-b6ee-4a05-8b36-75c2795ab7b0", "comment": "Malware payload (Mirai)", "value": "791fffecae973a65d60b59fe2aa83cfc98a33cbc14698f06d4835069dff9025d903be3578f9fc09071eb692293ff6857", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476575, "uuid": "2d677878-e61c-4fa9-8459-4a7857916a9b", "value": "T1B833280BA58181FCC569C17443FBB53AC876797E0239B1DA7BC8FF176D85E601E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476575, "uuid": "4fa6705a-32a6-4002-a761-5b9258df68ce", "value": "768:j7s093tGOHn2PAe6nCAQTGWexrecbwBg4ubt7U4E1rjWb57Vn7fOngg:M0937QAe6CAQiWexKg1It1rs7Vn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675476575, "uuid": "ffd0f365-44bb-475e-9d35-45f91d4580d4", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675476575, "uuid": "1673a357-8954-4ea3-8606-5168d42de2b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476575, "uuid": "c27b05f3-89b2-482b-b7d9-5a5bdc89e4b8", "value": "49e115a08d48c1abe6031d65d362eb28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f760fbea-a43d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675482156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675482156, "uuid": "8fe42e0a-3c5c-4028-a994-ecf35341da55", "comment": "Malware payload", "value": "e620180c426405af67f9229052e059b1", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675482156, "uuid": "279ca35f-da91-41fb-8777-12e789e11729", "comment": "Malware payload", "value": "c68175c7f763d23c2e8c6e0b142f1699a3edc5677144af2ee65a81b43e9a7f59", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675482156, "uuid": "78296544-7cfe-4dea-9b34-36103f6534e6", "comment": "Malware payload", "value": "7d47412c86c42e58ad0fef05bf05a4da68351c9d", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675482156, "uuid": "deb65dda-37e2-4e86-9f2f-5e20056ea94d", "comment": "Malware payload", "value": "5b4918535618a28d98e6c4821102eaa1cfbb89295c09a166395a17a5644c3edc8cee9d2a7c24e9d53054481945d7b29e", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675482156, "uuid": "18e58c75-2983-402e-98f2-e0a44efb18c4", "value": "T1F9B41280EDBB3E06FAD23872C88F3864EF987950D3551B46A95018953EC312E0FA57E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675482156, "uuid": "645774ba-64c4-4916-b275-5842d309e804", "value": "6144:qQAKnxpuRjkCRXL2Kpl28JKjlMIBbDAi6dc6g:FnzAXiA21pMMDAFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675482156, "uuid": "46a9df55-45e0-48d8-bf10-214a139dd7f5", "value": 495926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675482156, "uuid": "a7ac34df-85f3-49bc-bd73-a234c0303029", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675482156, "uuid": "4388dd4d-d859-4c7d-a8a3-19abc87e6185", "value": "UBJO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b38f87f-a45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675494323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494323, "uuid": "8635f663-3e99-47e0-b5a1-6802e11a51fc", "comment": "Malware payload (Amadey)", "value": "1d8228fff102f733155be32d19071261", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494323, "uuid": "d479eb2f-05fd-453c-8a05-7f1161878577", "comment": "Malware payload (Amadey)", "value": "c691eae3a347f5b26aae1103403eacf2f8ab7421b2d6e4869c93cd55151ad590", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494323, "uuid": "5a2e0bea-4f2e-4f68-b2e6-1f88dcb921bc", "comment": "Malware payload (Amadey)", "value": "30b29630f9179d0f55fd350e65e922edc9b7fbae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494323, "uuid": "4b6568e9-e29c-4439-9cf1-825b98cbd715", "comment": "Malware payload (Amadey)", "value": "348eaf1f44371866cb3f737b52d63ce234ed23d240951ae00cb67fef527285b4f5a16f1ecb2b14a8919e4d00c5260d24", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494323, "uuid": "8e186b71-3723-4d87-a3d7-a7e7dbe55fc0", "value": "T105D412337690C2F3C95751347C14E659BF7EA8384874998BBB9A17EA4F782C1363630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494323, "uuid": "dc6e829e-129c-4626-b606-d3935e070176", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494323, "uuid": "a88d7ab2-2668-4298-a2e5-7eef23c8a4dc", "value": "12288:WoHAr0XKEm6+IQxzxq2WQkMlP4DGW4KvtoTwUb0SToWYJh:W7ujr1QxFq0LPLW92TwUghX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494323, "uuid": "63d321b9-850e-415e-b10a-5ac81c025a99", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494323, "uuid": "fa9cdf50-8f33-42e5-bd7f-34d66eff1b89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494323, "uuid": "64a562f4-c498-4329-bd04-2f1b78655e60", "value": "1d8228fff102f733155be32d19071261.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5547b66-a4db-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675549879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675549879, "uuid": "7a97f55c-0999-4c53-8a6d-ad64c652d764", "comment": "Malware payload", "value": "027195c3aa8119f23f59abc976c2f443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675549879, "uuid": "573e6475-0c15-4091-8e5a-411cc3484a0f", "comment": "Malware payload", "value": "c918be51dd1f8d17c15126e156b03975949d8783e0a5589b1d2c3eedbe602f2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675549879, "uuid": "44481fa5-3f8b-41d3-bce3-6a3b15c0e5e3", "comment": "Malware payload", "value": "9ab36cb901a6ed73099a73cf5ddcaaa74a54926c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675549879, "uuid": "2df53653-c192-4399-ba5f-1e8ce8d94b8b", "comment": "Malware payload", "value": "41b5ae639cf7c24df36a5b63c0bc16ea47f25eea5a2498125d6cc3c49782dad607245f146f2cbffa3cc88a748f23a39a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675549879, "uuid": "5dfe88fc-db68-4894-9eef-33f4a38f03fb", "value": "T115B5DF065C98E1A7E0C58FB0CCF76EFB5C15EC79C0B5481791083EFA3A76E522C5A629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675549879, "uuid": "37f5f52e-2748-4b5d-bafe-ff2e35772438", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675549879, "uuid": "40ff89e5-0fca-4ab8-b340-631cbe696bc4", "value": "49152:d3ZBj9YVk2/g/HcNVRIlJUxYvivNCmI9yv7OXLCgv2MR:XBZ+HgERu+NCmINjv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675549879, "uuid": "dadf90bf-bed5-4c52-ab56-39bd394a3c22", "value": 2333327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675549879, "uuid": "244dce0f-46ec-4f4a-968a-cae54d647ee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675549879, "uuid": "31cd96f3-8b92-4b78-a5ba-1dfb59e3b093", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41cfb74-a4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675546065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546065, "uuid": "0dd0aa77-d274-4fce-a7e8-365d6e399f32", "comment": "Malware payload (Mirai)", "value": "789c5fe38c6c59d1b46136db53198a75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546065, "uuid": "9caaf4ce-1966-4965-a430-54212ebfc336", "comment": "Malware payload (Mirai)", "value": "c9524266d8e83b3e4c121e6b95d71eb48be3546fca70579f278f146f678a8827", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546065, "uuid": "187469f8-2348-49dc-96ad-0807b5f079e0", "comment": "Malware payload (Mirai)", "value": "c8e7290320a6aa78218970dbbe8f196e6893cbff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546065, "uuid": "44e040a0-7e50-4f0c-9bfb-4db56763fdd2", "comment": "Malware payload (Mirai)", "value": "77a736fdba4970262e4cf9844fe9a49aa5a391d89c72de30862d35cd8268a2d9e3649e8d4faa3613747c1a05fc351d15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546065, "uuid": "01dd6b33-569a-4288-bf13-ea204c198119", "value": "T1CB632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546065, "uuid": "b6c54044-05bc-44d5-be46-f8d9a73bb964", "value": "1536:qNSlxYmii8N1U9uO//kWUjveikg/QA83NRuxAvjWq:qNnK7kpTeikg//29jL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546065, "uuid": "5d1d189c-cb9e-4430-9fb9-0138dc24475d", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546065, "uuid": "bd1bbc28-84ba-4142-994e-e1465fac2b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546065, "uuid": "59cb279e-4a2c-4b5a-906f-ed0d118a7b05", "value": "789c5fe38c6c59d1b46136db53198a75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583634a1-a446-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675485755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485755, "uuid": "6868ac7a-d8e3-4e0c-bbd1-152e08427932", "comment": "Malware payload (Quakbot)", "value": "163123668093c039e4a6efcd844beadb", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485755, "uuid": "533c36b0-ef36-4424-9e35-a027eb88d350", "comment": "Malware payload (Quakbot)", "value": "ca5882b549611fd2fa3c767896813363ceb64d3d2f2b484b7fffa55cb7724c99", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485755, "uuid": "1b8274c8-545e-41c4-9cda-997e490d6665", "comment": "Malware payload (Quakbot)", "value": "00dfbc628d121da4fe06322fce790dfd665087e7", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485755, "uuid": "7e5fa7e2-ada6-4fd3-a265-22eb9081d538", "comment": "Malware payload (Quakbot)", "value": "d3928e70cf04c3127dfcd20fe7d318dcccc70df8b5f0fc7ff437fc98e95be0395ea0f84ae9e9dc495185b172b3c03d59", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485755, "uuid": "2f8722b9-dd68-4db1-9896-598a00a8acbc", "value": "T17D410806F339D053CF4749351B90061AE4BEE56FA9B10D2B72E69D401CA6084FCB0587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485755, "uuid": "db94f2f2-e197-4769-a611-0b3e1500bff6", "value": "48:9TZA0kFTZv0x7k53fOQJoe1K/oCkqp35A7xw7O+yAJUlzjqETZJ:BZA0clvco2URkRp3K1P94AjNTZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675485755, "uuid": "56ef8514-94b8-4974-b4a3-db9c16697be6", "value": 2300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675485755, "uuid": "f927ff40-cf5e-4d3a-baa5-8b14ecd2dc30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485755, "uuid": "28e79fc2-7059-465c-a13f-c8382dbbb202", "value": "f75391f4412d224d02096de3b0d2732e76876196e894a064741a5908696d7cbe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5a7a1f-a498-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675520846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675520846, "uuid": "a12dfa93-c42a-4bbc-9a9e-7e8e5ebbf807", "comment": "Malware payload (RedLineStealer)", "value": "40a5fecee950dcb948f7d836d353f2b4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675520846, "uuid": "890ad54b-3a55-4ed1-adbd-b290b47a0284", "comment": "Malware payload (RedLineStealer)", "value": "cb268686538fc297753f748558410f3d28aa9d0a9abe661ecc3d8990c7c7051a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675520846, "uuid": "9d4b8652-7f40-4a8e-bdfa-0599d1e91d49", "comment": "Malware payload (RedLineStealer)", "value": "54c4cfb72116997ead3d2b79368895de67541e3b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675520846, "uuid": "97d807e6-48ba-402b-95f6-fd65d09b5408", "comment": "Malware payload (RedLineStealer)", "value": "6960359f4b47c7d922abf6df23837c6e5137f961e4909308da765422ec492075518f2e7585857585e9150068c2452108", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675520846, "uuid": "e16c6c39-f67f-4aaf-bb29-51527d67369d", "value": "T1E54633EA273714476E9DB04028CD2FD52A737239B0540A48A8ADD9F273354FEDB2879D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675520846, "uuid": "79727205-2b3b-4db4-b49e-f8cf83d75602", "value": "98304:RmZBf58lDB7AYN4bjpLyyo7i3E2bQw/HBoEAXBnmPxbU/rgi4nWQRIfnFISHc:ROQtb69LVoQE7G+xXBnmJbRbnVRyBHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675520846, "uuid": "bf4f41eb-567e-4294-9d65-492710ab8bbf", "value": 5648636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675520846, "uuid": "5ae70dd5-c719-4fa6-a57a-0b9282ddc8fa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675520846, "uuid": "c052f62e-65e2-4272-9f0a-7f4b1aa205d9", "value": "Fortnite.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd914ab-a448-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675486650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486650, "uuid": "c3c82163-26ac-47a6-8564-f564b8c16d99", "comment": "Malware payload (LaplasClipper)", "value": "b7c9864f3b0a8c526e1dbba672af273b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486650, "uuid": "d603fca6-67a8-4b5e-8e6a-5291101289d0", "comment": "Malware payload (LaplasClipper)", "value": "cbda4e6ad06b72aa1b82106c8ebec0df6ff5e5ff362f1753563f0a763440a9c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486650, "uuid": "18642fcf-9eb4-424d-9f8f-07d200af5981", "comment": "Malware payload (LaplasClipper)", "value": "e6bb1719b5e83270ef35e39b7ab708391fa21adf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486650, "uuid": "d10a9103-06b0-4e35-bb4a-b5bc9901b213", "comment": "Malware payload (LaplasClipper)", "value": "800756527247085df872eace79248699986d8cec6f9cf4a8fd2d8893ef01198df7763e451ac83064a1b6e66b3dae9ad3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486650, "uuid": "467ed4f1-53a7-4e51-bad9-5a62ba5ab83c", "value": "T1B495332272C39071E45787B989099501AAFDF5AB1735AA4B3B2DA3681FB0FE1773C341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486650, "uuid": "29eab67c-c3e1-4006-8351-7db226a4e1d4", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486650, "uuid": "d2d9bc1a-88be-4849-89dc-83996b8d51ac", "value": "49152:w7heG5AIM9Xhx4U7u/mBSnw8PIoFoxBOjU7ZEKNyZY2oQ:uGXhxK/QSXPIoeCjAuKyZYlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675486650, "uuid": "8fa2ec6e-bc8c-4959-adcc-8e734c451617", "value": 1963520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675486650, "uuid": "88367e63-c29c-40d5-9238-1285eaf7f06f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486650, "uuid": "05a93db6-7710-4f28-810d-87ab44d4d2cb", "value": "b7c9864f3b0a8c526e1dbba672af273b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be29a50-a4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675545971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675545971, "uuid": "2ef56b0c-6282-4190-b20e-81c80cec5e28", "comment": "Malware payload", "value": "82653d847ef5304b9804b263f8f11eee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675545971, "uuid": "c2e089a6-f846-4385-b657-ebfc77e1b96b", "comment": "Malware payload", "value": "ccf8be824e0fb1a3311e61fc23af004c3d5984dcbcf784ea72247c82cfb16b98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675545971, "uuid": "8665ac90-2dbf-4123-9d3d-17914745ae5c", "comment": "Malware payload", "value": "ccc9c188dce102df9beca6ccaa23435b5b1fe8d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675545971, "uuid": "c4b98e15-7a11-4a9e-8337-32bb3adf34b2", "comment": "Malware payload", "value": "012c0b9913df877351563d184a9538a8ee04aa755b5f19f5d922cabcabedede88becf6595a155411e73a812199cb6d14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675545971, "uuid": "b4af5ec8-c7b3-4de7-bc48-5bc9ed17b181", "value": "T1DB14D03236C0C072C5AB15344C64DBB56BBEB93056B48A4B77A81B7E9F302DC667B346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675545971, "uuid": "1bbd4bb7-8722-4ac3-b700-ebebefd19005", "value": "847f96cdadc895b3547edbb7a505a62a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675545971, "uuid": "0c7cba50-7655-47b3-89d0-411e9faf3adc", "value": "3072:Lpnff9wPh94Lf2LzYIW3VLL5wG5HQgatgCCl0HBu5kkM0rN1ejW3Y2B0f:LpNAYLuoIcLinmC+0HfkrrN1iuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675545971, "uuid": "a81a3561-0e44-4b60-b596-a9ea79889cbc", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675545971, "uuid": "12746fde-4fcf-4fd6-8ac6-864e27089d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675545971, "uuid": "a65b10fa-d9ba-4da3-8343-46f548b44d3f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e167cf-a4b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675531895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531895, "uuid": "391d4ac6-f175-4e2e-8681-016d178221e7", "comment": "Malware payload (GCleaner)", "value": "d9d3501dce8f05ef4c905db79d274af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531895, "uuid": "85d9bca7-f190-4b80-abf6-7de4633a9705", "comment": "Malware payload (GCleaner)", "value": "d032178ccd12b10f97c8f4b37ab7134f9c3718f8c698a20da1cbe1fe5159870d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531895, "uuid": "a7d86a19-ff67-4346-8b3d-eb831eb0ab73", "comment": "Malware payload (GCleaner)", "value": "f89be05c19538eb33494293990ef01d2343a98ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675531895, "uuid": "8e84a785-766b-4d7e-9474-cc220d2306fc", "comment": "Malware payload (GCleaner)", "value": "e293dd8480a52d5b056c637f1261a9ccb4894a75f368bc1d2b4464212b2501329a5d7e6e49b56f8e56ef555f7e031436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531895, "uuid": "145f2251-8785-47d1-8afd-41cfb7113810", "value": "T113B5DF025C99E1A7E0C98FB0CDF36DFB1D51EDB9C0B5481391447EFA3A32E122D56A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531895, "uuid": "36a5b68a-b024-49e0-bcbe-046e3228259b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531895, "uuid": "df4254b5-bd19-4c38-b65d-2114902afc6b", "value": "49152:d3Zk3ejRVljDy2L4LJroAIcNQJDZa4RnCLCgv2MR:XCeRt4LJrFXiJ84Jqv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675531895, "uuid": "2b70dbee-c45e-41f3-abe6-5e8c222647f0", "value": 2316441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675531895, "uuid": "43a173a2-04ab-437c-bee0-d85243ce2a5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675531895, "uuid": "e2f575dc-347d-4c0c-b429-0221d2bc8445", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9651b956-a43e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675482423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675482423, "uuid": "6c1abec5-e19e-4a26-ad09-97306c01a2bd", "comment": "Malware payload (GCleaner)", "value": "44383d8b4fdd4732fb6ff0174433529a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675482423, "uuid": "4bde8729-8606-4da7-a028-8aef1e7abe26", "comment": "Malware payload (GCleaner)", "value": "d111ec53f8b2b607690efdb923ef287b18bcc25c656e1b0c1ea327d1416899f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675482423, "uuid": "37bf219e-4688-4fdf-bf23-454ced585698", "comment": "Malware payload (GCleaner)", "value": "ed6257749dd594ed0a535cf56bbe32dcc10ead07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675482423, "uuid": "60f60a02-78ed-4b9e-a904-12e56d45a82c", "comment": "Malware payload (GCleaner)", "value": "1b9eededc43393ff3aea09375e4bc8c2cf1aa02a1e2902ec18578c071d1c9f23190a72f77e97e95af9632599fed1663c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675482423, "uuid": "1c676698-d0b8-4416-a3ac-7eb5a0637b6c", "value": "T154B5DF065C98E467E0D58FB0D9E36EFB5C11ED78D0B41817D1083EFB3A32E522D4AA69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675482423, "uuid": "03b12878-8d02-4cc0-a9ba-8b680203e793", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675482423, "uuid": "5aa637f4-ed40-4513-b83c-12e7ab1771f8", "value": "49152:A2ZPbwklvCECBcs6hSgaVhjvHufecegP4xxiLCgv2MR:Njwkl/CaxcJHufezbxEv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675482423, "uuid": "a64c54d0-1a4f-4c51-9046-a0029b645a62", "value": 2278911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675482423, "uuid": "43165f0a-c5d9-4ee3-a950-a5bfdc470c9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675482423, "uuid": "18d4aa2d-5e1f-4515-9201-65f72b20b116", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688962dc-a49f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675524007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675524007, "uuid": "637e12cd-a47b-4315-bc66-6fe3d0b01dee", "comment": "Malware payload (AsyncRAT)", "value": "a037f22c953e5236009d7ab6c929a05e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675524007, "uuid": "ac2a7eb2-a335-4482-97c6-6877c9dd193e", "comment": "Malware payload (AsyncRAT)", "value": "d22331111020609818ec6b06fd33c7b22a145dc25b51e65aad5d37e708fdba5e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675524007, "uuid": "c564c246-c8c2-49db-afb4-39a1e0c52eec", "comment": "Malware payload (AsyncRAT)", "value": "129a7045be97bf7a9ec4df5ccd4973982262c677", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675524007, "uuid": "7f692f79-ce0c-4765-9fdf-ee05dd2d0d6b", "comment": "Malware payload (AsyncRAT)", "value": "1493569651b467dcc8d4071c734c221ecd55e784ce5acab2e707a34926032a1ae564cd5a25dd445f13960a6e2d18c4b0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675524007, "uuid": "5100e524-d40d-4b72-a3ed-6bfa20914d5b", "value": "T160B633519EA9ACBF4B7C833DA1BF1F1D2AB44FD1844CA9EB23E174C3064AB91145BC19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675524007, "uuid": "768b9824-d623-4cc6-8f5e-fa1e31711df5", "value": "49152:xnUFXUHFtQ0tiykxySQt+b2XMCrjDh/PUjNHIzNrloTCw8C4xnuyaxaYBEDPGzyS:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675524007, "uuid": "bcffd5f5-abfb-45ea-af05-8f64850f77f3", "value": 10703252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675524007, "uuid": "47d7c9dc-c697-4748-baf1-f8e9bb378005", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675524007, "uuid": "fbe8e0fe-93e9-41bb-8cd7-2522029ea767", "value": "Fortnite_Injector.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04347690-a4d0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675544884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675544884, "uuid": "90b260d7-731a-476e-9a24-218679d36474", "comment": "Malware payload", "value": "bcd81d79aa027fd710b3d02cd13b8c26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675544884, "uuid": "ef012d34-df0c-4295-839f-010f92ea0da6", "comment": "Malware payload", "value": "d27f766afbb457fc1fb45e09a07e75839a44117e35ba7ba5003fc90d599959ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675544884, "uuid": "0084f3e2-782e-4b73-be00-a80d558f45bf", "comment": "Malware payload", "value": "b0a12df83507169ece42a0b649e13b98b672c646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675544884, "uuid": "5298f412-e518-43f0-9e78-7d53c3868e07", "comment": "Malware payload", "value": "4b75fced9ce228eaa33d18e7819222a0dd1e9adb9d1966fc52e79a3fbdcc0841e490a221c91e34e052d289a44c7dffce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675544884, "uuid": "ff6ac131-d1bb-4bce-8224-fc98948d10db", "value": "T192F3D03631D0C072C56A24309875D6B5ABBEB83152B9CD87BBA41F7E9F303D1923B256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675544884, "uuid": "b6c95e06-ac0a-4187-b14d-4fdce2bb342a", "value": "847f96cdadc895b3547edbb7a505a62a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675544884, "uuid": "45b25fe6-3a5b-4c8b-a642-5930d47b5aa1", "value": "3072:JpKCO9q/LvL3Z3CSWYRLz5fuJ2c1lo9Z1JNFViO/O+:Jp8SLLJSS9IloPrNFrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675544884, "uuid": "ba8e0b6a-de41-4cf1-a763-7696401d7856", "value": 163984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675544884, "uuid": "ca357261-4228-43dc-a023-b40ba41e1077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675544884, "uuid": "6796912e-b9eb-4df5-82a7-d0845a7f1da1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c411ec0e-a49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675523731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523731, "uuid": "066164cb-6c50-45c2-9fe1-ef0cdeba37a1", "comment": "Malware payload (Amadey)", "value": "5f2c9b05ea1cde4fd7f6dc8a59b50e76", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523731, "uuid": "86b96ffa-4c54-47ef-af44-69e6cfd9445e", "comment": "Malware payload (Amadey)", "value": "d410bb2728b8da8f392cf73c7dff7a5b4854c3297d2a41e1e7014ae9ba1f8a52", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523731, "uuid": "0fef70e3-87b7-4c90-826c-4df84be151da", "comment": "Malware payload (Amadey)", "value": "9d439a7a910a30afd7e26b7f602967362654e54b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523731, "uuid": "87943593-c140-41fa-8fbb-e706564061c1", "comment": "Malware payload (Amadey)", "value": "9dcc810fbb1351b25f8e39881cd433fc3145e29c2a35da0068b62608173d48e41246fb47ab23249144a707adb65c2f76", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523731, "uuid": "4bc97c1d-e85b-4689-b071-16f4e38ef590", "value": "T124D412323590C072D87704744720FBE9AB7DAD325978D60BBBA95BAD9F306D0DF22249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523731, "uuid": "86d0da7a-0f50-4e30-b864-f3ee4e801ad0", "value": "be7581a01c1ad2f53e81adb31665eb55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523731, "uuid": "a648e46e-c97f-4efb-ba11-2de6f1652412", "value": "12288:IpVROeMKewmNPs08BPxfd5dL2t5i4ByCbNB2OVCbbY522O9pSl5nUW:yLYNPNiPxhLy5iB6UOs/bSTUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675523731, "uuid": "7202677f-4429-47b5-8dbb-70111b4f9f7e", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675523731, "uuid": "ea62622d-953d-4dc6-8c6c-14e38e29e76c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523731, "uuid": "0de68054-457e-4409-9257-b5915daf0955", "value": "5f2c9b05ea1cde4fd7f6dc8a59b50e76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537476a2-a47f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675510228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675510228, "uuid": "4fca90e3-d89c-4c4b-bcaf-2ae9d457b3f0", "comment": "Malware payload (RedLineStealer)", "value": "db7d8fa729fd164ca2a5794341058995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675510228, "uuid": "e0df8e38-8e91-4cde-b5f6-a0aff1fd411a", "comment": "Malware payload (RedLineStealer)", "value": "d433481a5ec4b4445828802f528b19d54f9be76561c1386e0a458a1ccf2e034a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675510228, "uuid": "3ef9a3c4-54d4-4b18-b6c2-7899e6eb00a3", "comment": "Malware payload (RedLineStealer)", "value": "dae40301699f4bfec6eb5e673da2d2fc786ce40e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675510228, "uuid": "42ab82f3-d472-4a76-b7ba-28d90f0bcf2a", "comment": "Malware payload (RedLineStealer)", "value": "1addfa06c66e565c1eb2ced358e5932257548bbe0a386717bd0c6b031ffef0b46189b4bb19bb3f2166f0651edc97d13e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675510228, "uuid": "8ce7939c-542a-4b17-89bb-a01a52fc2e66", "value": "T12D54F13E36F1D0B6C57B15368C24EBA4ABBEA5300578C907B7981B6DDF306D06B26346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675510228, "uuid": "2e73a9a1-76ba-49bf-bcfd-425ae9d0b470", "value": "aea30aa8311fa7a3ea56995ee020184d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675510228, "uuid": "62b82960-6fc3-4a81-bfcf-58661f66eba9", "value": "6144:4bdLWlXX916xfF6NfUp2NjJdyLgEzAsStlmJTmKHY:4bdeXN/Nf0O9dagEsZOp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675510228, "uuid": "2609f7f8-324d-4131-8e5d-de060877d529", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675510228, "uuid": "49478b0b-b11d-497f-a841-3e1c2cd9e72a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675510228, "uuid": "12e01007-28d6-46b7-ac97-22849d200b9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf6013b-a4ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675535504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675535504, "uuid": "e69aea32-1a8c-4470-bb93-32fbeb9f7abe", "comment": "Malware payload (GCleaner)", "value": "b066cf877c0d3bf70475d9f5a656143d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675535504, "uuid": "346cda9f-2780-4967-bddb-37ba53f0e77f", "comment": "Malware payload (GCleaner)", "value": "d52e0d5d4a1af3a9d2c83d6d7afca153a7b1d219f999e4e8f2315c79487b02d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675535504, "uuid": "bf55a31b-7ce5-4794-968f-4bd3efe9ab91", "comment": "Malware payload (GCleaner)", "value": "ef1837c7b61013524bc7800dcb5438ee315ff02c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675535504, "uuid": "add87326-a8d4-4751-b8e9-353edb2c00fa", "comment": "Malware payload (GCleaner)", "value": "90a50509d157f596be1af691f8529528f90fc73bbc1c27cf452140f62e93aeee63bcf0daa3b2678ee214cd6d2b0bc93a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675535504, "uuid": "19fb9808-e2c5-4d0a-a803-f9941ca4ecad", "value": "T110B5DF025D98E16BE1C88FB0D8F75EFB1C21ED79D0B4581392447EFB3A32E522D46668", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675535504, "uuid": "d5e0ea29-9e13-440c-b3f6-34a2228b02b7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675535504, "uuid": "f5d06d43-4844-429c-af3f-69dc9aa46e30", "value": "49152:d3Z0tg7QSmghqYxeme9qomrvikGbRNDRklVqLFBoxvdVYZLCgv2MR:X0qFk8vikGbXDRklVqJBox01v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675535504, "uuid": "4970f02c-756c-4692-91c0-7d6e01ed2662", "value": 2329976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675535504, "uuid": "12359803-8c27-4e30-b220-77d584c82851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675535504, "uuid": "be7ae9d5-0ee5-450c-ad00-873b3ddf42fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bd94b1-a440-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675483219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483219, "uuid": "7e89b311-7180-4ec7-88ad-f7dc44dc4abe", "comment": "Malware payload (Amadey)", "value": "3bb17138f075edbb3c7ff1ae371378ea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483219, "uuid": "7d9be67e-f914-46ff-8f3d-2911e3cfb370", "comment": "Malware payload (Amadey)", "value": "d589a162929b1940afea294a313cf1e64bdb8888b9aaef46bba637314b13ab92", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483219, "uuid": "6b8bb872-ca36-4b03-aa91-dee2183b4617", "comment": "Malware payload (Amadey)", "value": "69cc77ec60cbd346c3488240380a18df4d581ec4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483219, "uuid": "ac02dec1-12bc-4453-9147-51d20ef48d10", "comment": "Malware payload (Amadey)", "value": "a211c49aefc6974de2023d943a35d99310afcada3b575bc4a8754e8b2d24cdfc89313aaf5313abbb8eb5c75161f44ac3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483219, "uuid": "baa69308-56d2-4371-8881-6f67587a7414", "value": "T15114D0323690C076C57657305C64DBA56B7EB93086768A3BBB950BBE4F702C0663633E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483219, "uuid": "41e67936-df5b-458e-9735-4da0360931a0", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483219, "uuid": "e752d1c4-2971-496d-a3b6-ef54cdeda7d7", "value": "3072:2lEnHcVUWLFastRoWiBg5X1IZBOQCRVqnFP0feNPA1K1XJIA1:2lhLcs/oq1IZBOfKyfemYJIA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675483219, "uuid": "b1ca0a3b-a36b-4643-a1cc-9f60a548743e", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675483219, "uuid": "ddda6b31-c22e-4d52-87e1-3c95f1156c2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483219, "uuid": "666d5fa8-dbf2-42be-b19f-5bbf2b5c7e8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c1fa8a-a474-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675505484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505484, "uuid": "6258cfc4-44bc-4149-a3fa-a91a0c84d9ae", "comment": "Malware payload (CoinMiner)", "value": "08c03747cae227ba50ac8cd13b032b8b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505484, "uuid": "9f7fbd5b-5ffd-4c11-92fa-364d708ea739", "comment": "Malware payload (CoinMiner)", "value": "d687c4a51b2b34ee6c4678c2b950640c7048dfddb914f332b6b3bc96d323f16a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505484, "uuid": "d19c3013-a7d1-42e2-9a08-00ce374a35c4", "comment": "Malware payload (CoinMiner)", "value": "5d2f74e18218497ce7e15c099b7d6ab885dcf436", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675505484, "uuid": "daee94e6-aec7-4888-8240-f7ca1416b5ed", "comment": "Malware payload (CoinMiner)", "value": "1dc5396d9ebb6bec3afacaf28717dcb3abd9445ccd553113a1879aaf5c1718f1b22e4bce947f9eba27da087e9c30db1c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505484, "uuid": "8d5d448e-7c42-49dd-af55-ab2a7fd101ab", "value": "T14A0601732344CC69D5597C34C39AADF79317AC74EEDC072B3791BE1A3932A849CA2849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505484, "uuid": "7e7e3d40-07f2-4140-ad39-13e0364739a5", "value": "e4e732a4748861083534c64deabb68bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505484, "uuid": "6d4f7352-3c3a-43e6-89b8-9f5f0b3de358", "value": "98304:JZ2V03iCieQPi4jR6AdLOH/08VVxDdKnSdzWVKG:vy03D4oAdLgLpDAnSowG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675505484, "uuid": "e8d337d4-b737-4eb7-a863-53ed25815453", "value": 3694880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675505484, "uuid": "06ccb050-15cf-47ed-b0f3-2a1af33d976d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675505484, "uuid": "3520dfea-1f4a-494e-82c9-ca37bee24afb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcb2575-a4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675546085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546085, "uuid": "d049cc7b-4efa-4dd6-b9b9-5d23fb70b0cc", "comment": "Malware payload", "value": "3765ecb1572641b587d2b6b24fc355ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546085, "uuid": "867c4463-5e6d-4070-8092-aecc5daac17c", "comment": "Malware payload", "value": "d84022a5f778aa195aacc47078cfc984785fad47bc81a6e7a912a3aa4bc6b63b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546085, "uuid": "02c8512e-b913-4a51-93a9-107dfcdf135a", "comment": "Malware payload", "value": "f3e2926772ac1b787d4a4e49c53b9931edba3d76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675546085, "uuid": "d498d141-d327-4c7d-8603-75b4b1f7c88e", "comment": "Malware payload", "value": "cbedb0c3a7dd723987e2a97624fca3e5da87da440a8c045b565a3219c8eced773d401df41aaabebde5d2bfa82db2715f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546085, "uuid": "907d555b-64b1-40b8-998e-a27cfb7d1dbb", "value": "T1E214D0F136D0C07BC4AA25315964DBA47BBEB8309670894777A41B6DAF302D0A6FE317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546085, "uuid": "728d5ea2-bc5c-48a8-9c23-c1a1b108fe66", "value": "9d027e1822da283963b2da86a5b0354e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546085, "uuid": "e3022b23-ccba-4088-b96b-915b050d5f02", "value": "3072:CtrOYxMtlQpLNW+WwnX5mMRta05VI2zosFvx+Tw3DIffSRsN:CtrI0pLA+EhGjFjDInSSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675546085, "uuid": "f4610919-3b41-4670-a609-a136408a1f5e", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675546085, "uuid": "bcc4e9c7-b8d6-433c-94e7-b000fc2c98c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675546085, "uuid": "b4af7518-1522-43a5-ba3c-97c00d287975", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565118ee-a486-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675513239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513239, "uuid": "dace3094-2e81-4f64-bfa9-51f3bf42837f", "comment": "Malware payload", "value": "0db25078251c1a4bdb7868fd6fad2683", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513239, "uuid": "9391a8d9-c313-4d8f-b5fa-daad10bd9a8d", "comment": "Malware payload", "value": "d8e9afd22bbec8cfbf0807869f111bd66e054ac71f4c8bc956fe390de055d8a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513239, "uuid": "0c089f96-ba55-472c-b816-ea94c7e1c477", "comment": "Malware payload", "value": "0d325abd43a49ac366780f4a79260973ba69f241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675513239, "uuid": "34bac11c-6dfb-4649-8ec4-9e1acfc04525", "comment": "Malware payload", "value": "bc48b93828f0adf67d2fdbe533b4cf0f3dbd7b32c00eb2ff1dd1051f1e369ec34b2f94a2627061d3c6cf54c40d6b628c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513239, "uuid": "1429a2f1-8be1-45fd-bd49-26a9608375b1", "value": "T17F763315BFE240F6F3D60CB2AF561FD660AAC9754E0A4843A3E493BA3B7C446C50DA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513239, "uuid": "cf3a8979-ad4f-4246-9203-e0abb936ead8", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513239, "uuid": "e6a8078b-42ae-477b-b75a-903f44f65a89", "value": "196608:91OqWi3rxyKG3DihKgj9pSieJSgucqhxBMg+wd:3OqqKGc9pSieJgcYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675513239, "uuid": "ea82d005-45c4-436e-b361-48a684bd19bd", "value": 7619859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675513239, "uuid": "8a060e5e-d69d-46fc-97c5-5e5391959337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675513239, "uuid": "37ded818-672b-4ac4-9003-6ed563eed333", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd75e77-a4d0-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1675545011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675545011, "uuid": "f692463e-e690-4e1c-bc9d-203d55bf6847", "comment": "Malware payload (PrivateLoader)", "value": "008ad6f06b42fa51f990a67d08a39cae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675545011, "uuid": "e5ee5f2e-7624-4631-b8cd-8c43b81656b3", "comment": "Malware payload (PrivateLoader)", "value": "dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675545011, "uuid": "d32d8923-2ab5-47fa-a171-92dd97d24163", "comment": "Malware payload (PrivateLoader)", "value": "74be7d963aa3fa076e2119cebc5ee4a246069941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675545011, "uuid": "3ee53bca-a00c-447c-97d1-370fd5c8c3dd", "comment": "Malware payload (PrivateLoader)", "value": "ef6e64b5d030f2303c72cf2a4d32107f653dff1a01c26deda0d39b56c3cf0e9404be4028f3ec84253f944c40f9c45f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675545011, "uuid": "5987a9f0-6caa-4187-ad34-1df466bf2095", "value": "T14DF533D1E2DAC0FFE83126B458990FB0FF7282009964576F53502E7DA944AD0AAD5E3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675545011, "uuid": "f6607a46-e09d-4d1c-b5b4-3789a7a4576f", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675545011, "uuid": "bda3e1f8-5057-44d5-9175-320353ab7f49", "value": "98304:JhZ2y+lmG4JJsHf608xmtdOVTjQwiH11XD9ml7Js1NR8:Jh0y+lmzJJY6dm7Ol9M11XD8l7Js1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675545011, "uuid": "f09ef002-5b31-44f5-bb84-323787e41867", "value": 3470689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675545011, "uuid": "34a71bc6-419e-4209-b59a-4536e47577d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675545011, "uuid": "e6861f54-3e50-44c6-8866-c0ae9132255a", "value": "DAD9E695E9F592E48326DD349556F81987C115AD152BF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6a14fb-a4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675553111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553111, "uuid": "c5e85c7e-a9f0-46fb-9587-151e8b41da5f", "comment": "Malware payload (RedLineStealer)", "value": "937768008be3b71478be77f512943a75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553111, "uuid": "acb95bd8-21be-4ef5-8bd6-5eeb1a8b2b46", "comment": "Malware payload (RedLineStealer)", "value": "dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553111, "uuid": "af8fc53d-7316-48d7-b4b7-079f0bc21fe0", "comment": "Malware payload (RedLineStealer)", "value": "be2c1470c46eb18c49500dd5bb07a7cabe588398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675553111, "uuid": "c2cc698a-56d7-49f3-9a20-61174e0f88df", "comment": "Malware payload (RedLineStealer)", "value": "1b44a13aef7c99be6beeba7fd7422b0865ec17bbda0ed25435d5fd95b866f941325d8073978fe2ca9a25572beac7553f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553111, "uuid": "67b2cbeb-8f91-42e8-a391-5bdcbacb0f1b", "value": "T1E5F533B1B7D1C0B3E24417329ABD67B2E4B9D3EC173915873340924F8EA8956D13B5A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553111, "uuid": "2236c858-fb2d-461f-9dfe-254df9901c8c", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553111, "uuid": "de503c44-8ab1-440e-b34b-852e2c4b46d6", "value": "49152:xcBbNrb9o7jgMOHIT8SdFQE0+9DymbzgZklR2IM5AZ1UEEwJ84vLRaBtIl9mTScm:xerungqJnQrm/FP2wZ1WCvLUBsKScYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675553111, "uuid": "8bcc5296-0108-4293-afbf-09906b977446", "value": 3454874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675553111, "uuid": "caf357d7-3276-42cf-9bbd-14f274455c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675553111, "uuid": "4de76064-f01c-450a-8d00-fee859385b27", "value": "DC812FA1AE68DFA017CFDE268E2AE523019308B102BCE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612c367d-a45c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675495219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675495219, "uuid": "815df275-f55a-48c7-b303-5933701e14be", "comment": "Malware payload (Amadey)", "value": "ac5574535f352784a90ce06b4ca1eeee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675495219, "uuid": "cb576918-3202-4e6a-a5e7-c34006242d2c", "comment": "Malware payload (Amadey)", "value": "de9573b6d66e311748f8dd4deb632be37d5c03430dec960f3cb964fe72695a27", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675495219, "uuid": "5e4f79ee-cc55-4a2b-8ee7-236443c5f2a4", "comment": "Malware payload (Amadey)", "value": "c761f06e059d7cf90e066eb9bc8dc0ddbe8f52e9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675495219, "uuid": "ed36c300-701a-480a-8d1d-96f0a440aaf2", "comment": "Malware payload (Amadey)", "value": "3a2ffb60051bfcb924e85fcf72265fb7f3f5b017fd1d3c296040f441bde36c35f55fd4110fab79d22133ae09cd49ebbc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675495219, "uuid": "06b70415-18d0-43ca-84a3-5f9245090f19", "value": "T15905223536E0C431CA6E61344840E9A97B7E28305672B95B3B281E6EDF75BD05B37F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675495219, "uuid": "20a3cda1-03b1-486b-af59-ace75445594a", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675495219, "uuid": "3a3d44e8-a580-431b-a4bc-3739c67ae2b1", "value": "12288:LlOVfbq7+SvonAkxON2Y0rfgRjBDELkDN/UYQtiJ98VNhfIvRVBXpIgF:LK7SvonFfEjBDEL01yhgvPBZIgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675495219, "uuid": "53dbe659-d579-47d9-a2d2-69d28b4b859c", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675495219, "uuid": "3516ac2b-3b7c-4a53-ae9c-9a6e663fa965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675495219, "uuid": "8c544dbe-eb31-4a7f-a5ed-55c47209b355", "value": "ac5574535f352784a90ce06b4ca1eeee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2cd676-a431-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675476927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476927, "uuid": "fa94bc67-6f25-4371-800f-00e0d36a0869", "comment": "Malware payload", "value": "8d0557bd047b783909c4d6c49686771d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476927, "uuid": "03b1b0c6-45fa-4bb9-979e-695154a5f5b4", "comment": "Malware payload", "value": "df473029e1d53c877f137c555093d8f81100599334b273ef7fe98efc3dc560ff", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476927, "uuid": "dd92a0cc-03c8-49d7-8a6a-9b9a5f596cc9", "comment": "Malware payload", "value": "611185768383d200fc8d9d71cd418620bdffc0fb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675476927, "uuid": "fae6bc78-e8e3-428a-96a4-7ec4a2059186", "comment": "Malware payload", "value": "45c10847f690eb8b76deb236240b9b10bf5a894276d623fd49022afe614cbd675d4fd4cb4e6cf481510088f6af64dfe4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476927, "uuid": "9fa91b4b-b6d4-4d2d-8adb-d4f6d29d0a03", "value": "T1052733A71C16ACDEC031A47A457E2344A975CA2A3AA237121044DFBBD5F3875CADDECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476927, "uuid": "163ffea0-34c8-4265-ae57-b55d97f8650b", "value": "393216:0a8ZssJA35z7A79L+gM91mbgafiubchZ7bxT9i/zVN2I+TXjVAKpPbNiRSKcsPJu:9yJA35z7c5SLmbBffc377i/zVN2IkziK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675476927, "uuid": "dd815237-b38f-4273-b7bd-5d522cacbd23", "value": 21503229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675476927, "uuid": "d0b16490-4ff7-4451-ac85-abc298a042e4", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675476927, "uuid": "975a943c-149f-4dc6-8b1b-42e3aebd95d7", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0675d73a-a449-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675486906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486906, "uuid": "2ce2734d-1050-4d37-9400-2ffc4b0f6222", "comment": "Malware payload (GCleaner)", "value": "96d7c0b6f3d7c8bf47506c11ef0ff2be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486906, "uuid": "48297c90-ccd8-489f-921a-e29c91d620fa", "comment": "Malware payload (GCleaner)", "value": "e127f89617ab65b8ba398f6deaf85079b8c958d45aa8c7183ad79f505f5c5a85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486906, "uuid": "899cba67-a68f-45da-b395-62f0d91c919f", "comment": "Malware payload (GCleaner)", "value": "d49153f6a6f87336e73b7aaa124b715ed60925ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675486906, "uuid": "91bf85d1-d259-407b-89e9-b450cde15741", "comment": "Malware payload (GCleaner)", "value": "a29034301e7f68c0a8541f105b1cd89b46c5fdb3cd3d5e9d4cce492f3c530bdee161ecea516f2ef353a02d6575192c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486906, "uuid": "49af8bf9-2235-4ede-bdec-798efe293425", "value": "T19FB5DE025CA8E1A7E1C58FB1CDF75DFA4C15ED79D0B8091791043EFB3A36E022C96A69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486906, "uuid": "d7429549-7e53-4b59-b71b-21ba3acf4e5d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486906, "uuid": "6e00839e-9e3c-4155-b3aa-8d1b491277c3", "value": "49152:A2Z/J70iEs+PLsnkCh9q5pOlCqLCgv2MR:NeLYnkChopOlBv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675486906, "uuid": "06e31f7c-19b9-453f-a610-9040577ce542", "value": 2309346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675486906, "uuid": "d6c336a1-b2d3-47b5-a0b4-6eeef979784e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675486906, "uuid": "76bca9ce-7131-49db-b31b-cb49c38f50e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791dca54-a427-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675472496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472496, "uuid": "2f5f3647-ca76-44f6-9f63-e3b998f78767", "comment": "Malware payload (RedLineStealer)", "value": "7123cd3eff3fd50e5cdd5e867f3ec108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472496, "uuid": "329b04b2-da39-4a38-baad-b3d3a0fac487", "comment": "Malware payload (RedLineStealer)", "value": "e194ded02983d6b6cbf7d2b36b315b07af6394e83d132a956e5ee7d5f0408695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472496, "uuid": "b2eb71f2-4ceb-44fe-a197-570ca1e3daff", "comment": "Malware payload (RedLineStealer)", "value": "eeb9dc18800e2c2517654e70f334d59c3165a927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472496, "uuid": "46f58239-c928-44ee-930f-c4d796dc7704", "comment": "Malware payload (RedLineStealer)", "value": "f9195a1051fa8770a9b3ab0e2dc489631bdc3017b2a772a6ddb242c82356b4df1d0a40a2dc9b044929e6d3ff1e445582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472496, "uuid": "fcbfe224-3630-45c1-ae73-7d05bb9f3b63", "value": "T17A54F1223690C372C57B10305934EB69FABDA9309275945BB3A557BD8F303D0AB3639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472496, "uuid": "9cd13824-f046-4d3e-ad90-8e81607937ef", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472496, "uuid": "90740c41-fa5b-45cf-864f-6e7f4a2042ec", "value": "6144:M8tmPLtafAlxWikCo/AVKfQsLjNTpixMHUUF1/FHZ6t2gIY:FtmPkf8xWikC+IZyRFXHsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675472496, "uuid": "9ea313b8-5c04-41b6-8e81-b52ee87f6bc7", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675472496, "uuid": "edccd247-c170-48ea-9cd4-80dbcd1f4615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472496, "uuid": "14500913-29c7-4b24-ae88-e2f14db90f8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c466d1a-a455-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675492231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675492231, "uuid": "fb523502-8e8b-4ee7-91c0-1ed31e0b5b04", "comment": "Malware payload (GCleaner)", "value": "4b5337ac07caffcb2866568f083891c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675492231, "uuid": "dba2d40f-41e9-48e5-bd3b-a0d2eff962e2", "comment": "Malware payload (GCleaner)", "value": "e198871348eed2ffe4aa94996b7536cdc8aab3fef7cb3b8692cc99d00cf7c42e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675492231, "uuid": "b47d932c-bed2-419e-9c86-d7f5071bc364", "comment": "Malware payload (GCleaner)", "value": "3efe60b5cde29615c6b7c55cfb96f78eb5cdba1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675492231, "uuid": "4da4cfc4-aadc-448e-abba-a8a2bf9eb9e2", "comment": "Malware payload (GCleaner)", "value": "ddcb76ada771a7844be9e349340571ec7289b3a8778eb34dbe62d70bb0efd392b7d93895cb9a5ca3c53bfe8a798a2e59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675492231, "uuid": "31075bac-ff4a-428c-a7fb-8398a17fd990", "value": "T138B5DE565C98E067E0D88F70CCF35DFB5C55ECB9C0B8485791043EFA3A32E522D96A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675492231, "uuid": "1d3a6aef-927b-47d5-8a60-1204f2001154", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675492231, "uuid": "b7b19e0c-8d7b-48ff-9d76-513d2207e392", "value": "49152:d3Z+fU75fw4QjTAMDXoloaO00NbIW07PJWz6LCgv2MR:XSE5fw4QPDaoD00NbIW07Plv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675492231, "uuid": "42f6e2b2-3102-4e93-a6b7-23d3bc2f945f", "value": 2283650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675492231, "uuid": "fd707547-e92a-4913-9b3a-d0d11fb5f648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675492231, "uuid": "7875ef99-4498-458b-bdac-de95b30b9a24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4de05a-a438-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675479645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675479645, "uuid": "288a86ae-92c4-4628-bf45-98ca90f8dfdb", "comment": "Malware payload (NanoCore)", "value": "8c4f47a96a1f9f58ab28a2353627c153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675479645, "uuid": "691b7621-54c6-4d09-918f-3e8e1d5886bc", "comment": "Malware payload (NanoCore)", "value": "e1cfeeaabcfa9339523fae340820f04895c7a8332b806fd4e813343516928dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675479645, "uuid": "bc75fc1c-940f-4067-898e-f5d3bc44a220", "comment": "Malware payload (NanoCore)", "value": "4e7e9f7c7d630e2406fe76ad1576d35a773e9e06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675479645, "uuid": "16c8f1c3-bacc-4614-8ce9-d6348f5fd4b8", "comment": "Malware payload (NanoCore)", "value": "aac4933fbf7f59255e9ac296339e236e758653951208edc68be972c3e9ed1a893eddeef2235a42fad04fb43174139ac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675479645, "uuid": "05bc4a9a-28b4-4e42-aa7f-6695f7921ed6", "value": "T16C15FF9835203E9ECC5FC471DB791FE49E137E66430AC1D3643B29A9BA9C486CE543A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675479645, "uuid": "642742aa-bdbb-4b05-b581-7c98353d88f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675479645, "uuid": "76e63bb2-1e0a-41d4-9576-2624c2ee8cdc", "value": "12288:pLYT+m0qD8CEULAfPpIuG1JZnXiGDyQics5Ec0Y7JOfEhvlQd9DiTsOzLnWIKBlK:pE+K4ozvtYpjsBhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675479645, "uuid": "5d2ae6b3-f7bc-4ff1-8487-29dbef318f76", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675479645, "uuid": "438f6114-5121-42f0-ab8d-53b40446d1c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675479645, "uuid": "d5180271-ca0f-4eda-b8c1-3dd6f25412ca", "value": "HEUR-Backdoor.MSIL.NanoBot.gen-e1cfeeaabcfa93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b063b8f-a4c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675539044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539044, "uuid": "552edc2b-e0c8-49e4-aa02-0ead9eaa1bdd", "comment": "Malware payload (GCleaner)", "value": "27129c5ee8bca899e2074f04249bea04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539044, "uuid": "19f127a0-d90a-47f3-a938-ab3b9ca8309c", "comment": "Malware payload (GCleaner)", "value": "e1deb4e4498f7e1d595d62316cd0b081e5f51ac8c9396aec08c715de89684943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539044, "uuid": "1e39e270-9ae7-4818-92f5-6e34f39ce110", "comment": "Malware payload (GCleaner)", "value": "d2a3326d6b08870c9f8c2d9e7998829c10cc4ad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675539044, "uuid": "99cf7cfa-4530-46c3-8242-ba3b20d1c42a", "comment": "Malware payload (GCleaner)", "value": "4bf5a412e4b020d8c6a926318901bf8b495bb1690eb78d600615d01717f4eed374ff0f02a89c696a6f8d8fd2e0310f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539044, "uuid": "e7e1ef77-97a8-4c01-ac37-6a8b04b72819", "value": "T196B5DE465CA8E0A7E1C58FB0DCE35DFB5C10ECB9C0B4492781447EFB3A32E526C5666A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539044, "uuid": "eeea564a-996b-4a44-93cd-5e7b5620d7e0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539044, "uuid": "91b2e189-3e96-4c1a-9f9b-85135108b9e4", "value": "49152:d3ZlTXpxEcNCsDXmsKuEhX0EgF5EAKO2ZLCgv2MR:XlTXpxEcpKuELQjgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675539044, "uuid": "f690dfc9-0f8b-4426-91de-d381195448a6", "value": 2338954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675539044, "uuid": "ba809fc4-0e93-478c-9a6b-445ef4706569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675539044, "uuid": "0b64e4eb-a092-4962-80f6-118955245eb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3174a5-a446-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675485785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485785, "uuid": "f6aaf1a6-dc8b-49f1-b128-120eb9e9ad2a", "comment": "Malware payload", "value": "9db7e5df2af613f78f3478854f9d9d53", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485785, "uuid": "b1f5aaa6-31e0-477d-b38f-6ea905e4c65e", "comment": "Malware payload", "value": "e629accdb0cb5bc722c3be410cbe849e80ecd4d85ababc9e4c6fa31c50782cfc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485785, "uuid": "44a40cbf-dd3a-4c59-8e1f-08e5d7dda360", "comment": "Malware payload", "value": "102259d49369b28a6b556ffa7fb8b61bab239bf9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675485785, "uuid": "bdbcdf56-9e35-4a8a-9f22-141d4390f623", "comment": "Malware payload", "value": "1cf0145d71feb7e22fa26971e82b4df244b79563696fa50c162d204777a77af94a0934fea3f9ada49f5df7ceaaa955af", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485785, "uuid": "c3798eb7-3c7f-4190-94be-dd57534fd893", "value": "T1116423F56D19D092D47A70B230416F2877EF80B0B83227C2D999650667FF25E0EA37A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485785, "uuid": "5d75359a-375e-497f-80e0-67018a47233e", "value": "6144:H6ChN/A3tleEbKjFx9wUtpj8IBTGCEVAA4amygXB8rurdLebg26FkQ:hLADei6x9jpQIBT/ID4LVmrurd6kzFkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675485785, "uuid": "e6dbb12e-00d9-4547-9f86-2385bfc31fc9", "value": 321195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675485785, "uuid": "ed0f0f95-c73e-4956-b9ec-ad3e8ac260c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675485785, "uuid": "53d57484-57de-41a8-9b14-e45ad5760b14", "value": "b3a8c4c505ea3dc87be0418e739e67f97ea0f64145d62da58402d6932f169a3d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b504ecc-a4ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675529193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529193, "uuid": "ffa9b06c-4a0f-4301-b2a6-4cb94d6236bd", "comment": "Malware payload (GCleaner)", "value": "9e757297ee36a7e87c692c2caf3ddf78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529193, "uuid": "00f7f579-9e29-4e41-a83d-c6657d78ab52", "comment": "Malware payload (GCleaner)", "value": "e7cbff5ee52c9a5c08fe321038babc9a61d5bacc2e9b0718d642ea7290113b7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529193, "uuid": "e280b526-3841-4c85-9145-90c65e12816a", "comment": "Malware payload (GCleaner)", "value": "4e62f9e92deec88cbf8a8c2b684a1690f2df56ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529193, "uuid": "2f851fdd-9537-4a21-acca-42fd89e0c9d3", "comment": "Malware payload (GCleaner)", "value": "ed57be6330bb5eb2655836cafa05e8163855c5147483f6d215049c5a5949d95253c82bba05dc9c50dcca484bc18fd86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529193, "uuid": "3eaa6aa6-5a9f-4979-bb73-7f379e98e5f0", "value": "T184B5DF026C98E167E1D88F70C8F75EFB4C11EC79C0B4192791093EFB3A36E422D96669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529193, "uuid": "59e2aa0e-aa3e-4281-910f-899fdc083037", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529193, "uuid": "1085715c-7317-4743-baa1-36007503a0c4", "value": "49152:d3ZHkQRQYTh292LXdJN2gtCF5p/2a3EShLCgv2MR:XHkQRQYTh292L36NTESNv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675529193, "uuid": "3d0be9db-4c95-48c8-90eb-bd1793476ad4", "value": 2334105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675529193, "uuid": "d0ac43d5-d339-429a-852f-2975ad0f2be6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529193, "uuid": "e45eafeb-ce68-45b1-bf12-5981d05e0b95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e9ac73-a4e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675552665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675552665, "uuid": "01f71153-2acf-463f-996f-3f09cdb39c5c", "comment": "Malware payload (AgentTesla)", "value": "66fbfc62d22dfe803c4c1442059c7d3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675552665, "uuid": "6ab6d37b-7954-4e3d-94d7-57478c8fa10c", "comment": "Malware payload (AgentTesla)", "value": "e8331c7dcc868cab5d525fa31fca222c940257563099d1ce3cf3c678c85dc286", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675552665, "uuid": "1d889ded-bb8d-4f23-9b0c-9ea878e9e0c7", "comment": "Malware payload (AgentTesla)", "value": "51c8cee114cd40dcd4b5a2bcb15df1a4ff89fcc7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675552665, "uuid": "484638f2-734f-47fd-8ac6-9bc4759ce636", "comment": "Malware payload (AgentTesla)", "value": "37a64024fb39827885fb318d7044c6eb9ad78553f7bee9a6d759955f7fad5cf0dce5c98355b1c86b5700704ab8aa008c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675552665, "uuid": "3c877429-2ea6-42f0-8675-d2ca5ca423f4", "value": "T1BEC47B85EA804184DC3E6BB0243E8D25965FBEFAE8B4A54E2F4D723537F31E3543614A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675552665, "uuid": "0e9b1e20-15cc-4c3a-97aa-c225fb2e137d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675552665, "uuid": "7a9cf7af-a6b8-4d2f-955a-b0979d5a14de", "value": "12288:oYQ+uhQMEe+2lP+kn0LRDZR/bZRWNxItGzv2y:oYihE0e3R/FKTvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675552665, "uuid": "ac1c07b5-918b-46c6-af9b-49a443bbc71d", "value": 549736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675552665, "uuid": "1472144f-8b86-4842-9732-5ec94f4189fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675552665, "uuid": "02d7181e-bbf9-4317-8e25-f6086ca2da30", "value": "PO 042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815b1e50-a494-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675519325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519325, "uuid": "1eb9c624-b4ec-4a00-836e-2fe484c6a351", "comment": "Malware payload", "value": "a865901d59c94222dde8f7c400556998", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519325, "uuid": "5de0ac35-9ed8-4303-8958-13aca43776bf", "comment": "Malware payload", "value": "e9721cd756d9ecdf784e71b8941c7d276e585eb4614ed551fe4913185e4908b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519325, "uuid": "af6d52d6-2bfc-4088-b9db-c25ae688f2e0", "comment": "Malware payload", "value": "047b4467a3b7db471e9df873c6792a9ee1cd7688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675519325, "uuid": "07a5ce1b-9cc2-4360-a7af-1da3e33449b7", "comment": "Malware payload", "value": "48a1423705fcba65cf942419f13d78d3e71673d8aa363cf08bb4078b3ebff46373f2eef9e1baef51211b812779ea8eaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519325, "uuid": "b5ea5e07-4b1d-4f25-975e-41280f2ab989", "value": "T1AC037C7278D0C071C13355709C64A5AAFB7AAA2153B8DC276F280578AF31BD1973B39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519325, "uuid": "62b212c0-4a0d-4b86-b85f-db43fabd426a", "value": "768:kqQ9VK+ZRr+HYGhRq7rIcBuIpfLf5liY0hAz23Cau:qVlr+HY0gfHLhli1h4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675519325, "uuid": "7d4882f4-8115-4f8f-b55a-e2d4b5d6678c", "value": 40616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675519325, "uuid": "524a85ac-fe22-4b08-9c6a-9dcfa2929eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675519325, "uuid": "6834b87b-9717-4dcf-8aa2-d712d9b80a22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf0bbdc-a46a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675501384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501384, "uuid": "3078d97b-928e-4ca6-8dbb-074439f66801", "comment": "Malware payload", "value": "631868c42f96526b847354b5c6e96a20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501384, "uuid": "21a1fb44-5ef3-420b-847d-e1d54decf390", "comment": "Malware payload", "value": "ea16c156e0945410756265bc8f26ef528912a79493e5bb9a5e05501404aa3536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501384, "uuid": "c1559e9a-7717-4650-8033-ba4eb7492aa3", "comment": "Malware payload", "value": "189a283451cacb9b871ba430ca8bbb038a04bcfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501384, "uuid": "9d8acd6c-de9d-4775-8db4-55a782bb0d32", "comment": "Malware payload", "value": "a281db92ff9ed9362bbd79bcfe31c52562b03a4e282c43cc815f21a5779c3a297f1cae5a1e85a247060bbe49b0097cbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501384, "uuid": "5dbca485-8e1b-4048-85da-d349eaef2bd7", "value": "T16C52F90675B188B3C43A82B898A18D47F717693597F580331E2C46ADEFA72D45B3B7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501384, "uuid": "11afdf2c-de56-4306-ab79-2b447f7337af", "value": "384:n+WLylnffltltZZzz11ppz9K+Zdm34wugAB+B:+WmK+DixTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675501384, "uuid": "6537f2cd-9188-42c7-9384-681bf0225aab", "value": 13392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675501384, "uuid": "4158bcdc-9a5f-42f9-961b-8a08741078a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501384, "uuid": "a64513ca-db8e-44e0-8ab2-27cac702be84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b70e4bc-a438-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675479640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675479640, "uuid": "ea602b35-1c15-40a3-a393-28d8d91015d4", "comment": "Malware payload (Amadey)", "value": "aa5cdf45ddc9c7cdcd6d5aee1e1c80e2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675479640, "uuid": "c212e033-e4cc-4b0b-b2bd-7dd311feb23f", "comment": "Malware payload (Amadey)", "value": "ebfd81901347f8dffdbc645c62cbc179dcfb89be040a8a47de3a9d74c9255c4b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675479640, "uuid": "13cc5554-b67a-404c-a9f8-57955a30c0a4", "comment": "Malware payload (Amadey)", "value": "ebde213423b18cb4d715e7b080fc90df8954fe14", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675479640, "uuid": "b16382a8-7f91-446a-9e8b-bcf82a737c8e", "comment": "Malware payload (Amadey)", "value": "fddbb3cc344719e2843c2ad588d9748c312a08c3b0ee2e485f7cddbe1db3d57978f599c995f5817a3be0257ac347782e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675479640, "uuid": "e30570a1-88e1-4b4d-8664-fe6f62e19e87", "value": "T10914DF333691C032C47A10347C64DBB56BBEA93186759A4B77A40BAD4F307E06F3A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675479640, "uuid": "896574eb-5d70-499c-86af-51ba27b82779", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675479640, "uuid": "74856a4d-fce8-4e87-abf3-9020bf240e39", "value": "3072:rl7OghcecfL8RkPqbW6+54cKHDkG7auDgaRTD8mh6h2FwWQK9rR:rlfMLukib+KHPDgaRTH1FwHkrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675479640, "uuid": "2b1dd141-7d5b-459e-9765-a812922cae81", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675479640, "uuid": "855fd2c4-d631-4863-8e63-4829d790d98d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675479640, "uuid": "2e71ffef-c44b-40ad-b4a8-28f14a8dd2ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80226cdf-a44f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675489687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675489687, "uuid": "5a2b412b-d477-4da2-9f47-ea9c663c96e4", "comment": "Malware payload (GCleaner)", "value": "6963fd9dc106e34779c7d9d60362f66b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675489687, "uuid": "4f1d09f9-67a8-41ed-8a51-a2e2831d9e91", "comment": "Malware payload (GCleaner)", "value": "ec9baaf173b7bfb79130d9de38ed426c22985ec4f08ac8cbc18503f1225acd92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675489687, "uuid": "65595c58-4bf0-4701-8681-97d66e7a9065", "comment": "Malware payload (GCleaner)", "value": "380852b1e9fd302af72614e3ae0fe7a9322cf5cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675489687, "uuid": "ef26fe93-98fa-481c-8612-0407529c41db", "comment": "Malware payload (GCleaner)", "value": "2702fb44d4ebd3398ff256f293b9963b41b6adc84dc207efeea824f12dc5f00e721c98ea553a2a35f08322d1d16a3f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675489687, "uuid": "578b0503-ca86-4ff1-9cee-c4d3fa092932", "value": "T194B5DF051C98E5ABE1C98FB4CCE39DFB5C11EDB9C1B4481791443EFB7A32E422D86629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675489687, "uuid": "b493539b-58fc-42c6-a1e2-0c9dabc2ae6c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675489687, "uuid": "f4bbfaaf-75f1-4707-a9b4-4a776ca6b438", "value": "49152:d3Z0kDHwHKZJkv9a5AIyTYmxKxrneoHKn6PhUOe6CxTkJT60LCgv2MR:XrwHC69vJTYXxrLq4UOf6kJTNv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675489687, "uuid": "cf9a693c-fd7f-414c-a259-1ad41ffdfd5e", "value": 2323727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675489687, "uuid": "c0b45f02-1ff3-43e0-9393-be51164b9796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675489687, "uuid": "1f3ad348-9c7b-4a1a-aee4-1557c5cc54a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3798e40b-a4ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675529938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529938, "uuid": "f88a999c-b80c-4013-98ac-9f288356ad06", "comment": "Malware payload (RedLineStealer)", "value": "8dc40ddf53bdc0472a2e7cb61b270d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529938, "uuid": "2cb0f9c2-2ef7-487d-b715-dcd3b9046399", "comment": "Malware payload (RedLineStealer)", "value": "eea3064653587e54a46988beb77026830141417a8a552c4b5d1f1d4e0dbdef65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529938, "uuid": "20cc50e6-e4ec-46ea-b1fd-4c565dcd9ca4", "comment": "Malware payload (RedLineStealer)", "value": "55fd9d5be6d20253c7d16b8e0e0cb0bf19882ab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675529938, "uuid": "3e74ba85-ce15-4e81-acab-6827b6cc4966", "comment": "Malware payload (RedLineStealer)", "value": "2c29a486d413bd0d1acfb4f28c15ee6a1fe4aab92d416664e513501ddf92c8e9cd55a48b4f71d296b2a3eedd192d1dd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529938, "uuid": "eb1a45fc-ace1-43cb-b716-919da8bf9862", "value": "T1EFB412367290C472C36B103218B4FEB16FFAF43116768DAB7398169F5F701E0AA76661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529938, "uuid": "7824230b-c61a-4e55-9c2f-29534cf2bc75", "value": "be7581a01c1ad2f53e81adb31665eb55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529938, "uuid": "31a46383-c9f7-4b7d-82a9-b79d9eb2ef75", "value": "12288:mpVtpCnslXsgHUev1+GH3/34MePurA89QHn56feSa+AgqH:AvmgHUe1+83fvckBQHMWgqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675529938, "uuid": "760bb197-dbaf-4d40-856a-00665a527fb8", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675529938, "uuid": "a48594a5-80ba-45d2-8416-cc857d7de93b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675529938, "uuid": "639561ca-24fe-4bb5-8000-d09ea6c4181f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5335b91-a49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675523733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523733, "uuid": "ab88085e-8f29-419c-b48a-1ec9ad4e6ba5", "comment": "Malware payload (Amadey)", "value": "f9b9379ba98d2060e7286ab032d247e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523733, "uuid": "8e9e0dcc-f72c-4813-92b4-ed0995f01dc2", "comment": "Malware payload (Amadey)", "value": "ef837e4549085f90fccd5b3a25082480ea20102458889ea8576c2714404086ea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523733, "uuid": "f1f5423c-2a1e-438b-b73b-3617781667c4", "comment": "Malware payload (Amadey)", "value": "7e7fc068e47d5c8f3397aed0a0b16cda06a84b58", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675523733, "uuid": "8c3b30f4-d42c-451c-86fa-8b0a765b3d1f", "comment": "Malware payload (Amadey)", "value": "4ed08be8628bb1b29d1b29d4ae1c76881090ac67726ecdc1494695099cf6597eb96d39294d4833ac1bac4a00e391a828", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523733, "uuid": "fcf7f899-5e9a-4637-a7a6-d6a07a4b932a", "value": "T1D00523A23240C972C5BE14393420DB19677CBF224AB5885B7B980EBE0F247D11B7775B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523733, "uuid": "aa151d60-e693-4bf4-aaa0-21ce0d5fe18a", "value": "99cebe82e9a09163c3069dbc31af6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523733, "uuid": "88336ace-de1d-48fc-8a16-92dd9893a916", "value": "24576:zdJm3Q6zwuipPR5JGoi+OW9uqeH/0g+vh/tVpb:zdQEuIPRzGoTy/0g6h/tV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675523733, "uuid": "2f24aee8-5f35-4d0c-bce0-02e8b3e62deb", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675523733, "uuid": "6a6b5e8d-bdf0-480e-8383-b2a4236aeeab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675523733, "uuid": "4d6c8c1b-7fb5-441a-9248-5616e232fc6d", "value": "f9b9379ba98d2060e7286ab032d247e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da8027e-a460-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675496823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675496823, "uuid": "e6f3b39f-3ef9-419d-bfda-2b91ee1da9a1", "comment": "Malware payload (GCleaner)", "value": "744cdab4c8da46dc3eec12cafd6757a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675496823, "uuid": "b0457699-7a46-4108-bca1-69bd89d50aa4", "comment": "Malware payload (GCleaner)", "value": "f0f20a6fb439da0fea9dde6f067e35aece864a8924bc9752d5c55a1b3ef3255c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675496823, "uuid": "70ec3baf-3665-44b3-881e-38c192b216d3", "comment": "Malware payload (GCleaner)", "value": "06b43d3558282f086c8f24ced2c4f019c6d89064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675496823, "uuid": "faf18dcf-d32b-4e6a-a595-cfa1869945f1", "comment": "Malware payload (GCleaner)", "value": "5ee1dab4e8ae0dad8152325e665b83bd8d6ad98b853bb54e435bccc7366b1e5a2d4efe0bf19f1ea6e6e000e3eac182f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675496823, "uuid": "43d650e6-c1d8-4e14-9081-91e7138241d1", "value": "T114B5DF165C98E067E0C88FB0CCE36EFB5D10ED79C0B4492791057EFB3A36E522D96629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675496823, "uuid": "851fe5da-5b43-499d-bec8-edbc603dc0dd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675496823, "uuid": "b74e4c3f-6fd6-4ff1-963f-8f3ca1b1a36e", "value": "49152:d3ZAuTTwfCWtoBROmJ4TE1BRbJ/74+6NrHZOYLCgv2MR:XTTTwCRPWEXZJ736/dv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675496823, "uuid": "9204b7b4-e662-4bb8-88d2-ae26ac28d9df", "value": 2318528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675496823, "uuid": "2fdc6d5e-a3cc-482d-a179-51cbb694bf53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675496823, "uuid": "56b72c88-f521-4209-8e0a-b63947aca84f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57ed634-a482-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675511762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511762, "uuid": "0abb8103-cb56-493c-86ae-b083941d3b2b", "comment": "Malware payload (Gafgyt)", "value": "c413f066508594ffaa2208f03a105c1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511762, "uuid": "c7530a5d-05b3-4767-9147-3e69acc5329f", "comment": "Malware payload (Gafgyt)", "value": "f1327dfcac517b4cff52eab6d9d410109de667f7f00e4aac835aa0325c3e6eb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511762, "uuid": "52a66f27-2786-4da0-a179-29cbf95a6323", "comment": "Malware payload (Gafgyt)", "value": "42b194ebac6c75bdf4aaa49482f39b2af741aaa5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675511762, "uuid": "6bf8340a-f800-4d94-8d53-95b2d77e3a73", "comment": "Malware payload (Gafgyt)", "value": "b01732cc564f433b6befd3fdb2637a519ae44ded683fab3fd6135616712159f2f89fdd59d94b4f9e4acd3fab83494517", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511762, "uuid": "82555fc0-2be0-47f5-b7ec-d2d8cd00aaf1", "value": "T177930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511762, "uuid": "bf768653-578e-4403-8d0b-53cf219436f8", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOx+ePczYrmREqQ4b/X7XSee:OQ2HYBv1WT7ePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675511762, "uuid": "f43334b4-0e7f-4124-84a3-63afb9833dbe", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675511762, "uuid": "8d779ceb-0b72-4e6b-965f-c350245c0ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675511762, "uuid": "4f17015f-43b4-431e-982f-81ef8f0019fc", "value": "c413f066508594ffaa2208f03a105c1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e080c4dd-a427-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675472669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472669, "uuid": "1ec5a43b-57a0-47a8-8027-3fa338d95f8b", "comment": "Malware payload (RedLineStealer)", "value": "20dfb45f65b59e034e36b1c5584c63f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472669, "uuid": "087769f2-2b09-4575-8bb8-60c1863e0820", "comment": "Malware payload (RedLineStealer)", "value": "f3162a139191ee7ab512dc14be6002712818fb4b00a3de5dc213d62c6c08beba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472669, "uuid": "a3013491-155d-4f3f-b7ea-b9e7f37d5edd", "comment": "Malware payload (RedLineStealer)", "value": "08c204385efc01ed1aa8ff837572d64db9428809", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675472669, "uuid": "5030d7ab-365e-497a-aa28-36dbcb6ff5fc", "comment": "Malware payload (RedLineStealer)", "value": "7f81570ed6b07b3916f7b2a48d33cc731bdcfe721135f67cee19c1d1a9a251ab053a2a75bbc12023bdc990fca123ee74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472669, "uuid": "17752eb5-689f-456b-bbaa-4843d2d29562", "value": "T124E41292FEE48132D9B51BB018F913870E35FCA5ADB493AB1791348E4CB3540EA75B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472669, "uuid": "0b8899cc-f139-4dca-bf1e-92d0dea23630", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472669, "uuid": "fc68d304-7944-46dc-a571-e1bc0c13db03", "value": "12288:KG7Py90OrmBsLOCgFSiYBwwSP43mjc+I3/VWPbajAw3TJDubTJJ14tRvkENvTw:ny9rmYOCw1YMg3m+/VS+p35mdX8KEN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675472669, "uuid": "d0e4dfe7-54f7-4fb0-9f76-187a7f1fccdf", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675472669, "uuid": "e6b4aa9e-7e8a-4551-b781-6313b76ca24f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675472669, "uuid": "1897a577-bedc-46c1-9ae0-5327d1ec3ceb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b53fd1-a46b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675501912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501912, "uuid": "8c34b188-6573-4256-8253-04af6eec8143", "comment": "Malware payload (Smoke Loader)", "value": "4c29661d6a78acabbdc8797c6a714037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501912, "uuid": "4ccb2357-0e07-4121-8313-a848684adbcd", "comment": "Malware payload (Smoke Loader)", "value": "f46bef25382fcc2f724212312a5f2bc627b62d50228a8d2f56a27f224bf7f649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501912, "uuid": "944c2fa8-7479-4969-8d01-9af9fb5405b7", "comment": "Malware payload (Smoke Loader)", "value": "b42936dca766491d171c5326874d41199701e82f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675501912, "uuid": "4ec5a066-ca4b-426d-8261-0e8bfdb94944", "comment": "Malware payload (Smoke Loader)", "value": "007c3f906fe5999f8379533cebb11d3e1c481b64a41988eefd92629eac9805486f6b786af640a4d9979cc04676be05d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501912, "uuid": "d25d9978-b05a-4f5a-ad84-e2af5a200eb1", "value": "T14914E03339D0C072C5BB107C5864DBA5ABBEA8324675994BBBA80B6E1F303D16737356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501912, "uuid": "55eac759-6f3e-4dec-b309-04d8b663339f", "value": "aea30aa8311fa7a3ea56995ee020184d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501912, "uuid": "bf121c7e-3f4d-4b3d-a044-a00092f7342b", "value": "3072:kbH8JudLgjLuy0JOWLR5HCHLnjq6wdOrxZGANFGVSZD8rn4OhgY0U729:kbjgjL5QOUojQOVZGVS18zcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675501912, "uuid": "76eea990-02db-4319-97df-3f5ffd5f8ce3", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675501912, "uuid": "d42613c7-c69d-41bf-9648-6fe4aee838d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675501912, "uuid": "a9fa8530-4bc0-499a-be39-f70ff69952fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518c5780-a441-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675483596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483596, "uuid": "41e58619-c91e-48f1-b5b3-5329aaca5bcb", "comment": "Malware payload (RedLineStealer)", "value": "07bcc7b57db149170ee127ca07702f39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483596, "uuid": "8f843d90-a4cc-4d05-9784-23e75d905ed8", "comment": "Malware payload (RedLineStealer)", "value": "f58b535b19e79a66b7a24fd19478d69f7ab189aed6aff0b6f7ca8f6544774a08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483596, "uuid": "9981db0d-cbec-4b44-be8e-225dc4f9bc40", "comment": "Malware payload (RedLineStealer)", "value": "47a964d8722e817aedcae1a37c991494eea3047e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675483596, "uuid": "bdbdf5b6-ba6d-4b41-9346-a61c9a7ff592", "comment": "Malware payload (RedLineStealer)", "value": "e04930967bfd43c6ce138a9d5a4a001ac8e5001c5954eb61b6b92ce3ddfc2ed41b2067835e759038301b3e127659c3eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483596, "uuid": "6aa7c38a-ad76-4f0c-8dd2-ad41799bca62", "value": "T15154F1323790D073C5AB00394C60EAA4BBBEB8305A79855777645BBD5F342D1AB3A34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483596, "uuid": "c7e3fc7b-04a6-491c-afa9-9747d4f1bca1", "value": "0b0752cae49392e7dfcbc7d6caf8e684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483596, "uuid": "6d8a632d-c5f8-4604-943d-293b8f6255dd", "value": "6144:EliLyBnmF+ZWf8RZUnZ875CLe1IjnLr6fx7IsdVG6tr:Eli+dm90RZUnZ8FCLeajnL4xMsdfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675483596, "uuid": "a8de7f75-aa01-4551-856f-c5a2fed0bc38", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675483596, "uuid": "85c946c5-f5ac-480e-96aa-db2415fb21fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675483596, "uuid": "e5d7ec6c-9a96-4139-925b-410f1ad6695b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2c9166-a467-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675499879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675499879, "uuid": "0ba8dbce-b810-43c1-b999-4a63bf071a7b", "comment": "Malware payload (RedLineStealer)", "value": "4363d227c02a9e2ec6bdcca5caef3be6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675499879, "uuid": "3fa71e71-08bb-46cd-9ec0-f2edeb865503", "comment": "Malware payload (RedLineStealer)", "value": "f8b9cf1aa72fa4cf17b3286cc3c73f893e2bf491a46c364b3e1c6d1e8f1bcb2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675499879, "uuid": "3b107858-5265-4e6a-ab39-23471e7ff59a", "comment": "Malware payload (RedLineStealer)", "value": "0e9b14d10aca33c73e646ae1be543a1ada537e6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675499879, "uuid": "8414304d-59fc-465e-bf91-e7339bbc4862", "comment": "Malware payload (RedLineStealer)", "value": "2dcfb3481a3fd2198d73766f991ffc90613956a103860d9d49242ae44d35e924f74e01e426115b04d278aabbbea460ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675499879, "uuid": "4e4dbb64-8ad6-4562-9318-7c2b39432872", "value": "T1D4940116A7E94433DDB613B04DF207C30B39BCA1AD74865B66997C5A8DB3680E43273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675499879, "uuid": "c209bb66-89ca-4a04-8008-66bd5fdb6102", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675499879, "uuid": "baa71abd-a80d-4072-b0e5-4b6386afc746", "value": "6144:ohEN7+Zp0yN90QEJnYp8MLfMR7jrufJjaW9qCXOZ4378/mHBHPFc9nN:oG7Fy90SLfYjqjaQq3s1hv8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675499879, "uuid": "aa212f94-17b9-4f2b-829d-861529680c4a", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675499879, "uuid": "ad91bea4-ad80-4c7e-bfb3-469ca5c97802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675499879, "uuid": "c479a73a-a732-4906-94e3-c0bf4220aadd", "value": "4363d227c02a9e2ec6bdcca5caef3be6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78f591d-a4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675527227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527227, "uuid": "2430c2da-b22d-4d52-99dd-4b5eafdd1407", "comment": "Malware payload (RedLineStealer)", "value": "9cc134659561ee2afd14fd6433e9661d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527227, "uuid": "74489d83-8232-4f70-bd78-6b8182f4b2ca", "comment": "Malware payload (RedLineStealer)", "value": "fa17fb4d70e3c39e5548ea0f6980ae951c1f009890d79471b4792360002e34a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527227, "uuid": "53d9a669-0116-4b88-aeeb-6a67bba9c0fa", "comment": "Malware payload (RedLineStealer)", "value": "9c358826da568be19f1c244f810d3ff59087c295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675527227, "uuid": "7fd60b79-d5cd-4404-9c75-0d8f0d810a9b", "comment": "Malware payload (RedLineStealer)", "value": "3a27105332715b7ffd7cfd1f7837eb98120c297bef2bf1bc4a0da5068f8c1ef64fe2dff38cedb33b74c1ebdf152cb8e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527227, "uuid": "47da1644-79b3-43ce-823c-fcfba4f5822e", "value": "T1A1A52303B9D2C8F2F93149354A09E7D16ABD7D302F24C69BE7D91D2DC9350B0B624AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527227, "uuid": "2a494818-7691-43e8-9c6f-bfef07d4ecb0", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527227, "uuid": "32f20804-c137-4cc2-abdf-c8b47b26b76d", "value": "49152:V5O7fPYebhETwwFP+/CHapiBiSyKHKmagg5vtpNuT4D3S:V5EfP1bhmFPaCuiRsmJgnpNuT4DC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675527227, "uuid": "bf835179-2af3-4d04-976f-65278290cfde", "value": 2190290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675527227, "uuid": "58bcd968-94d9-428f-be96-824251b9bffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675527227, "uuid": "c515458a-70a6-43e5-856b-a095e4385c1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24235ff-a4c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675541714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675541714, "uuid": "ac075cd3-464f-4aa9-818a-0c89cbf6b205", "comment": "Malware payload (DCRat)", "value": "1fe4dd92af5c5ee25a09b96be9665b82", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675541714, "uuid": "369779b6-6911-498d-afb8-6121ad23c578", "comment": "Malware payload (DCRat)", "value": "facab8cbe6fc18795a0b062d3517a377ed0eb2405bf09db921fe6698e1db9b6e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675541714, "uuid": "6f6705ba-7f41-4a9b-a527-aa737d8e943a", "comment": "Malware payload (DCRat)", "value": "c5fbb22928e330657e829f36d5d783a7b42bad7d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675541714, "uuid": "0034685e-4a5b-4bd0-9133-26fd397dbb6f", "comment": "Malware payload (DCRat)", "value": "0e444fbd42ece62e3822f76895ac69a85493047e5a09773649174e022308718e8716424204035ece1dd138337f85e4f9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675541714, "uuid": "765b9e0a-b1b5-44f9-a868-35782499968b", "value": "T19575330F5698641BE72B31F7490A278FF6AAC2A54F14CA4DECF029659C0EAC3CD7511E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675541714, "uuid": "9e09cdbf-04c7-4e22-808a-c2588ef51511", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675541714, "uuid": "724de7ac-ae92-454b-b1b4-0ed124b0584a", "value": "24576:TKzrNDIAyCCB2SkYKVTw/e3OyD+hL6kFoKRV1eeGwsYonaNk7oAmZz8ol44FAOqk:TKXFIAyfBvkYsk/4ONhL6kFo85KYJNk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675541714, "uuid": "80f104ab-f78f-422a-9823-380030bc553d", "value": 1555968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675541714, "uuid": "408e0a4e-9066-4e2b-8c44-4907e8a73bb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675541714, "uuid": "2fcbc37e-162b-4536-bc58-93060c0d2ac6", "value": "1fe4dd92af5c5ee25a09b96be9665b82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b44aad-a45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675494317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494317, "uuid": "e4acfa32-5fcf-46a1-9ade-ad8ecba063a0", "comment": "Malware payload (RedLineStealer)", "value": "3aa4f19fc6d87e9316fd624505a25a1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494317, "uuid": "6e886ff5-87a8-412b-a553-2dc61b4d1bcf", "comment": "Malware payload (RedLineStealer)", "value": "fd175c2b3abdea1356f213078f594cd33d643c39ce9db3360f30263bbafa90c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494317, "uuid": "5986d8cb-a1e2-4619-a2ce-05c29dd6c6d1", "comment": "Malware payload (RedLineStealer)", "value": "110f4b8ead3b62bd414e3eebefe7317a047f3474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675494317, "uuid": "2d56a2a2-eacc-44f9-9929-0c2a28d87fe7", "comment": "Malware payload (RedLineStealer)", "value": "035b9cc461b149db71cefa04028f4f27e3b61d4908fd9b0f957fc5ed5d938560b13426f0759497f5489a0d0b01c7da1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494317, "uuid": "06235f72-e3b4-40b5-9ac8-addb0bc82af3", "value": "T1DD0522317B50C0F2C05925748C50D758BFBEA62176B8A98BBB4B27ED9F312D01E36366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494317, "uuid": "90e1b8ee-27da-4c07-a881-e4c5d00a0b10", "value": "99cebe82e9a09163c3069dbc31af6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494317, "uuid": "15dc7f1f-d1a2-473b-a52b-9ca68fdaf67a", "value": "12288:gJwegjoPW8UQ3RMOnRm8IrGe44fn4FWhpB5uAMQVwLNFct9MNmQrceF:gGRoPW2MmFQnPhQAUFoCkQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675494317, "uuid": "f37c9f2f-8b44-4e35-891c-23c7cdfb630e", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675494317, "uuid": "47444509-f390-46ff-a62f-b141cf8bdb4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675494317, "uuid": "8438eb52-29d0-4a3b-8f2b-00bf49b1f056", "value": "3aa4f19fc6d87e9316fd624505a25a1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077d60f8-a4ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675535441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675535441, "uuid": "c4bde1d3-aa7c-40a4-ba32-019f87785dd8", "comment": "Malware payload (RedLineStealer)", "value": "fdb1079f281cfde3d9984167331a6919", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675535441, "uuid": "11c2a83e-dffb-4540-ad78-afc2e5b64490", "comment": "Malware payload (RedLineStealer)", "value": "feb87f71e1a8522ec1c77710ab9d6d70b3a5f4713911c4c870d0d9699e444421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675535441, "uuid": "a519025c-c47f-4577-8cfe-2a04759b0f88", "comment": "Malware payload (RedLineStealer)", "value": "d29500d4d712dd5e28e13086ea82ccdf697aa75a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675535441, "uuid": "d8572f50-b30c-46fa-a59a-9a76d1a33ea0", "comment": "Malware payload (RedLineStealer)", "value": "fdb1d5e2de5fb3905eaf131ca7e2d12e7e1b61c9c73acf578c378de5672c778e5d304f19d01a87aada526237cf53f827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675535441, "uuid": "b6301809-c0e4-402d-b85c-7f5a3d9f6500", "value": "T17184F12232D0C0B2C57A34346854EBA1ABAFB834D5758E0B3BA813FD4F747D15B76296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675535441, "uuid": "5eebd89e-2d7f-4deb-9a2e-084f2086943e", "value": "158a612a52d4365bdc88fe279a20e1a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675535441, "uuid": "413afe68-0e36-4bef-8c23-992ec0e44905", "value": "6144:oR1LHvkRMOB2222pAikkVELsTAVJTfvP8LWTSN6ApVS8vA:oR1LMRMOB2xIzV6s0f3PyWTe6ApVHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675535441, "uuid": "8a549458-5946-49da-b82d-f4de80eeea6d", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675535441, "uuid": "ff6aeab8-17ce-41f4-843d-b0c8f95053a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675535441, "uuid": "538f0580-b5dc-42be-a0cf-cb1c09807e37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d6013d-a479-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675507608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675507608, "uuid": "6acf593a-fb19-4c1a-a935-6ba7ed6817ea", "comment": "Malware payload (GCleaner)", "value": "fff48c17a075546fe02658a90f6324d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675507608, "uuid": "38d178ad-9a6e-4d3c-8b28-4457fed82b76", "comment": "Malware payload (GCleaner)", "value": "ff69e912b43837aa85f1ded1848f888f15c090efef9572cdc95f76c993e3928d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675507608, "uuid": "683ca7f5-bcd5-4b4f-9650-446461b6adc6", "comment": "Malware payload (GCleaner)", "value": "a81395c371d02aee8c1ede1d9ccfcd7c057fac77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675507608, "uuid": "6ef23644-edfc-4830-91a0-13d606bffa9d", "comment": "Malware payload (GCleaner)", "value": "57d62dad526077235f1bd58ec06515335b03012d9d148d1a16643a63750b2589daf7f8f08136a2e4dd34dbf1614b497e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675507608, "uuid": "cc7818f1-5951-4050-8404-7c41eecf3b19", "value": "T188B5EF165C98E067E0C98FB0DCE36DFB0C15ECB9C0B8181791547EFB3A32E522C96669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675507608, "uuid": "ee382e2c-8c7c-4f92-8f1d-f7a2469ad65f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675507608, "uuid": "11a297d6-cec0-4019-b814-1552f7b41207", "value": "49152:d3ZPpHj5oB5xP7Jh4VpLX/K5efrOSBvOklYb7s/iNDLCgv2MR:XxHFoB5xzwfXC5grO0vZYbI/0Hv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675507608, "uuid": "235c2b83-230a-405b-97af-d267b97a03d4", "value": 2317502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675507608, "uuid": "38def78e-1c06-4850-b647-e99da76eac17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675507608, "uuid": "f551c74c-804d-4ea1-aca6-910d7064a165", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }